Post-RTI, buzz now is privacy law

Disclosure of info only in public interest

An expert group has suggested a law to protect privacy of citizens, recommending that both government and private sector organisations should be covered by the proposed legislation, being drafted by the Department of Personnel and Training.

Suggesting a “conceptual framework” for the proposed legislation to the Planning Commission on Thursday, the group recommended that right to privacy should be extended to individuals, except in cases of national security, public order and prevention, detection, investigation and prosecution of criminal offences.

Disclosure of information shold be made only when it is in public interest. Protection of an individual or rights and freedom of others may also be considered an exception to the application of the proposed right to privacy law, the group headed by former Chief Justice of Delhi High Court A P Shah said.

The ambit of the privacy legislation should extend to data being processed in India, and data that originated in India, even when it is transferred internationally. The violation of the proposed law should constitute an offence and penalty be imposed on the violator, it recommended but did not quantify the amount of penalty.

Prime Minister Manmohan Singh had recently called for maintaining a “fine balance” between the Right to Information (RTI) Act and the Right to Privacy.

He also said the citizens’ right to know should definitely be circumscribed if disclosure of information encroached upon someone’s personal privacy.

This came in the wake of RTI activist Arvind Kejriwal’s accusations against the dealings of the company owned by Robert Vadra with housing major DLF and Union Ministers including P Chidambaram terming the dealings as “an issue between two private individuals.”

While releasing the report, Justice Shah noted that protection of the right to privacy guaranteed under the Constitution was a major concern with the initiation of programmes like Unique Identification number, NATGRID and DNA profiling, most of which will be implemented through the communication and information technology in the country.

To ensure protection of right to privacy of individuals, the panel outlined nine “national privacy principals” for collection, processing, storage, access retention, destruction and maintaining anonymity of the information collected about an individual.

Under these principals, a data (information) controller will be required to give simple information to all individuals in clear and concise words before collection of any personal information about them. The individuals will also be given choice with regard to providing personal information.

So far telephones were tapped by an executive order. The panel has recommended that under emergency situation, telephone of an individual could be tapped by an executive order just for first 15 days.

The authorities will have to seek a court order for continuing further tapping of telephone of an individual, Justice Shah said.

After personal information has been used in accordance with the identified purpose, it should be destroyed. Data retention mandates by the government should be in compliance with the national privacy principals, the report said.

Justice Shah, however, clarified that recommendations his committee for formulation of the proposed legislation would not come in conflict with the Right to Information Act, saying, “RTI also recognizes right to privacy.” The privacy Act should not circumscribe the Right to Information Act.

Additionally, RTI recipients should not be considered a data controller, the panel categorically said in its report.