'Less of a privacy protection bill'

'More like data is the new oil bill'

The Justice B N Srikrishna Committee has come out with its much-awaited report on data protection law and a draft bill. Activists are not happy with the report as they feel it shies away from addressing certain concerns. BJD MP Tathagata Satpathy is one MP who was closely following the debates and discussions on data privacy. He believes the report is more a let’s regulate-"data is the new oil” bill. He spoke to Shemin Joy of DH on the "A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians" report and the draft Personal Data Protection Bill, 2018.

The Justice B N Srikrishna Committee has come up with a report and a draft bill on data protection. What is your sense of committee report and bill?

We have waited nearly a year for this expert committee report to come. It was set up right during the Supreme Court case where the Government was arguing that privacy was not a fundamental right and another matter where it was being questioned why there was no strong legal regime to regulate how private companies like WhatsApp, Facebook are treating our citizen’s data.

The expert committee report provides only a very basic, weak structure. It focuses too much on allowing companies and government departments to use our data, rather than protecting the rights of individual Indian citizens. It is less a privacy protection bill, or more a let’s regulate-“data is the new oil” bill.

The expert committee recognised that current government surveillance may be unconstitutional and excess ive, especially after the Supreme Court’s right to privacy judgement nearly a year ago. But they stop short there and have made no actual surveillance reform recommendations either as specific outputs in their report or in their draft data protection bill.

I think the draft data protection bill is only a start - and a slightly disappointing one at that. We will have to do much to improve and fix it.

No actual surveillance reform recommendations either as specific outputs in their report or in their draft data protection bill

Do you see the possibility of the government bringing the bill to Parliament in the Winter Session?

There is limited time for the government to bring this bill. They ideally should have completed their expert committee process earlier and held a public consultation on the draft bill.

The minister should immediately seek open public inputs, and not just from their chosen experts and the industry, in addition to feedback from the states, and present this to Parliament right at the start of the next session.

The government could also seek better consensus and support by openly discussing this Bill and their approach to privacy before Parliament’s Standing Committee on Information and Technology. That committee started hearings on the issue of citizen privacy and data security back in April right after Cambridge Analytica but has so far only heard from bureaucrats in the Ministries of Home Affairs and Information and Technology – no voices of citizens or public interest groups.

It is crucial that this bill is studied effectively, improved and amended, and passed only as a strong comprehensive law but must definitely be passed before the general elections. In this era of Cambridge Analytica and election interference, the safety of our citizen’s data and protecting their privacy is a fundamental duty on all in government and elected positions.

The report/bill does not squarely address government surveillance. Rather, it does away with the inconvenient question by simply suggesting that the government bring in a separate law. Is that a fair assessment? How likely is it that the government will bring a separate law to tame intelligence agencies?

The expert committee report admitted that the current legal regime and government processes for surveillance are not strong enough when it comes to protecting privacy, which our Supreme Court confirmed and strengthened as a fundamental right nearly a year ago. But despite saying this and tossing around a few ideas in a chapter, they have done nothing. No specific recommendations on what amendments or further legal reforms should be made on existing Indian law regarding spying on citizen communications, tapping their phones and devices. No amendments or other measures included in their draft citizen data protection bill. Not a single clear recommendation or instruction to government despite nearly a year of work by this committee and so many specific suggestions to them.

Parliamentarians have previously tried on their own initiative to bring more oversight, controls on our intelligence agencies. There was a private members bill, and even repeated statements and appeals for reform by our previous vice president.

The expert committee’s bill should have made a start, by updating all of our existing laws on phone tapping and communications surveillance. Even the Privacy Bill that was started by the UPA across 2011-14 and taken forward to the NDA government in 2015 has sought to include surveillance law reform in their ambit. So rather than just being a missed opportunity, this is actually a step back. We are now the only major democracy in the world where phone tapping and surveillance is only controlled by police officials and bureaucrats, with no judicial or other independent overview and no regular, institutionalised oversight by Parliament.

In this era of Cambridge Analytica and election interference, the safety of our citizen’s data and protecting their privacy is a fundamental duty on all in government and elected positions.

Tathagata Satpathy (Image credit: https://loksabha.nic.in)

The draft bill suggests ways to strengthen Aadhaar law. It seems to assume that Aadhaar meets the standard of the Supreme Court (Puttaswamy) judgement on privacy and proceeds from there, while the apex court is still to rule on its constitutionality. What is your view on the Justice Srikrishna Committee’s approach? Does it mostly tiptoe around how the government collects, processes and uses people’s personal and sensitive data?

The committee appeared to be a bit obsessed with furthering their vision of a “digital economy”, perhaps one that they viewed as only being fuelled by the data of our citizens. And their approach to the government using data appears to constantly recommend exceptions. For example, they give a wide carve out for data collected under "any" law passed by Parliament from requiring its collection and usage to be consented to by the people to whom it belongs. That is a massive loophole - they could have instead named and included the specific laws they believe were such rare, special cases, but instead just give themselves a broad exception that they will always seek to use.

On Aadhaar, their report very clearly appears to note that the current system and its Aadhaar Act are broken and dysfunctional. They even recommend several amendments to the Aadhaar Act - many of which are similar to the concerns that MPs raised two years earlier but which the government steamrollered over by its brute majority in the Lok Sabha and treating it unlawfully as a money bill before the Lok Sabha. But they did not make these amendments to the Aadhaar Act as part of their Citizen Data Protection Bill - apparently, they believe that fixing the broken, Orwellian Aadhaar system is only a “nice-to-have”.

Trai chairman R S Sharma recently put out his Aadhaar number and dared hackers to show him what harm they could do to him with that number. Was that expected of a person who is the country’s telecom regulator? Where does that episode leave the whole idea of data protection in this country?

Officials holding high statutory office - particularly as regulators seeking to safeguard the interests of citizens - should act as befitting the responsibilities and trust placed on them. They must be regarded as always seeking to safeguard the law and be available as enforcers for the interests of citizens as Parliament as enacted and not be seen as defending other interests or government agendas.

India must ultimately have a strong, independent Privacy Commission headed by a chairperson who seeks to not only protect the fundamental right of privacy of citizens when it comes to government agencies and the private sector but also expand and further their rights along with improving the culture of how user data is treated in India.

We are now the only major democracy in the world where phone tapping and surveillance is only controlled by police officials and bureaucrats, with no judicial or another independent overview

What improvements will you seek in the draft data protection bill?

It must be a bill that protects the interests of citizens with respect to their privacy and protecting their data first, and not that of first focusing on lubricating the interests of only certain large firms who want to exploit one vision of a digital economy. Citizens and privacy advocates have already been working on this, in the same way, they stood up for network neutrality in India three years ago. Please see the SaveOurPrivacy.in effort and its Model Indian Privacy Code.

Citizens must have several more, and stronger rights to their data. They should be given meaningful controls, including not being forced to give their data wholesale in order to be entitled to use certain services. And wide carve-outs, loopholes for how government departments and agencies can collect data without notifying users and obtaining their meaningful consent must be tightened or removed.

We must have a more independent and stronger Privacy Commission system, with an effective central institution and an enabling legal framework for enforcing privacy interests across India’s states, as befitting our status as a federal democracy. We must not have a Data Protection Authority which can be controlled, influenced by the Central Government or industry interests

A Privacy Act must include reforms to surveillance law and current practices. It can no longer be a 'babu' controlled system that allows mass spying at the behest of who-ever is the ruling party. And the Privacy Act must trump, amend, and override the broken Aadhaar Act.