Activists raise pitch as data privacy law panel may submit report soon

With the Justice B N Srikrishna Commission likely to submit its report on a new data privacy law soon, activists and lawyers have stepped up efforts to ensure that the law is not diluted.

A group of young lawyers under the banner 'Save Our Privacy', supported by the Internet Freedom Foundation, has now come up with an 'Indian Privacy Code' that proposes a fine that runs up to Rs 10 crore and a jail term of five years if somebody "collects, receives, stores, processes, discloses or otherwise handles any sensitive personal data" illegally or conduct unlawful surveillance.

For violating the privacy of citizens, the Code proposes a fine running up to Rs 1 crore and a prison term of up to three years. The Code proposed by them includes action against private parties in case of violation of privacy.

In August, the government appointed a 10-member Committee of Experts on a Data Protection Framework for India under Justice Srikrishna to "make specific suggestions for consideration of the central government on principles to be considered for data protection in India and suggest a draft data protection bill." The panel came out with a 243-page white paper in November.

The need for a robust data protection law arose amid reports of a leak of 'Aadhaar' data and controversy surrounding Cambridge Analytica harvesting personal details of Facebook users.

The draft law by the commission, which will be placed before Parliament, is expected to be a robust law that would deal with and regulate the use of personal data by technology companies like Facebook, Google and others.

The Code proposed by the lawyers pitch right to privacy as an "inalienable fundamental right" and emphasises that personal data can be collected only with one's consent.

It also wants all data collected, processed and stored prior to the date on which this law comes into force to be destroyed within a period of two years from the date on which it comes into force.

Also, one has the right to request erasure and destruction of data at any time and such requests should be complied within a time-frame, manner and mode to be prescribed by the Privacy Commission, which is to be set up by the government.