Terms of Privacy

Context: Parliament must scrutinise the challenges associated with ‘Data Protection Bill, 2019’ an should tighten the framework, and move quickly to usher in a data protection architecture in India.

Challenges in Personal Data Protection Bill, 2019: Analysis of Joint Committee of Parliament

• Concern with Sections 35 and 12 of the draft legislation: Both sections are against the provision of blanket exemptions, more so without the creation of an oversight mechanism.
• Section 35: Centre can exempt from the application of all provisions of the Act any agency of the government when it is deemed to be in national and public interest. 
• Section 12(a)(i): It creates the space to exempt the government from provisions of consent, allowing it to collect personal data without individual approval. 
• Privacy concerns revolve around personal data, if data is non-personal, and anonymised.
• Bringing in data collection by electronic hardware, law has been created a specific distinction between hardware and software.
• Clash between IT Rules and Data Protection Bill: While the committee has suggested all social media platforms (not intermediaries) be treated as publishers, there are concerns about provisions under IT Rules.
• Lack of clarity in implementation: Seems to be a concerted push towards data localisation, though whether or not it will be implemented in a graded manner, depending on the sensitivity of data, is unclear. 

Way Forward:

• Section 12 and 35 need to be scrutinised in greater detail: Adequate safeguards must be put in place to protect the right to privacy, and prevent the misuse of personal information.
• Need to widen the ambit of the personal data protection bill, bringing in non-personal data under its scope. 
• Require a regulatory architecture for non-personal data. 
• Need to bring all social media intermediaries under the ambit by redesignating them as social media platforms. 

==========================================================================================