Excellent study material for all civil services aspirants - begin learning - Kar ke dikhayenge!
SHARE:
Data Protection Regime (DPR) in India
Read more on - Polity | Economy | Schemes | S&T | Environment
- Pandemic, digital and protection: The Covid-19 pandemic automatically increased people’s participation in the digital economy. Unfortunately, the number of personal data breaches from major digital service providers has increased worryingly in the same period. While the EU and other nations have legislated proper data protection laws, India has none till date.
- The first signals: The need for a more robust data protection legislation came to the fore in 2017 post the Supreme Court’s landmark judgment in Justice K.S. Puttaswamy (Retd) v. Union of India established the right to privacy as a fundamental right. In the 9-0 judgment, the Court called for a data protection law that can effectively protect users’ privacy over their personal data. So, the Ministry of Electronics and Information Technology formed a Committee of Experts under the Chairmanship of Justice (Retd) B.N. Srikrishna to suggest a draft data protection law.
- Mobikwik breach: The March 2021 data breach at fintech firm MobiKwik was perhaps India’s biggest breach with the data of 9.9 crore users at risk. Given the significance of data in this age, robust data protection regimes are necessary to prevent such events and protect users’ interests. Presently, how different entities collect and process users’ personal data in India is mainly governed by the Information Technology Act, 2000, but this data protection regime falls short of providing effective protection to users and their personal data.
- PDP pending: The Personal Data Protection Bill, 2019 (which is now under scrutiny by a Joint Parliamentary Committee) could play a big role in providing robust protections to users and their personal data.
- Associated issues:
- Consent - Data aggregator entities could override the protections in the regime by taking users’ consent to process personal data under broad terms and conditions. This is problematic given that users might not understand the terms and conditions or the implications of giving consent.
- Data Privacy poof - The frameworks under IT Act emphasize data security but do not place enough emphasis on data privacy. While entities must employ technical measures to protect personal data, they have weaker obligations to respect users’ preferences in how personal data can be processed.
- Data Protection poof - The data protection provisions under the IT Act also do not apply to government agencies. This creates a large vacuum for data protection when governments are collecting and processing large amounts of personal data.
- Obsolete - The IT Act was enacted in 2000 and further amended in 2008. However, technology and cross-platform integration have increased exponentially. So, the current data protection regime seems to have become inadequate in addressing risks emerging from new developments in data processing technology.
- How PDP helps: This Bill brings a meaningful change to personal data protection in India through this regime. The proposed regime under the Bill seeks to be different from the existing regime in some prominent ways.
- Roles defined - The Bill envisages codifying the relationship between individuals and firms/state institutions as one between “data principals” (whose information is collected) and “data fiduciaries” (those processing the data) so that privacy is safeguarded by design. The Bill seeks to apply the data protection regime to both government and private entities across all sectors.
- Privacy focus - The Bill seeks to emphasize that data principals will have to maintain security safeguards to protect personal data and also have to fulfill a set of data protection obligations and transparency and accountability measures.
- Citizens rights - The Bill seeks to give users a set of rights over their personal data and means to exercise those rights. For instance, a user will be able to obtain information about the different kinds of personal data that an entity has about them and how the entity is processing that data.
- Regulator - The Bill seeks to create an independent and powerful regulator known as the Data Protection Authority (DPA). The DPA will monitor and regulate data processing activities to ensure their compliance with the regime. The DPA will give users a channel to seek redress when entities do not comply with their obligations under the regime.
- Associated issues: Many provisions in the Bill create cause for concern about the regime’s effectiveness. These provisions could contradict the objectives of the Bill by giving wide exemptions to government agencies and diluting user protection safeguards. For instance, under clause 35, the Central government can exempt any government agency from complying with the Bill. Government agencies will then be able to process personal data without following any safeguard under the Bill. This could create severe privacy risks for users. Similarly, users could find it difficult to enforce various user protection safeguards (such as rights and remedies) in the Bill. The Bill threatens legal consequences for users who withdraw their consent for a data processing activity. This could discourage users from withdrawing consent for processing activities they want to opt-out of. The DPA will be tasked with regulating the provisions of the bill to frame regulations on issues such as mechanisms for taking consent, limitations on the use of data, and cross-border transfer of data. The supervisory mandate of the DPA is sweeping, given the fact that it has to regulate a wide array of preventive obligations, such as security safeguards and transparency requirements.
- The road ahead: In this digital age, data is a valuable resource that should not be left unregulated. So to have have a robust data protection regime is crucial. The Joint Parliamentary Committee scrutinizing the Bill was expected to submit its final report in the Monsoon Session of Parliament in 2021. This interim period shall be utilized to make some changes in the Bill targeted towards addressing various concerns in it could make a stronger and more effective data protection regime.
* Content sourced from free internet sources (publications, PIB site, international sites, etc.). Take your
own subscriptions. Copyrights acknowledged.
COMMENTS