WHY DOES INDIA NEED A DATA PROTECTION AUTHORITY?

THE CONTEXT: Data has become crucial for any country. After the Supreme Court Judgement in Puttaswamy Case in 2017, the debate about the privacy of users is on the floor every time. There is a demand for the proper setup for the protection of users’ data. Data protection Authority is an effective solution in this regard. This article analyses the importance of data protection authority in the securing of users’ data.

 WHAT IS DATA PROTECTION AUTHORITY AND WHY IS IT REQUIRED?

India’s data protection authority (DPA), as envisaged under the proposed Personal Data Protection (PDP) Bill, has been entrusted with the crucial responsibility of protecting and regulating the use of the personal data of citizens.

• India has around 290 million social media users, 340 million messaging application users and around 400 million search engine users. These can easily be siphoned off to a foreign land and used for micro-targeting advertising.
• In similar cases, the EU has the General Data Protection Regulation and the US laws dealing with issues of privacy with the help of such authorities.
• In 2018, Srikrishna Committee also recommended Such Authorities for effective security of data.

PROTECTION FROM WHOM?

Basically, personal data is collected and processed by

• State actors => central and state governments and their instrumentalities;
• Non-state actors => private organisations providing services, social media intermediaries, e-commerce entities, big tech companies and employers
• The central and state governments are one of the largest data fiduciaries (who collect, hold and process data) in a wide array of state activities such as national security, welfare administration, subsidies, provision of municipal services and employment benefits etc.
• Similarly, in the age of big data, non-state data fiduciaries such as social media intermediaries like Facebook, Twitter, YouTube and giant e-commerce platforms also collect large amounts of personal data on a day-to-day basis.

WHY DATA PROTECTION IS REQUIRED?

  WHAT IS RIGHT TO PRIVACY AND WHY IT IS IMPORTANT?

• A right to privacy is defined broadly as “the right to be let alone.”
• It usually excludes personal matters or activities which may reasonably be of public interest.
• The right to privacy is our right to keep a domain around us, which includes all those things that are part of us, such as our body, home, thoughts, feelings, secrets and identity.
• The right to privacy gives us the ability to choose which parts in this domain can be accessed by others and to control the extent, manner and timing of the use of those parts we choose to disclose.

In the Puttaswamy case, the SC instructed the government to pass a law that would regulate informational privacy not only from non-state actors but also from the state parties and other individuals.

DEVELOPMENTS AFTER THE SUPREME COURT JUDGEMENT?

• In August 2017, the Supreme Court held that privacy is a fundamental right, flowing from the right to life and personal liberty under Article 21 of the Constitution. The Court also observed that privacy of personal data and facts is an essential aspect of the right to privacy.
• In July 2017, a Committee of Experts, chaired by Justice B. N. Srikrishna, was set up to examine various issues related to data protection in India.
• The Committee submitted its report, along with a draft Personal Data Protection Bill, 2018 to the Ministry of Electronics and Information Technology in July 2018.
• In 2019, the Personal Data Protection Bill was introduced in Parliament that is not passed yet.

OBJECTIVE OF THE BILL

• Its regulatory nature not only creates a safe environment for a data principal to get his/her data processed but also protects the right of data fiduciary to profess.
• Gives both the partners in this relationship certain rights and liabilities for it to work effectively.
• Makes sure that the judgement made by the Supreme Court and the rights under the Constitution is protected and safeguarded.
• It attempts to create a secure mechanism for processing of data, establishing certain norms for social media intermediaries, cross-border transfer, liabilities of agencies processing personal data, remedies for illegal, unauthorized and harmful processing, and to lay down a framework of a Data Protection Authority for India for the above said purpose.
• The need for the Bill is derived from the growth of the digital economy and the purpose of monitoring the valid use of data as a means of communication.

PROVISION REGARDING DATA PROTECTION AUTHORITIES

• The Bill sets up a Data Protection Authority which may:

1. 1. take steps to protect the interests of individuals,
2. 2. prevent misuse of personal data, and

• 3. ensure compliance with the Bill.
• It will consist of a chairperson and six members, with at least 10 years of expertise in the field of data protection and information technology.  Orders of the Authority can be appealed to an Appellate Tribunal.  Appeals from the Tribunal will go to the Supreme Court.

HOW DPA IS EMPOWERED TO PROTECT THE DATA?

• The Chairperson of the authority will have the power of superintendence and to give direction for the affairs. The authority will itself appoint members and officers it deems necessary for discharging its duties under this act.
• The most important function of the authority would be to protect the right to privacy that is to protect the interests of data privacy, prevent any misuse of the data, promote data security awareness and comply with the provisions of this act. Other responsibilities or the powers of the authority include formulating regulations and policies for all the purposes as stated above to regulate the data processing, inclusive of all such regulation required provisions.
• The authority has the power to enact code for the practice in the good faith of the data processing companies and entities. The code of practice shall be formulated for an agency, association, or industry involving personal data processing. The authority has the role of maintaining the code and making necessary changes to adapt to the needful.
• The Authority may, for the purpose of discharging of its functions under this Act, issue directions. From time to time as it may deem necessary directions can be issued to some data fiduciaries or data processors in general, or to a particular data fiduciary or a data processor. By the means of provisions of such order or directions, a data fiduciary could be bound to comply with the directions.
• The authority has the power to call for information for discharging its functions as required by the Bill from data fiduciaries and data processors. The authorized officer in the authority has the power to seize any computer resource or any other document if it gives any doubt of misconduct or violation of regulations under the act.
• The authorized officer in the authority has the power to seize any computer resource or any other document if it gives any doubt of misconduct or violation of regulations under the act.

WHAT ARE THE ISSUES: AN ANALYSIS?

WHAT INDIA CAN LEARN FROM BEST PRACTICES

1. EU MODEL

2. CHINA MODEL

There is no single regulatory authority that deals exclusively with data protection/privacy matters. The Cyberspace Administration of China (CAC) is currently generally considered the primary data protection authority in the PRC, although various other legislative and administrative authorities have claimed jurisdiction over data protection matters, such as:

• National People’s Congress Standing Committee
• Ministry of Public Security
• Ministry of Industry and Information Technology
• State Administration for Market Regulation
• Ministry of Science and Technology

Other sector-specific regulators, such as the People’s Bank of China or the China Banking and Insurance Regulatory Commission, can monitor and enforce data protection issues of regulated institutions within their sector.

WAY FORWARD:

• The DPA must be established not as a regulatory body appointed by the central government but as a quasi-judicial independent body having judicial representation and should be subjected to only judicial oversight and monitoring and not executive supervision as envisaged in the current Bill.
• Need for a decentralised DPA structure with state bodies and bodies at the district level like the Consumer Protection regime and to a certain extent, the Right to Information regime.
• As DPA will be an umbrella regulator over the sectoral regulators, there is a greater need to make it not only independent and competent but also efficient and effective.
• There is a need to set up an independent DPA, which can implement the Personal Data Protection Bill in an unbiased manner. It cannot appear to be under the direct command and control of the central government.

CONCLUSION: Maintaining a balance between informational privacy and the development of a strong digital economy is a truly challenging task, requiring a qualified and neutral body at the helm. India can unlock its true digital potential as a data market only with an independent DPA, and not by a regime that irreparably harms our constitutional values and citizens’ right to informational privacy.

Just add to your knowledge