Government Policies

KEY POINTS

·         The draft has included well recognised privacy principles on how a notice should be sent to individuals before data is collected.

·         It also expresses that for the consent to be valid it must be free, informed, specific, clear and capable of being withdrawn, besides prescribing explicit consent for sensitive personal data.

·         Purpose limitation and collection limitation also feature prominently in the draft bill.

·         Similarly, some of the key rights of individuals, such as the right to confirmation and access, right to correction and right to data portability, are part of the bill and would go a long way in providing individuals with control of their data.

·         Finally, the creation of a data protection authority is sorely needed, and it will lead to a strong, independent and specialised regulator.

·         These positive developments are, however, significantly compromised by provisions which dilute the privacy protections under the draft bill.

·         The bill does not restrict consent as the sole ground for processing.

·         Under Section 13, personal data of individuals can be processed “for the exercise of any function of the state”.

·         This can be done without the consent of the individual as long as it is to provide a service or benefit to the individual.

·         This implies that for most interactions between the state and the citizen, there is no requirement for the state to obtain consent to process a citizen’s data.

·         Similarly, other grounds of processing, such as ‘purpose related to employment’, are poorly worded and provide employers an unhealthy degree of discretion on how they can deal with their employees’ data.

·         One key subject missing from the draft bill is the reform of surveillance laws.

·         The provision that will hurt businesses is the need to maintain a copy of all personal data collected on a server or data centre located in India.

·         This has been introduced to deal with problems with data requests faced by investigative agencies, when they require data hosted outside India.

·         However, the proper response to this problem is to work with other countries on reforming the mutual legal assistance treaties.

·         Requiring all businesses to store data within India, without any reform of surveillance governance, will pose even bigger privacy issues in the future.

Please Review 

Thank You

Kindly review.