India moves closer to first data privacy law

PANEL MOOTS NEW AUTHORITY TO PREVENT ‘MISUSE’; LAYS DOWN ‘EXCEPTIONS’

Recommending what it termed a “fourth way to privacy, autonomy and empowerment” that was distinct from other international experiences, the Justice BN Srikrishna Committee on Friday proposed a draft Personal Data Protection Bill that could form the basis of India’s first data privacy law.

The committee, which said it had combined the principles of individual ‘privacy’ with using data for ‘empowerment’, also proposed the constitution of a Data Protection Authority (DPA) of India with the mandate of protecting the interests of users who it described as “data principals”, and preventing the “misuse of personal data”. It called for financial penalties and jail terms in the case of violations.

The committee -- set up to recommend a legislative framework for data privacy in 2017 -- submitted its report and the proposed bill to the Union minister for law and justice, and electronics and Information Technology, Ravi Shankar Prasad.

The proposed bill makes individual consent the centrepiece of data sharing, awards rights to users, imposes obligations on “data fiduciaries”— all those entities, including the State, which determine purpose and means of data processing. It also lays out provisions on data storage, making it mandatory for a copy of personal data to be stored in India, and called for amendments to other laws, including the Right to Information. Though the bill does not mention it directly, the report also suggests changes to the Aadhaar Act.

The committee argued that such a law would protect “individual privacy, ensure autonomy, allow data flows for a growing data ecosystem, and create a free and fair digital economy”.

In its report, the committee said: “It is the duty of the state to put in place a data protection framework which, while protecting citizens from the dangers to informational privacy originating from state and non state actors, serves the common good.”

Receiving the report, in response to a question on broad timeline for the bill to become a law, Prasad said, “I hope you understand we can also have some more feedback, consultations, go to Parliament, which can either pass it or refer it to a standing committee. And being a very monumental law, even for myself, I would like to have the widest possible consultation process.”