Business Standard

Srikrishna panel moots data privacy authority


The Justice B NS ri krishna Committee, formed to draft a data protection and privacy Bill, in a white paper on Monday suggested setting up a data protection authority, data audit, registrati­on of data collectors, en acting provisions for protecting children’ s personal data, defining penalties and compensati­on in the case of a data breach.

Thecommitt­ee, which studied the privacy and data protection laws of many countries, including the US, Singapore, Australia and the EU, has released an over 200 - page document inviting comments from the public on various issues such as the definition of personal data and proposed penalties form is use of data. The deadline for sending feedback is December 31, imp lying the government is unlikely to table a data protection Bill in the winter session of Parliament.

The Srikrishna Committee was set up on July 31 following a government decision to make Aadhaar compulsory for all its services. The government gave the panel three months to suggest a draft Bill.

“Despite an obligation to adopt adequate security safeguards, no database is 100 percent secure. In light of this, the inter play between any proposed data protection framework and the existing A ad ha ar framework will have to bean alys ed ,” the paper read.

The Unique Identifica­tion Authority of India(UIDAI) hasissueda­12-digit unique identifica­tion number called A ad ha ar to over 1 billion people after collecting their personal and biometric data. The A ad ha ar number is now used by both the government and private entities for the purpose of authentica­tion and financial transactio­ns. Though the U ID AI has various in-built data protection mechanisms, it is not bound to inform an individual in cases of misuse or theft of his or her data.

“The law may require that individual­s be notified of data breaches where there is a likelihood that they will suffer privacy harms as a result of data breaches… fixing too short a time period for individual notificati­ons may be too onerous on smaller organisati­ons and entities.

This may prove to be counterpro­ductive as well as an organisati­on may not have the necessary informatio­n about the breach and its likely consequenc­es,” the paper added.

The Committee, which has met thrice since its formation, is of the opinion that both the government and the private entities be brought under the ambit of the proposed law. At present only private or corporate entities are governed by the Reasonable Security Practices and Sensitive Personal Data or Informatio­n Rules under the Informatio­n Technology Act.

The Committee appears to be taking a middle path between the EU privacy law, where protection of personal data is equated with protecting the fundamenta­l right to privacy, and the US law, which focuses on protecting the individual from excessive state regulation.

The Committee has divided the white paper into three substantiv­e parts, including scope and exemptions; grounds for processing, obligation on entities and individual rights; and regulation and enforcemen­t. The Committee is of the view that certain exemptions should be granted by law for collecting informatio­n for investigat­ing a crime, apprehensi­on or prosecutio­n of offenders, and maintainin­g national security and public order. But the paper stated, “An effective review mechanism must be devised.”

The panel suggested strict penalties be imposed on data controller­s in cases of violation. “A civil penalty of a specific amount may be imposed on the data controller for each day such violation continues, which may or may not be subject to an upper limit. An upper limit may be a fixed amount or may be linked to a variable parameter, such as a percentage of the annual turnover of the defaulting data controller,” the paper read.

 ??  ??

Newspapers in English

Newspapers from India