Data Protection Bill gives Centre unlimited powers

The proposed Data Protection Bill gives the government power to access any non-personal information from anywhere at any given time.

This gives the Centre unlimited power over any data that is not listed as personally identifiable. It will also be able to exempt government agencies from the provisions of the Bill.

“The Central Government may, in consultation with the Authority (proposed Data Protection Authority), direct any data fiduciary or data processor to provide any personal data anonymised or other non-personal data to enable better targeting of delivery of services or formulation of evidence-based policies by the Central Government, in such manner as may be prescribed,” the Bill reads, pointing to the increased powers the Centre has given itself; these were not mentioned in the draft, which was under consultation.

The Bill, at the same time, gives consumers the right to erase their online data but will have to provide an adequate reason for it. Technically called the “Right to be forgotten”, it essentially allows users to restrict or prevent the continuing disclosure of his/her personal information to an entity that collects data.

But the right is not absolute and only applies in certain circumstances. Though this might offer benefits for consumers, it can create nightmares for corporates.

“We are confused at this point in time whether or not an enterprise will be required to store data separately for law enforcement purposes. For example, if a person asks Uber to revoke his data from the company and later if the government wants to track that user by accessing Uber’s location data for law enforcement purposes, will the cab-hailing app company be required to hold the data (to provide them for law enforcement) despite the deletion request from the user?” said Akshay Garkel, Partner at Grant Thornton.

In this example, if Uber keeps data for law enforcement despite the user’s request not tostore his information, the user can sue the company. There is nothing in the Bill on how a company in this situation will be able to store data for law enforcement needs without breaking the law.

COMMENT NOW