For a robust data protection regime

The Personal Data Protection Bill, 2019 is on its way to becoming one of the first comprehensive pieces of legislation on data in the world. It aims to protect the fundamental right of privacy of citizens against excesses by both the State as well as private entities, including the powerful Big Tech companies like Google and Amazon and social media intermediaries such as Facebook, Twitter, etc.

This, however, is not the limited purpose of the Bill. The underlying objective of the legislation is transformative as it aims to recognise the value of data in promoting a free and fair digital economy even while keeping personal data of citizens secure and protected.

The report by the Committee of Experts, under the chairmanship of Justice Srikrishna, based on which the Government of India drafted the Bill, titled ‘A Free and Fair Digital Economy — Protecting Privacy and Empowering Indians’. The Committee’s report laid emphasis on providing equal importance to both the aims of the Bill, as is evident from the title and approach by the Committee.

An extract from the report summarises its approach: “(..) any regime that is serious about safeguarding personal data of the individual must aspire to the common public good of both a free and fair digital economy.”

Free and fair digital economy

The transformative objective of the Bill is also articulated in its Preamble, which states that “it is necessary to create a collective culture that fosters a free and fair digital economy, respecting the informational privacy of individuals, and ensuring empowerment, progress and innovation through digital governance and inclusion .” Basically, the Committee and the Bill rightly realised the value of data in oiling the economy if used responsibly and purposefully.

Public good is often seen as a competing interest to the individual’s right to privacy. A false trade-off between public interests of economic growth and data protection has often led a few cities to advocate for a narrow approach to the PDP Bill. However, practically, fundamental rights of individuals often go on to increase public goods.

This has found recognition in the Srikrishna Committee Report and the PDP Bill, where the individual is not treated as an atomised unit standing apart from the collective, but a part of it and their interests are inextricably linked. Rights to citizens empower the citizenry as a whole. Both the protection of personal data and facilitation of the growth of the digital economy serve a common constitutional objective of a free and fair digital economy.

As the report of the Committee notes, “such an economy (free and fair) envisages a polity where the individual is autonomously deciding what to do with her personal data, entities are responsibly sharing such data and everyone is using data, which has immense potential for empowerment, in a manner that promotes overall welfare.”

In furtherance of promoting this notion of common public good, the PDP Bill allows certain exemptions for data fiduciaries to share and use personal data of individuals in a manner that furthers the common public good.

First, in case of public health emergencies such as epidemics or disaster management measures, personal data can be processed and collected without consent of the data principal. The right to health of community over that of individual’s informational privacy is given deference in the Bill.

Second, data collected for recruitment or termination of employment of a data principal by the data fiduciary is exempted from consent. This enables corporates and start-ups from being saddled with prohibitive costs of storage, maintenance and regulation, thereby facilitating ease of doing business.

Third, the Bill creates research exemptions, i.e., it exempts data used for archiving, research and statistical purpose from the full force of its provisions.

Fourth, for encouraging innovation in artificial intelligence, machine-learning or any other emerging technology in public interest, the Bill has provisions for creating regulatory sandboxes.

Regulatory sandboxes permit limited regulatory exemptions so that companies can carry out tests and experiments without being overburdened with prohibitive initial compliance costs.

Fifth, the Bill also has exemptions for journalistic purposes subject, however, to compliance with any code of ethics issued by the Press Council of India or by any media self-regulatory organisation.

Sixth, manual data processing by small entities are largely exempted from provisions of the Bill to protect small and medium sector enterprises from undue hardships of compliance.

Seventh, the Bill allows exemptions to collection and processing of personal data for legal proceedings, prosecution and investigations.

Lastly, the Bill enables the Central Government to be free to use anonymised or non-personal data for better targeting of public services and for formulation of evidence-based policies.

The way forward

Even though the Bill has taken strident steps towards achieving a free and fair digital economy, some issues remain unresolved. Blanket power to the Central Government to exempt itself or its agencies from any of the provisions of the Bill by way of an executive order needs a relook.

Similarly, the independence of the Data Protection Authority and adjudicatory authorities under the Bill are issues which require a deeper engagement. There is also over centralisation of powers into the Central Government, leading to stress in co-operative federalism. Further, there is an urgent need for a robust consent framework. Given the lack of digital awareness and literacy in India, one cannot presume that the consent given by citizens will be free and informed.

A truly transformative data protection regime in India must be one that empowers citizens and also limits governments’ misuse of powers. Only with such a robust framework, India can confidently move towards the goal of becoming a leader in building a strong and robust digital economy.

Patnaik, a former CAG bureaucrat, is a Rajya Sabha MP from Odisha. Pratap is a practising advocate. Views are personal