This August will mark six years since privacy was reaffirmed as a fundamental right in as many words by the Supreme Court in the truly landmark Puttaswamy versus Union of India case. The promised law on personal privacy of all Indians, protection of their data, and responsibility and accountability of data fiduciaries which are primarily governments and private corporations which collect so much individual data is still in the making. This week, according to reports, the union cabinet approved the draft Digital Personal Data Protection (DPDP) Bill, finally setting the stage for it to become law.
From the constitution of the Justice Srikrishna Committee constituted to examine the SC judgment and draw up a draft, the exercise has seen multiple iterations with even the title of the Bill changing. Sections of the civil society and independent data-privacy experts have weighed in on the drafts and made several suggestions to make the Bill as strong as possible in favour of individual citizens who are seen only as data-that-can-be-mined by both sets of data fiduciaries. What is appalling is the government’s approach. Even if the approach of the private corporations is justified on the grounds of their profit motive, the government is Constitutionally obliged to uphold the rights and welfare of citizens in formulating the law and implementing it.
As the largest collector and storehouse of personal data of all Indians, the central government and its various agencies should have been conscious and ethical enough to put forth a Bill that would uphold rights as well as offer easy compliance and grievance redressal for citizens who may not have the knowledge or assistance to protect their privacy and make the handling of their data transparent. Earlier drafts had fundamental points on how personal data can be handled, how data of minors should be dealt with and so on, but its provisions on certain aspects such as “deemed consent” were controversial. Part of this allowed the government and its agencies wide powers to collect and store personal data and allow sweeping exemptions by any department or authority from the proposed law making a mockery of it.
The latest iteration too apparently contains such grey areas which need thorough examination and revision. In the last decade, India’s digitalisation and digital economy has galloped and expanded to cover a wide range of activities in the daily lives of citizens, rich or poor, educated or not. But the government has dragged its feet on the transparency and legal protection that citizens need. It is already too late, toomuch data has been collected and misused with zero accountability.
