Firstpost: National: Thursday, July 26, 2018.
The justice
BN Srikrishna committee had been appointed to draft a data-protection law for
India on August 2017, following the Right to Privacy ruling. The 10-member
panel was expected to present its draft last month, after many delays. But so
far, there is still no certain date as to when it will be released.
In the
meantime, TRAI has released its recommendations on privacy, security and data ownership
in the telecom sector.
There have also been reports of how the Srikrishna
committee may ask Google, Facebook and others to store their data
locally.
Caravan claims to have got access to the draft of the proposed law,
which is tentatively titled, "The Protection of Personal Data Bill,
2018".
This draft comprising around 15 chapters covers topics such as data
localisation, the creation of a data protection authority, data protection
measures, separating personal and sensitive data and also proposes some
amendments to the Aadhaar Act, 2016 and the Right to Information Act, 2005.
Measures
pertaining to the Aadhaar Act 2016
The report goes on to state that the changes
to the Aadhaar Act include offline verification process for Aadhaar, increasing
or creating civil and criminal penalties for contravening the Aadhaar Act and a
new adjudication process to address disputes arising out of Aadhaar. There is a
proposal for the appointment of an adjudicating officer above the rank of a
joint secretary in the Union government, with the power to make inquiries in
case the Aadhaar Act is found to be violated in any manner.
The Telecom Disputes
Settlement and Appellate Tribunal has been suggested as the appellate body for
any appeal against the appointed adjudicating authority and only appeals from
this tribunal will be heard by the Supreme Court.
This really does not change
the status quo by much, as the common man still cannot approach the courts in
case of any Aadhaar-related disputes. As the report notes, in the current
setup, only the Unique Identification Authority of India (UIDAI) can approach
the courts in case of any disputes. A look at the number of Aadhaar-related
data breaches in the last couple of years and the attitude of UIDAI, which
refuses to acknowledge its own shortcomings, should give you enough of an idea
of how flawed the system is.
The suggestion by the draft on data protection law
on 'offline' Aadhaar verification also seems incomplete. Offline verification,
under the current Aadhaar Act, cannot be deemed as a method to authenticate, as
any authorised body seeking Aadhaar verification does a real-time query with
the Central Identities Data Repository (CIDR) which is maintained by the UIDAI.
In the case of offline verification, there is no clarity on how it will be
executed, even though on the surface it does intend to address issues with
authentication, such as poor network connectivity, change in biometric
information and so on. But 'offline' means there would be no real-time querying
of the CIDR database. How then would the Aadhaar identity be verified? Does it
mean that the agency doing the offline verification will have access to a local
CIDR database? Will the data be stored on a new type of Aadhaar card? What
about potential data breaches in these cases? There seem to be no clear
directions on this.
Measures
pertaining to RTI Act, 2005
The changes proposed to the RTI Act could possibly
allow officials to withhold details and make them less accountable under the
garb of increased privacy.
According to the current Section 8(1)(j) of the RTI
Act, "information which relates to personal information, the disclosure of
which has no relationship to any public activity or interest, or which would
cause unwarranted invasion of the privacy of the individual unless the Central
Public Information Officer or the State Public Information Officer or the
appellate authority, as the case may be, is satisfied that the larger public
interest justifies the disclosure of such information: Provided that the
information, which cannot be denied to the Parliament or a State Legislature
shall not be denied to any person.."
This section of the act, according to
the report, is misused by a lot of information officers to deny answering RTI
queries.
According to the draft data protection bill, this section has been done
away with altogether.
In its place, there is another provision in the bill which
requires three conditions to be fulfilled before disclosing any personal data
under the RTI. These conditions include:
(a) the personal data relates to a
function, action or any other activity of the public authority in which
transparency is required to be maintained having regard to larger public
interest in the accountability of the working of the public authority;
(b) if
such disclosure is necessary to achieve the object of transparency referred to
in clause (a); and
(c) any harm likely to be caused to data principal by the
disclosure is outweighed by the interest of the citizen in obtaining such
personal data having regard to the object of transparency referred to in clause
(a).
With no clear definitions of 'public interest', these requirements give the
information officers more leeway against disclosing personal information, says
the report.
We are yet to see the actual draft of the data protection bill, but
these two measures suggesting amendments to two major acts definitely raise a
lot of concerns at face value. Hopefully, the final draft of the bill, when it
is finally, if ever, disclosed, will address the questions raised by the
report.
.JPG)
.JPG)
