The Wire:
National: Thursday, September 27, 2018.
Right
to Information and privacy rights activists have together rejected the
amendments proposed to the Right to Information Act, 2005 in the Data
Protection Bill, 2018 drafted by the Justice Srikrishna Committee.
In
a joint statement, the activists pointed out that the Committee of Experts
under the chairpersonship of Justice B.N. Srikrishna tasked with drafting the
Data Protection Bill was expected to develop a framework harmonising the need
to protect certain kinds of personal data with the provisions of the RTI Act,
2005, which lays out the statutory framework for Indian citizens to access
information, including personal information, but it failed to “safeguard and
balance the two”.
Giving
a detailed account of why they were opposed to the proposed amendments, RTI
activists owing allegiance to National Campaign for Peoples’ Right to
Information (NCPRI) and privacy rights activists from Save Our Privacy said the
right to both information and privacy are fundamental rights which flow from
the constitution.
Pointing
out that “the State has an obligation to protect and promote both rights,” they
said to strengthen democracy and constitutional freedoms, it is critical that
the two rights are carefully balanced.
‘Draft
Data Protection Bill proposals will severely restrict the scope of RTI Act’
In
this backdrop, they noted that the Justice Srikrishna Committee, tasked with
drafting the Data Protection Bill, was expected to develop a framework
harmonising the need to protect certain kinds of personal data with the
provisions of the RTI Act. “However, the Draft Data Protection Bill, 2018 (DPB)
prepared by the committee, fails to safeguard and balance the two. If accepted,
the amendments proposed to the RTI Act, 2005 through the DPB will severely
restrict the scope of the RTI Act and adversely impact the ability of people to
access information.”
Stating
that Section 8(1)(j) of the RTI Act, 2005 states that “notwithstanding anything
contained in this Act, there shall be no obligation to give any citizen
information which relates to personal information the disclosure of which has
no relationship to any public activity or interest, or which would cause
unwarranted invasion of the privacy of the individual unless the Central Public
Information Officer or the State Public Information Officer or the appellate
authority, as the case may be, is satisfied that the larger public interest
justifies the disclosure of such information,” the activists said this
exemption was, however, not absolute.
They
said information was still required to be disclosed “if it is such that cannot
be denied to the Parliament or a State Legislature (proviso to 8(1)), if public
interest in disclosure outweighs the harm to the protected interests (section
8(2)) or if the information relates to any event or matter which has taken
place twenty years ago (section 8(3)).”
Srikrishna
panel changed the definition of RTI section 8(1)(j)
But
now, the activists said the Justice Srikrishna Committee has proposed that
Section 8(1)(j) be amended to read as follows: “Notwithstanding anything
contained in this Act, there shall be no obligation to give any citizen –
information which relates to personal data which is likely to cause harm to a
data principal, where such harm outweighs the public interest in accessing such
information having due regard to the common good of promoting transparency and
accountability in the functioning of the public authority.”
The
activists said the panel has provided some exceptions stating that “provided,
disclosure of information under this clause shall be notwithstanding anything
contained in the Personal Data Protection Act, 2018; provided further, that the
information, which cannot be denied to the Parliament or a State Legislature
shall not be denied to any person.”
They
said for the purpose of this section, the terms “personal data” , “data
principal” and “harm” were to have the meaning assigned to them in the Personal
Data Protection Act, 2018.
Data
Protection Bill seeks to severely curb the disclosure of information
On
how the change to the definition would impact release of information, the
activists explained that currently in order to invoke section 8(1)(j) to deny
personal information, at least one of the following grounds has to be proven –
information sought has no relationship to any public activity; or information
sought has no relationship to any public interest; or information sought would
cause unwarranted invasion of privacy and PIO/appellate authority is satisfied
that there is no larger public interest that justifies disclosure.
However,
by replacing this with the proposed formulation that personal information would
be exempt if it can be shown that disclosure is likely to cause harm and such
harm outweighs public interest, they said: “the DPB seeks to severely curb the
disclosure of information”.
Mere
possibility of harm enough to deny information; definition of harm also widened
The
activists elaborated that now “the proposed amendments refer to a mere
possibility of harm, rather than a reasonable certainty.”
Moreover,
they said, the definition of term “harm”, which is sought to be applied to
section 8 of the RTI law, has also been made very broad and expressed
apprehension that “this would have a chilling effect on the RTI Act”.
“The
term ‘harm’ is defined as (i) bodily or mental injury; (ii) loss, distortion or
theft of identity; (iii) financial loss or loss of property, (iv) loss of reputation,
or humiliation; (v) loss of employment; (vi) any discriminatory treatment (vii)
any subjection to blackmail or extortion; (viii) any denial or withdrawal of a
service, benefit or good resulting from an evaluative decision about the data
principal; (ix) any restriction placed or suffered directly or indirectly on
speech, movement or any other action arising out of a fear of being observed or
surveilled; or (x) any observation or surveillance that is not reasonably
expected by the data principal,” they said.
Scope
of public interest test for release of information narrowed
On
the other hand, the activists pointed out that “the scope of the public
interest test within the proposed section 8(1)(j) appears to have been
narrowed, by restricting it primarily to the promotion of transparency and
accountability in the functioning of a public authority, as opposed to a more
expansive understanding of public interest in terms of upholding constitutional
values of social justice, welfare and democratic rights of citizens.”
‘Data
Protection Bill drafted hastily, has many errors’
The
two groups of activists also said the proposal to amend the RTI Act through the
Data Protection Bill, 2018 appears to have been hastily drafted based on an
incorrect understanding of the RTI law. “For instance, the Justice Srikrishna
Committee seems to have erred in interpreting the proviso to Section 8(1),
which states that “information which cannot be denied to the Parliament or a
State Legislature shall not be denied to any person”, as being only applicable
to section 8(1)(j) and not to the whole of section 8(1),” they said, adding
that there were also several judicial pronouncements to this effect.
Activists
question composition of Srikrishna panel
The
activists also mentioned that since the constitution of the Justice Srikrishna
Committee, many of them had raised concerns regarding lack of diversity in its
composition and lack of transparency in its functioning.
Stating
that they believe that the legal framework for privacy and data protection
should complement the RTI Act and in no way undermine or dilute the existing
statutory framework that empowers citizens to hold power structures to account,
the two groups demanded that the provisions of the Draft Data Protection Bill
be suitably amended and harmonised with the provisions and objectives of the
RTI Act.
They
said this would also be in keeping with the recommendation of the Justice A.P.
Shah report on privacy (2012) which had stated that “The Privacy Act should
clarify that publication of personal data in public interest, use of personal
information for household purposes, and disclosure of information as required
by the Right to Information Act should not constitute an infringement of
privacy.”
‘No
need for amendment to RTI Act’
Finally
the activists, who include Anjali Bhardwaj, Venkatesh Nayak, Nikhil Dey, Rakesh
Dubbudu, Pankti Jog, Pradip Pradan, Dr. Shaikh, Ashish Ranjan, Nachiket Udupa,
Amrita Johri, Rakshita Swamy and Sai Vinod from NCPRI, and Raman Jit Singh
Chima, Vrinda Bhandari, Naman M. Aggarwal, Gautam Bhatia, Apar Gupta, Prasanna
S., Praavita and Ujwala Uppaluri from Save Our Privacy, reminded people that
“neither the recognition of the Right to Privacy, nor the enactment of a data
protection law, requires any amendment to the existing RTI law”.
Therefore,
they said, they reject the amendments proposed to the Right to Information Act,
2005 in the Data Protection Bill, 2018 drafted by the Justice Srikrishna
Committee.