The Indian Express: New Delhi: Friday,
September 14, 2018.
Justice BN Srikrishna Committee’s draft
Personal Data Protection Bill 2018 is introducing a new right the right to be
forgotten, to remove very old, irrelevant and unnecessary information links
from social media networks. This concept is prevalent in the European Union
(EU) and France, though it was not preferred in the US to the more valuable
press freedom. Mario Costeja Gonzalez wanted Google and a Spanish newspaper, La
Vanguardia, to remove a 1998 news item about selling off property to pay off
debts. The EU court in 2009 upheld his right not to be reminded of that
unpleasant part of his life. The US court did not agree with William James
Sidis, a former child prodigy, who did not want The New Yorker to publish about
his past.
In India, after a person got a
certificate of marriage with a woman’s name who never married him, her father’s
plea to annul that marriage certificate was accepted by the Karnataka High
Court. A rape victim has a right that her past be forgotten. At the same time,
a criminal cannot claim that he has the right to insist that his conviction
should not be referred to by the media, the Gujarat High Court said.
As per the Srikrishna Committee’s Bill,
an adjudicating officer, who is not a judge but a bureaucrat, will decide.
According to Section 27 of the Bill a data principal (for instance, a former
minister convicted earlier) has a right to prevent the data processor or data
fiduciary (could be a TV, web portal or newspaper) from using such data or
information if data disclosure is no longer necessary, the consent to use data
has been withdrawn or if data is being used contrary to the provisions of the
law.
Section 27(2) says the adjudicating
officer can decide on the question of disclosure, and the circumstances in
which he thinks such disclosure can override the freedom of speech and the
citizen’s right to information. In determining this, the adjudicating officer
has to consider five factors listed in subsection (3). They are: (a) the
sensitivity of the personal data; (b) the scale of disclosure and the degree of
accessibility sought to be restricted or prevented; (c) the role of the data
principal in public life; (d) the relevance of the personal data to the public;
and (e) the nature of the disclosure and of the activities of the data
fiduciary, particularly whether the data fiduciary systematically facilitates
access to personal data and whether the activities would be significantly
impeded if disclosures of the relevant nature were to be restricted or
prevented.
Aggrieved by the order of the
adjudicating officer, one can file for a review. If he reaffirms the decision,
an appeal can be made to the appellate tribunal. This is fine as far as data
protection is concerned. But when the data principal is a public servant (for
instance, a former minister), and the data fiduciary is a newspaper or web
journal, the freedom to criticise the public personalities for their public
policies based on their past statements and activities will be in jeopardy, and
a journalist has to wait for the decision of the adjudicating officer to clear
her writing about it. A citizen seeking access to such information will be
confused whether to approach the CIC or DPA these adjudicating officers are
subordinate to members of the Data Protection Authority.
The right to be forgotten in the Bill
might spell a danger to press freedom. The PDP Bill says the rights of the data
principal, including the right to be forgotten, are exempted if the purpose of
data processing is in the interest of the security of state (Section 42). But,
the Bill says, Parliament should pass a law explaining the procedures to
determine the interests and to create another authority to decide the
disclosure. These rights will not apply to the processing of data in the
interests of prevention, detection, investigation and prosecution of any
offence or any other contravention of law (Section 43). For that, too, however,
Parliament has to make a law to consider and achieve such interests. The
Srikrishna Committee did not suggest any draft for these two additional
provisions contemplated under Sections 42 and 43. Even for this, Section 4
(right to privacy needs to be respected) and, Section 31 (fair and reasonable
processing duties) will apply.
An exemption “for journalistic purpose”
is provided in Section 47 saying that where the processing of personal data is
necessary for or relevant to a journalistic purpose, the provisions of Chapters
II to VIII of the Act shall not apply, except SS 4 and 31. Section 27(2)
disappoints. It says Section 27(1) applies only where the journalist
demonstrates that the processing is in compliance with any code of ethics
issued by (a) the Press Council of India, or (b) any media self-regulatory
organisation. This means the journalist has to prove that privacy was taken
care (Section 4) and all safeguards prescribed were complied with (Section 31).
Journalistic publication will be dependent upon the opinion of a dealing clerk
or adjudicating officer. These are additional pre-publication restrictions on
citizens and media which were never contemplated by the Constitution and
rejected by the judiciary.
The penalty provisions are severe and
costly. Section 74 gives the power to impose a penalty to the adjudicating
officer after an inquiry, besides facilitating compensation (Section 75).
Failure to adhere to security standards (Section 31) might lead to a penalty of
up to Rs 5 crore (Section 69). A penalty of up to Rs 1 crore can be imposed
where any person fails to comply with any provision of this Act, for which no
separate penalty has been provided in the Act (Section 73). This can easily be
used against journalists.
Is this constitutional? Article 19(2) of
the Indian Constitution did not provide “privacy” as a ground for imposing
restrictions. This Bill fails on constitutional verification by the judiciary,
unless “privacy” is added in Article 19(2) by a major amendment to the
Constitution. The Data Protection Bill is going to be a serious threat to press
freedom and RTI.