The justice BN Srikrishna committee had been appointed to draft a data-protection law for India on August 2017, following the Right to Privacy ruling. The 10-member panel was expected to present its draft last month, after many delays. But so far, there is still no certain date as to when it will be released.
In the meantime, TRAI has released its recommendations on privacy, security and data ownership in the telecom sector.
There have also been reports of how the Srikrishna committee may ask Google, Facebook and others to store their data locally.
Caravan claims to have got access to the draft of the proposed law, which is tentatively titled, “The Protection of Personal Data Bill, 2018”.
This draft comprising around 15 chapters covers topics such as data localisation, the creation of a data protection authority, data protection measures, separating personal and sensitive data and also proposes some amendments to the Aadhaar Act, 2016 and the Right to Information Act, 2005.
Woman using an iris scanner for UIDAI Aadhaar registration. Image: Reuters
Measures pertaining to the Aadhaar Act 2016
The report goes on to state that the changes to the Aadhaar Act include offline verification process for Aadhaar, increasing or creating civil and criminal penalties for contravening the Aadhaar Act and a new adjudication process to address disputes arising out of Aadhaar. There is a proposal for the appointment of an adjudicating officer above the rank of a joint secretary in the Union government, with the power to make inquiries in case the Aadhaar Act is found to be violated in any manner.
The Telecom Disputes Settlement and Appellate Tribunal has been suggested as the appellate body for any appeal against the appointed adjudicating authority and only appeals from this tribunal will be heard by the Supreme Court.
This really does not change the status quo by much, as the common man still cannot approach the courts in case of any Aadhaar-related disputes. As the report notes, in the current setup, only the Unique Identification Authority of India (UIDAI) can approach the courts in case of any disputes. A look at the number of Aadhaar-related data breaches in the last couple of years and the attitude of UIDAI, which refuses to acknowledge its own shortcomings, should give you enough of an idea of how flawed the system is.
The suggestion by the draft on data protection law on ‘offline’ Aadhaar verification also seems incomplete. Offline verification, under the current Aadhaar Act, cannot be deemed as a method to authenticate, as any authorised body seeking Aadhaar verification does a real-time query with the Central Identities Data Repository (CIDR) which is maintained by the UIDAI. In the case of offline verification, there is no clarity on how it will be executed, even though on the surface it does intend to address issues with authentication, such as poor network connectivity, change in biometric information and so on. But ‘offline’ means there would be no real-time querying of the CIDR database. How then would the Aadhaar identity be verified? Does it mean that the agency doing the offline verification will have access to a local CIDR database? Will the data be stored on a new type of Aadhaar card? What about potential data breaches in these cases? There seem to be no clear directions on this.
A woman goes through the process of finger scanning for the Unique Identification (UID) database system, Aadhaar, at a registration centre in New Delhi, India. Image: Reuters
Measures pertaining to RTI Act, 2005
The changes proposed to the RTI Act could possibly allow officials to withhold details and make them less accountable under the garb of increased privacy.
According to the current Section 8(1)(j) of the RTI Act, “information which relates to personal information, the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual unless the Central Public Information Officer or the State Public Information Officer or the appellate authority, as the case may be, is satisfied that the larger public interest justifies the disclosure of such information: Provided that the information, which cannot be denied to the Parliament or a State Legislature shall not be denied to any person..”
This section of the act, according to the report, is misused by a lot of information officers to deny answering RTI queries.
According to the draft data protection bill, this section has been done away with altogether.
In its place, there is another provision in the bill which requires three conditions to be fulfilled before disclosing any personal data under the RTI. These conditions include:
(a) the personal data relates to a function, action or any other activity of the public authority in which transparency is required to be maintained having regard to larger public interest in the accountability of the working of the public authority;
(b) if such disclosure is necessary to achieve the object of transparency referred to in clause (a); and
(c) any harm likely to be caused to data principal by the disclosure is outweighed by the interest of the citizen in obtaining such personal data having regard to the object of transparency referred to in clause (a).
With no clear definitions of ‘public interest’, these requirements give the information officers more leeway against disclosing personal information, says the report.
We are yet to see the actual draft of the data protection bill, but these two measures suggesting amendments to two major acts definitely raise a lot of concerns at face value. Hopefully, the final draft of the bill, when it is finally, if ever, disclosed, will address the questions raised by the report.