The Data Protection bill will enable privacy violation, not guard against it

The public consultation process for such an important Bill deserves scrutiny. It went on for 42 days, from November 18, 2022, to January 2, 2023. This is too small a window for any intelligent reading of a complex bill. The process demanded that “one had to give specific feedback to individual clauses”, each within 2,500 characters. Thus, a critic could not comment on the overlaying logic, gaps, or priors of the Bill, and had to accept the framework, This makes any substantiative criticism impossible.

Also, the comments have not been made public, thus academics cannot access or analyse what the common objections were and if the ministry has responded in any substantial manner to them. In the final analysis, public consultation around this Bill served an ornamental purpose.

There are perilous issues with the content of the final draft, which a short article like this cannot cover. They have been discussed in detail by organisations like the Internet Freedom Foundation. More egregious points have emerged after the consultancy process.

The third clause of the new draft makes the Bill irrelevant for any data made public by the person/organisation who created it, or if that data was public to comply with some legal procedure. This looks innocuous on the surface. After all, publicly available data should be outside any regulation. But it enables harm. Publicly available data on the internet falls prey to data scraping. Automated data scraping without any regulatory oversight has the potential to reveal, via machine learning, sensitive intelligence that individuals did not consent to reveal when they posted some ostensibly harmless data on the internet.

Social and economic intelligence obtained thus could give first movers monopolistic power, and cause harm to social and economic rights. This is why European regulations like the GDPR explicitly cover this issue with stringent norms, including brakes on the mass collection of “public” data from social networks. The fact that the Bill does not address this at all makes it a useless law. It fails to tackle contemporary issues with AI companies creating surveillance tech with publicly available personal text and image data — something that violates the essence of the K S Puttaswamy v Union of India (2017) judgment, and creates opportunities for exploitation and predatory behaviour by companies.

Next, the August 2023 draft of the Bill completely alters the process of selection of the members of the Data Protection Board. All members will now be selected by the government. This creates a board controlled by the executive with no independence, contrary to the idea of data justice present in the original draft of the Personal Data Protection Bill created by the B N Srikrishna Committee in 2018.

The appellate tribunal which one can plead to against the decisions of this board has also been changed with no rationale provided as to how it was selected. Simultaneously, the exemptions granted to the government have been expanded. In the earlier versions of the draft, only notified agencies were exempted. Now, any data collected by such agencies is exempted even if the data is later processed by a different agency and regardless of the legality of the purpose.

Finally, aside from the changes that worsen aspects of the Bill, the cynical policymaking of the November 2022 draft remains. Employers, being “private” entities, are exempted even if they collect the personal data of the employees as long as the collection is deemed for performance evaluation purposes.

This, of course, legitimises ubiquitous invasive data collection in office spaces, invasive biometrics on blue-collar workers, and via apps for gig workers, enabling more sophisticated exploitation while simultaneously universalising a culture of surveillance and chilling worker agency at workplaces.

The “private” is thus made a meaningless concept with corporate rights subordinating public rights; this is also seen with the RTI 2005 Act being diluted, because of which there will no longer be a public interest exception for disclosure of “private” information. Private entities in possession of someone’s data under this Bill can also assume consent and share that data with other private entities, for an unspecified duration, without informing the person.

At this juncture, it is unlikely that most or even some of these issues will be addressed by the Rajya Sabha before the Bill becomes law. But it is vital to sharply point out what is wrong with this Bill and to keep educating people on the same. After all, people make their own history, even if under circumstances directly encountered, given and transmitted from the past.

Also Read

P Chidambaram writes: Aid and Advise

Inside Track by Coomi Kapoor: Allied problems, Cong-AAP ties & Hema Malin...

Faizan Mustafa writes: New penal code falls short of its laudable objectives

Suhas Palshikar writes: The rise of bulldozer governance

The writer is an assistant professor, working on AI, Data, and Policy, at the Ashank Desai Centre for Policy Studies at IIT Bombay