EDITORIAL ANALYSIS : The dangers in the Digital Personal Data Protection Bill

Source: The Hindu

• Prelims: RTI Act, CIC, Digital Personal Data Protection Bill, Governance etc
• Mains GS Paper I and II: Statutory, regulatory and various quasi-judicial bodies, Important aspects of governance, transparency and accountability etc

ARTICLE HIGHLIGHTS

• The government is set to introduce the Digital Personal Data Protection (DPDP) Bill in Parliament.
  • The final draft is wrapped in secrecy.

INSIGHTS ON THE ISSUE

Context

The Right to Information (RTI) Act:

Important provisions:

Objectives:

Background of Digital Personal Data Protection Bill:

• It was placed in the public domain in December 2022 but the final Bill has not been placed before the public.
• It has two provisions which would greatly weaken the Indian citizen’s right to information.
• It plans to amend RTI Act Section 8(1)(j) to read as exempting information under (j), which relates to personal information
• The proposed Bill defines the term ‘person’ very widely to include individuals, companies, and the state.
  • Most information except budgets would be linked to one of these.

What are the issues with circulation?

• MeitY focused primarily on consulting industry and big tech companies on a law that will have vast ramifications for the information regime in India
  • It will impact every citizen of the country.

The Digital Personal Data Protection Bill, 2022:

• It is a crucial pillar of the overarching framework of technology regulations the Centre is building.
• It includes the
  • Digital India Bill(the proposed successor to the Information Technology Act, 2000)
  • The draft Indian Telecommunication Bill, 2022
  • Policy for non-personal data governance.
• It will apply to processing of digital personal data within India
  • To data processing outside the country if it is done for offering goods or services
  • for profiling individuals in India
• It requires entities that collect personal data — called data fiduciaries — to maintain the accuracy of data, keep data secure, and delete data once their purpose has been met.

Importance of RTI?

• The Data Protection Bill of 2022 includes a provision to amend the Right to Information (RTI) Act
• To effectively hold their governments accountable in a democracy, people need access to information, including various categories of personal data.
  • For example, the Supreme Court has held that citizens have a right to know the names of wilful defaulters and details of the Non Performing Assets (NPAs) of public sector banks.
• Democracies routinely ensure public disclosure of voters’ lists with names, addresses and other personal data to enable public scrutiny and prevent electoral fraud.
• The RTI Act in India, especially the poor and marginalized, obtain the benefits of government schemes and welfare programmes, they must have access to relevant, granular information.
  • For example the Public Distribution System (PDS) Control Order recognises the need for putting out the details of ration card holders and records of ration shops in the public domain
    • It enables public scrutiny and social audits of the PDS.
  • The RTI Act includes a provision to harmonize peoples’ right to information with their right to privacy through an exemption clause under Section 8(1)(j).

Personal information is exempt from disclosure under RTI Act if :

• It has no relationship to any public activity
• It has no relationship to any public interest
• If information sought is such that it would cause unwarranted invasion of privacy
  • The information officer is satisfied that there is no larger public interest that justifies disclosure.

Issues with DPDP Bill 2022:

• The enactment of a data protection law does not require any amendment to the existing RTI law
  • This is also noted by the Justice A.P. Shah Report on Privacy.
• The DPDP Bill 2022, proposes amendments to Section 8(1)(j) to expand its purview and exempt all personal information from disclosure.
  • This threatens the very foundations of the transparency and accountability regime in the country.
• A primary objective of any data protection law is to curtail the misuse of personal data, including for financial fraud.
  • Government is the biggest data repository, an effective data protection law must not give wide discretionary powers to the government.
• The DPDP Bill, 2022, empowers the executive to draft rules and notifications on a vast range of issues.
  • For instance, the central government can exempt any government or even private sector entity from the application of provisions of the law by merely issuing a notification.
  • It would potentially allow the government to arbitrarily exempt its cronies and government bodies such as the Unique Identification Authority of India (UIDAI)
  • It will result in immense violations of citizens’ privacy.
• Small non-governmental organizations, research organizations, associations of persons and Opposition parties
  • The government chooses not to include in the notification
  • It would have to set up systems to comply with the stringent obligations of a data fiduciary.
• To meet its objective of protecting personal data, it is critical that the oversight body set up under the legislation be adequately independent to act on violations of the law by government entities.
  • The draft Bill does not ensure autonomy of the Data Protection Board
    • The institution responsible for enforcement of provisions of the law.
  • The central government is empowered to determine the strength and composition of the board, as well as the process of selection and removal of its chairperson and other members.
    • The chief executive responsible for managing the board is to be appointed by the government
    • It will give the government direct control over the institution.
  • Law could dilute the Right to Information (RTI) Act, as personal data of government functionaries is likely to be protected under it, making it difficult to be shared with an RTI applicant.

Section 8(1)(j) of RTI ACT:

• It exempts personal information which is not a part of public activity, or which is an invasion on the privacy of an individual.
• To help anyone claiming exemption it states: ‘Provided that the information, which cannot be denied to the Parliament or a State Legislature, shall not be denied to any person.’
• Personal information may be exempt if:
  • it is not related to a public activity or interest
  • would cause unwarranted invasion of the privacy of an individual
• Whoever claimed that a disclosure was exempt under Section 8(1)(j) should make a statement that he would not give this information to Parliament.

Misuse of section 8(1)(j):

• Many refusals of information did not adhere to the law but refused information with a bland statement that since it was personal information, they would not give it.
• To cover government officials: It has been widely used to cover arbitrary, corrupt or illegal acts of government officials.
• Some examples of illogical refusal:
  • The Department of Personnel and Training refused “Total number of Annual Performance Appraisal reports (APAR) of IAS officers pending for over years” by claiming exemption under Section 8(1)(j).
  • Request for details of Member of the Legislative Assembly funds being denied saying it was personal information
  • Details of the beneficiaries of the Prime Minister’s fund
  • Bogus caste certificates, education certificates, ghost employees
  • Gross arbitrariness and corruption in selections for jobs and non-conformance to rules and laws
  • Disproportionate assets compared to declared income
  • Verification of affidavits of elected representatives
  • Unfair assessment of students and job seekers in government
  • Disregard of corruption charges against officials that have been proven
  • File notings and minutes of meetings

Way Forward

• The creation of a totally government-controlled Data Protection Board, empowered to impose fines upto ₹500 crore
  • It is bound to raise serious apprehensions of it becoming another caged parrot
  • It will be open to misuse by the executive to target the political opposition and those critical of its policies.
• These concerns need to be urgently addressed before the DPDP Bill is enacted.
• If this amendment is made, all information which can be related to a person could be legally denied.
  • Most information could be shown as being related to a person, and hence the law would become a Right to Deny for Public Information Officers (PIO) who do not wish to give out information.
• The Data Protection Bill: It will set up a system of amending the RTI law in a manner that all personal information will be exempted.

QUESTION FOR PRACTICE

What do you understand about the term ‘good governance’? How far have recent initiatives in terms of e-Governance steps taken by the State have helped the beneficiaries? Discuss with suitable examples.(UPSC 2022) (200 WORDS, 10 MARKS)

Editorial Analysis – 2 Aug 2023