General Studies Paper 3

INTRODUCTION

• India is no Europe, and this seems especially true in the face of a task such as drafting and conceptualising a data protection law for over 1.4 billion Indians. The European Union’s (EU) data protection law, i.e., the General Data Protection Regulation (GDPR), came into force in the middle of 2018 and achieved widespread popularity as arguably the most comprehensive data privacy law in the world. Although the EU’s challenges may be due to its unique legal structure, India must guard against the risks of enacting a law that is toothless in effect.

ISSUES AROUND DATA USE

• This deliberation becomes increasingly relevant as the Indian government is likely to table India’s fresh data protection law in the ongoing monsoon session of Parliament (July 20-August 11).
• Late last year, the government released the Digital Personal Data Protection (DPDP) Bill, 2022 for public consultation.
• Considering this, critical gaps remain in the DPDP Bill that would affect its implementation and overall success.
• In its scope and definition, the DPDP Bill only protects personal data, that is any data that has the potential to directly or indirectly identify an individual.
• In the modern data economy, entities use various types of data, including both personal and non-personal data to target, profile, predict, and monitor users
• Often, this non-personal data when combined with other datasets can help identify individuals, and in this way become personal data, impacting user privacy.
• This process of re-identification of non-personal data poses significant risks to privacy.
• Such risks were accounted for in previous versions of India’s draft data protection Bill, in 2018 and 2019, but do not find a place in the latest draft.
• By not recognising these risks, the DPDP Bill is very limited in its scope and effect in providing meaningful privacy to Indians.
• A simple and effective solution — as in the earlier versions — would be to add a penal provision in the Bill that provides for financial penalties on data-processing entities for the re-identification of non-personal data into personal data.

LIMITED REACH OF DATA PROTECTION BOARD

• Another gap is the inability of the proposed data protection board to initiate a proceeding of its own accord.
• Under the Bill, the board is the authority that is entrusted with enforcing the law.
• The board can only institute a proceeding for adjudication if someone affected makes a complaint to it, or the government or a court directs it to do so.
• The only exception to this rule is when the board can take action on its own to enforce certain duties listed by the Bill for users.
• This is for the adjudication of disputes between the law and users — for example, an obligation on users not to register a false or frivolous complaint with the board, and not between users and data-processing entities.

WAY FORWARD

• In the data economy, users have diminished control and limited knowledge of data transfers and exchanges.
• Due to the ever-evolving and complex nature of data processing, users will always be a step behind entities which make use of their data.
• The Competition Commission of India, which is responsible for the enforcement of India’s antitrust law, has the power to initiate inquiries on its own (and utilises it frequently).
• These are not the only gaps in the DPDP Bill, but finding solutions to them would help address challenges in implementation in a significant way and make for a more future-proof legislation.