A Bill protecting state surveillance

A Bill protecting state surveillance

• The Ministry of Electronics and Information Technology released the Digital Personal Data Protection Bill, 2022, on November 18. 

The journey towards data protection law 

• The journey towards data protection legislation began in 2011 when the Department of Personnel and Training initiated discussions on the Right to Privacy Bill, 2011. 
• As per an Office Memorandum dated September 29, 2011, the then Attorney General, Goolam Vahanvati, opined that conditions under which the government can carry out “interception of communication” should be spelt out in the Bill. 
• This opinion was also echoed by the Group of Experts on Privacy, headed by Justice A.P. Shah, in 2012.

Turning into a surveillance society 

• The report of the Shah Committee emphasized the need to examine the impact of the government's increased collection of citizen information on the right to privacy. 
• Since then, civil society organizations, lawyers and politicians have consistently demanded surveillance reform, highlighting how personal data can only be protected when the government’s power to conduct surveillance of citizens is meaningfully regulated. 
• The latest Bill also fails to confront India’s growth into a surveillance society like its predecessors.

The surveillance architecture 

• The surveillance architecture in India comprises mainly Section 5(2) of the Indian Telegraph Act, 1885; Section 69 of the Information Technology Act, 2000; and the procedural rules promulgated under them. 
• But this architecture does not meaningfully define the grounds under which, or how, surveillance may be conducted. It also does not contain safeguards such as ex-ante or expost facto independent review of interception directions.

Enabling abuse 

• The concentration of power with the executive thus creates a lack of accountability and enables abuse. 
• Evidence for this emerges not only from instances of political surveillance but also from the slivers of transparency that accidentally emerge from telecom companies. 
• For instance, submissions by Airtel to the Telecommunications Department, as part of the public consultation process for the Indian Telecommunication Bill, reveal that excessive data collection requests are already a reality. 
• Airtel has asked the government to share the costs it incurs to comply with the increasing demands from law enforcement agencies to carry out surveillance.

Unfettered collection of citizen data 

• Apart from outright surveillance, unfettered collection, and processing of citizen data for other purposes, such as digital governance, raise concerns. 
• Agitation over the nature of the surveillance architecture was voiced by the Supreme Court in its right-to-privacy decision in 2017 and by the Justice B.N. Sri Krishna Committee in 2018. 
• However, all iterations of the data protection legislation since — the draft Personal Data Protection Bill, 2019, the draft Data Protection Bill, 2021 and the 2022 Bill — have no proposals for surveillance reform. Worse, personal data can be processed even without the person’s consent.

Blanket exemptions

• Like previous iterations, Clause 18(2) of the 2022 Bill allows the Union government to provide blanket exemptions for selected government agencies. 
• This Bill however is more egregious than previous iterations as it permits exemption to private sector entities that may include individual companies or a class of them, by assessing the volume and nature of personal data under Clause 18(3). 

Foreign legislations 

• Comparative legal regimes, which were considered before proposing the Bill, do not contain comparable provisions as per the explanatory note. Such blanket exemptions to state agencies, let alone private corporations, are absent in foreign legislation. 
• While the existing or proposed legislations in the European Union and in the U.S. permit security agencies to claim exemptions on a case-by-case basis, depending on why they are collecting personal data, they do not contain blanket exemption powers to an entire government entity. 
• Further, other jurisdictions exercise meaningful oversight over state surveillance. For instance, the Investigatory Powers Tribunal in the U.K. is authorized to hear complaints against misuse of surveillance powers and can impose monetary penalties in case of a breach. 

Exempting state agencies 

• Under the new Bill in India, exempted state agencies and private entities will not be within the purview of the Data Protection Board, the body responsible for imposing penalties in case fiduciaries infringe privacy. 
• The explanatory note accompanying the Bill elaborates on the seven principles it seeks to promote, including transparency, purpose limitation, data minimization, and preventing the unauthorized collection of personal data. But when matched against the actual provisions, the Bill appears to serve a rhetorical value. 
• This can also be noticed by the government’s refusal to share statistical data on the number of surveillance orders issued yearly, thereby hampering any meaningful transparency. Further, in direct violation of purpose limitation, interdepartmental sharing of data is not only allowed, but encouraged by draft policies such as the draft National Data Governance Framework Policy, 2022, facilitating the creation of comprehensive profiles of citizens.

Contrasting the principles of data minimisation 

• In addition, provisions of other legislation, such as the Criminal Procedure (Identification) Act, of 2022, which allows for overzealous collection and storage of biometric data for 75 years, are in direct contrast with the principles of data minimization and prevention of unauthorized collection of personal data.
• The preamble to the 2022 Bill states that the purpose is to protect the personal data of individuals and ensure that personal data is processed only for lawful purposes. Unfortunately, by choosing to protect state surveillance, the new Bill fails to fulfil its mandate of protecting citizens’ right to privacy.