The latest

In July, 2018 the Telecom Regulatory Authority of India (“TRAI”) recommended rules that restrict telecom and internet service providers from using personal information and data of its users. This effectively meant that users can have control on their data and personal information. These recommended rules were to be applicable for apps, browsers, mobile instrument makers and operating systems. This surprise announcement by the regulatory authority has put in sharp focus the need for regulation of data privacy.

 

Justice Srikrishna Commission

Ahead of the TRAI recommendations, the Justice BN Srikrishna commission was instituted about the same time last year to put in place a regulatory framework for data privacy. The commission headed by former Judge of the Supreme Court Mr. B N Srikrishna consists of eminent jurists, academicians and regulators from the Ministry of Electronics and IT to draft a data protection bill in India. The objective of the committee - “ensure growth of the digital economy while keeping personal data of citizens secure and protected.”

This is a first in the country – to draft a bill / law that governs usage, data retention and responsibilities, obligations and liabilities of individuals, corporates and government in handling third party data.

 

Why do we need a law?

Facebook – Cambridge Analytica data scandal – 50 million user’s data estimated to be harvested without   their permission. 5 lakh users are from IndiaThe use of data has increased manifold especially in the process of turning the economy into digital economy.  The last decade has witnessed the growth and proliferation of social media, e-commerce /online retail business that requires the disclosing of user information including of their bank and other personal details. The demonetisation has only propelled data protection /privacy requirement.

The Facebook – Cambridge Analytica data mining scandal that hit the world in 2018 turned the issue of data protection / privacy on its head. The London based election consultancy firm along with the social media giant is at the centre of an ongoing dispute over alleged harvesting and use of personal data of almost 50 million Facebook users, believed to be without their consent.

This was alleged to have been done by way of a random personality quiz on Facebook where information of people was harvested and collected from users and their friends who never gave their permission for their details to be used. Facebook is being hauled by the Congressional committee in US and Europe. European Union’s Antitrust Regulators had imposed upon Facebook a hefty fine of $122 million on the ground that the Social Media Giant provided misleading information during its 2004 acquisition of WhatsApp. Dutch and French Regulators ruled that Facebook had broken strict data protection rules. Other European Countries including Germany, are heavily coming down on Facebook by imposing huge penalties for, inter alia, misinformation.

The scandal seems to have had its impact on India as well - it is estimated that data of approximately 5 lakhs accounts of Indian Facebook users has been used without their knowledge or consent. The Indian government has written to the social media giant seeking explanation, while it is planning to initiate legal action.

Back home, India has had to dealing with a similar issue. The raging debate on right to privacy was finally put to rest when in August, 2017 a nine Judge Constitution bench of the Supreme Court unanimously ruled that the right to privacy is a fundamental rule under the Constitution of India. It is an intrinsic part of the right to life and personal liberty under Article 21 of the Constitution. This only fuels the need to protect data of individuals / citizens.

On the same lines, the “Aadhar card – privacy violation” debate continues on whether the world’s biggest biometric unique identity database and its information extracting requirements violate the fundamental right to privacy of individuals. For now, the Supreme Court has ruled that the Aadhar is not mandatory for a range of services like registration of mobile phone numbers, booking gas cylinders, railway tickets and the like while it is mandatory to avail social benefit schemes.

 

TRAI recommendations

In its recommendations made public ahead of the release of the white paper on data protection by the Srikrishna committee, TRAI has broadly made the following recommendations1:

1. The definitions of “Data” under the Information Technology Act, 2000 and “Personal information” and “Sensitive Personal Data and Information” under the Sensitive Personal Data and Information Rules, 2011 are adequate for the present.
2. Each user has owns his / her personal data. The agencies in the digital ecosystem collecting such data are mere custodians of such data.
3. The existing framework for data protection is not sufficient. All entities in the digital ecosystem that control or process personal information should be brought under a data protection framework.
4. Privacy by design principle should be put in place – bare minimum data to provide particular service to customers only should be collected.
5. Clauses for data collection and limitation period to be expressly incorporated in the agreements.
6. Consumer awareness programmes to be undertaken to spread awareness of data protection and data privacy to enable users take well informed decisions about their personal data
7.  The government to put in place a grievance redressal mechanism relating to issues of data, ownership, protection and privacy.
8. There could be sector-specific laws within the general data protection framework for the telecom sector.

The above recommendations seem relevant to all entities of the digital ecosystem that use personal data of users.

 

Data protection laws around the world

Sweden was the first country to enact data protection laws (The Data Act) way back in 1973. As of 2018, nearly 100 countries including Europe, Latin America, the Caribbean, Asia, and Africa have adopted comprehensive data protection laws.

In the U.S there is no single comprehensive law governing the entire the nation. Instead there are individual states / federal laws. There are host of other regulations / guidelines developed by specific categories such as financial sector, health sector etc. These are considered as “best practices” which are increasingly being adhered to by the relevant industries.

The European Union’s (EU) General Data Protection Regulation (GDPR) came into force on 25th May 2018, replacing the existing Data Protection Directive that was in existence since 1995. The main objective of enacting the GDPR – address issues relating to the way in which data is collected, analysed and transmitted by different types of business such as social networks, mobile applications and e-commerce.

 

Data protection law – a new age legislation

The government instituted the BN Srikrishna Commission to make specific suggestions to be considered for data protection in India and suggest a draft data protection bill. The suggestions are aimed at ensuring a correct balance between economic developments alongside ensuring privacy of data of citizens,"

The high level committee is scheduled to meet in the last week of July, 2018 to finalize its recommendations after taking into account the TRAI recommendations. The TRAI recommendations are two fold – one which is (telecom) sector specific while the other being generally applicable to a digital economy.

It is widely believed that the Srikrishna committee may bring out recommendations which will take a middle path between the more liberal US laws and the very stringent Europe laws. The ball is set to roll for India to get is most comprehensive and much needed data protection laws.

To read more. Click here