India's Personal Data Protection Bill Draft Is Strict On Private Companies, Not On Government

India has been working on its own data protection bill for a while now, however recently, under the guidance of Justice Srikrishna and the final draft was also approved by the cabinet.

Now, this draft of the bill has finally been introduced in Lok Sabha by Union IT Minister, Ravi Shankar Prasad.

While the law does a great job of safeguarding our data, it isn¡¯t something that the companies would be extremely happy about. There are also places where safeguarding privacy comes with a big asterisk.

For example, according to Jochai Ben-Avie and Udbhav Tiwari of Mozilla, the Personal Data Protection Bill seems tough on private enterprise but gives the government and central agencies a free hand with user data without adequate safeguard. These are some major provisions for the Personal Data Protection Bill, 2019.

Government bodies get an exemption from these provisions

One of the provisions in the final draft grants the government complete discretion to exempt any government entity or department from this law. Basically, this risks the privacy of your data that is in the hands of the government agencies and authorities. We¡¯ve seen what happened with Aadhaar, and with this new bill, there will be no improvements in such cases.

Stringent Limitations to Private Companies

While government companies are no longer in purview, private companies still remain under strict scrutiny and provisions to safeguard data of citizens, including limiting the purpose and collection of data, the security of data, as well as clearly making the user understand consent of data submission for an open and easy-to-understand experience.

The Data Protection Authority isn¡¯t as well equipped as it used to be

In previous drafts, it was noted that the DPA or Data Protection Authority would form a committee with people from executive, judicial and external expertise. However, the final draft limits this to just executives and adjudicating officers that will be appointed only by the government. The former would have been a more dynamic approach with SMEs (Subject Matter Experts) from the industry to take the right decision or to solving data protection issues that the latter might not be well equipped to do.

Social media accounts will be verified using government IDs

To curb fake news online, the new bill is introducing a provision where users will have to verify their accounts using existing government IDs. The platforms will have intermediaries that will verify these documents. While this could help in finding the culprit for sharing fake news while also making users be more vigilant, the data shared with the social media companies can be grossly misused for profiling and targetting users -- completely destroying privacy and anonymity of a specific user online.

Government demands confidential company data

With this bill, the government also wants access to non-personal data of Indian citizens for ¡°public good and policy planning.¡± Now, this might seem like a regular demand, but this data is actually an intellectual property of a company as it can be protected trade secrets of companies or confidential information that could destroy their business if it ever got in wrong hands. No company would want to give that, and it could discourage them from participating and doing business in the country.

Sensitive Data To Be Stored In India, But Can Be Accessed Anywhere

This is another way to safeguard our personal data. As per this provision, personal (sensitive) data of Indian users will have to be stored in India. This includes financial data, health data, data pertaining to sex life, biometric data, religious or political belief etc. However, the companies will have access to this data from across the globe. This will indirectly make it easier for the government to keep tabs on Indian users

Right to erasure and correction

The new bill also brings provisions to manage existing data with companies. One of the provision states that users will have a right to erase the data that is no longer necessary (especially if the task it was necessary for is completed), thus preventing further misuse of confidential data. There is also a provision to correct data to keep things up to date.