The Data Protection Bill only weakens user rights

The Personal Data Protection Bill, 2019, which was introduced in the Lok Sabha this month, is a revolutionary piece of legislation that promises to return power and control to people in our digital society. Pending deliberation before a Joint Parliamentary Committee, it is intimately connected to the very same fundamental rights and constitutional principles that are being defended today on the streets and in the fields.

The Bill has seen serpentine movement, passing expert committees, central ministries and then the Lok Sabha in the winter session. Let us focus on some of the finer nuances and finer details which merit deliberation:

Securitization and Revenue

This Bill is central to several policy and political pronouncements by the present government. In many ways, it is a continuation of the politics of securitization of the government from its previous term.

Privacy is mentioned just once in this voluminous document — 49 mentions of ‘security’ and 56 mentions of ‘technology’.

The President of India’s address to Joint Sitting of Parliament on June 20, 2019 — fresh from the results of the general election — proclaimed that “my government is committed to that very idea of nation-building, the foundation for which was laid in 2014”. The priorities of the government are clearly charted out with zero mention of privacy or data protection; there are 18 mentions of ‘security’ and eight of ‘technology’. This familiar template is again found in the Prime Minister’s Independence Day speech on August 15, 2019 which focused on dramatic social change.

The government is seeking to not only access data but also collect it and then exploit it – making it an active data trader for the generation of revenue to meet its fiscal goals.

Principles in conflict

The scale of data collection is ambitious and broadly contained in the ‘Digital India’ programme; on its website it says: “to transform the entire ecosystem of public services through the use of information technology”. Here, all elements of a citizen state interaction are being datafied.

In the view of some technologists, this also fulfill is geostrategic goals when personal data is viewed as strategic state resource. However, this poses grave risks to the right to privacy.

Muddled formation

The existing draft of the Data Protection Bill is reflective of a political economy that is motivated towards ensuring minimal levels of protection for personal data. It has a muddled formulation in terms of its aims and objectives, contains broad exemptions in favour of security and fiscal interests, including elements of data nationalism by requiring the compulsory storage of personal data on servers located within India.

It seeks to place the privacy interests of individuals on the same footing as those of businesses and the state. Here, by placing competing interests on the same plane, two natural consequences visit the drafting choices within it:

• First, the principle of data protection to actualize the fundamental right to privacy is not fulfilled as a primary goal but is conditioned from the very outset.
• Second, by placing competing goals — which contradict each other — any balancing is clumsy, since no primary objectives are set. This results in a muddy articulation that would ultimately ensure a weak data protection law.

The present draft of the Bill comes as a disappointment especially after the emphatic judgment by the 9- Judge Bench of the Supreme Court on the Right to Privacy. The judgment contains categorical language that the Bill is a measure to actualize the fundamental right. However, this draft serves a political economy which at first blush appears attractive in its promise of taking us away from the dull maxims of constitutionalism and delivering us a digital utopia.

Hence, on a broader read, the Data Protection Bill is not a leaky oil barrel with large exceptions, but it is a perfect one. It will refine, store and then trade the personal information of Indians without their control; open for sale or open for appropriation to the interests of securitization or revenue maximization, with minimal levels of protection. For this to change, we have to not only focus on redlining the finer text of this draft but also reframing large parts of its intents and objectives.