Moots protection of sensitive personal data or information be brought under the law.
Social media sites, telecom operators, government agencies and every such body that gets to collate data on individuals by way of the nature of their operations would soon be governed by a set of laws that would protect an individual’s sensitive personal data or information (SPDI). The justice BN Srikrishna committee mandated by the government to draft a data protection law has come out with its white paper which has laid down that sensitive personal data or information by which a person is identifiable would need to be protected and would be brought under an ambit of law that would prescribe punishments in case of violations. What this essentially means is that any social media site, search engine, telecom operator or government agency cannot sell or disclose SPDI of individuals. The Srikrishna panel has identified health information, genetic information, religious beliefs and affiliation, sexual orientation, and racial and ethnic origin as SPDI. It has also placed caste and financial information too in this category. “In other categories such as philosophical or political beliefs, an assessment may be made whether these are matters in which a person has an expectation of a high degree of privacy,” the white paper has noted.
“It is data about/relating to an individual that may be the subject matter of protection under the law. Data in this context ought to include any kind of information including opinions or assessments irrespective of their accuracy,” the 223-page report that has now asked for stakeholders’ comments has noted. It has further said that data from which an individual is identified or is identifiable/reasonably identifiable may be considered to be personal data. The identifiability can be direct or indirect.
The white paper has, however, clarified that all information is not personal data. Only such information by which a person can be identified would be categorised as SPDI and come under the ambit of law. “Data could be in a form where individuals stand identified or in other cases it is possible that they could be identified. Whether an individual is identifiable or not is a question of context and circumstances. For instance, a car registration number, by itself, does not reveal the identity of a person.
However, it is possible that with other information, an individual can be identified from this information,” the paper has observed. Analysts FE spoke to said that the present practice wherein search engines or social media sites that map individuals’ choices, tastes and practices and sell them to third parties would be checked once the data protection laws are formalised. Earlier this year the Supreme Court already recognised the right to privacy as a fundamental right.