The government exempting itself and its agencies from some of the consequences of the Personal Data Protection Bill and giving itself more control, will affect the broader purpose of protecting privacy of users, according to legal experts and policy advocacy groups.
However, sources in the know said, the provisions of the law are fully in compliance with the Supreme Court judgement and the provisions of the act will be equally applicable on the government and its agencies except a few necessary exemptions have been done under special circumstances.
According to the provisions of the Bill, the government has given itself exemptions on the grounds of sovereignty and integrity of India, security of the state, friendly relations with foreign states, maintenance of public order or preventing incitement to any cognisable offence, among other things. Similarly, the data protection board, which will be set by the government to deal with the grievances of the data principals under the Bill, will also be exempted from being prosecuted.
Some of the concerns raised by the policy advocacy groups are with regard to increased government surveillance on exemptions of its agencies from the ambit of Bill, government’s control over the Data Protection Board, censorship of platforms and amendment to the Right to Information Act wherein no personal data information demanded under RTI will be given out, among other things.
According to sources, by nature of law, the data protection board is independent and therefore there is no question of it being controlled by the government. Further, personal information is very sensitive and in a bid to protect the privacy rights, the exemption of RTI has been given, sources said.
In clause 28 (1), the government said the Board shall function as an independent body and shall, as far as practicable, function as a digital office.
On the government’s power to block companies in case of more than two instances of penalties, policy advocacy groups said it will give the government disproportionate powers to issue content-blocking notices to data fiduciaries and intermediaries.
“The government collects vital data from all citizens and is one of the biggest data fiduciaries. Certain aspects of these exemptions do not fit well with principles of necessity and proportionality as enshrined in the Puttaswamy case that recognised the right to informational privacy as a fundamental right and laid down certain requirements to be fulfilled in the event that this right is to be restricted,” said Kazim Rizvi, founding director at The Dialogue.
The Supreme Court in Justice KS Puttaswamy vs Union of India case, stated that the informational or data privacy is key to the right to privacy which is a fundamental right.
“We believe that the DPDPB (Digital Personal Data Protection Bill), 2023 falls woefully short of such ideals. It fails to address many data protection concerns and instead puts in place a regime to facilitate the data processing activities of state and private actors,” policy group India Internet Freedom said.
One of the provisions of the Bill said, “The central government may, for the purposes of this Act, require the Board and any data fiduciary or intermediary to furnish such information as it may call for.”
According to Rizvi, this provision is concerning. “The government seeking information from the board contradicts clauses which discuss the board’s independence. Thirdly, this causes uncertainty to businesses, and additionally, due to the broad definition, the information sought by the government might infringe on intellectual property rights,” he said.
Rishi Anand, partner at DSK Legal said, “The (government) exemption raises concerns about potential overreach and violations of the fundamental right to privacy. Additionally, differential treatment of private and government entities regarding consent and storage limitations has raised questions about equality in the regulation.”
According to Anand, the government should introduce clear guidelines and limitations on government data processing for national security and public order to prevent potential misuse and protect citizens’ privacy rights.
