Draft bill proposes steep Rs 10-mn fine, 3-year jail for privacy violations

The draft bill also calls for informing the subjects of surveillance who undergo the interception of communication about the said interception within 60 days

As a debate rages on privacy and data protection, a citizen-led initiative termed Save Our Privacy has submitted a draft bill to the Justice BN Srikrishna Committee. The committee has been tasked by the government with studying issues around data security and individual privacy, is yet to submit its report. Lawyers and activists linked to the initiative termed their draft a model bill that takes a comprehensive view of not just data security and processing but also surveillance and communication interception.

The draft bill, submitted on June 8, envisages a penalty provision of up to Rs 10 million for those found violating the code and a jail term extending up to three years or a combination of both. This penalty is for those who collect, receive, process or hold personal data in contravention of the provisions of the proposed law.

Save Our Privacy is a community-driven campaign supported by several lawyers and activists, including Apar Gupta, Raman Jit Singh Chima, Kritika Bhardwaj, Gautam Bhatia, Praavita Kashyap and Prasanna S.

In their letter to Retired Justice BN Srikrishna, the volunteers said the group was trying to adopt the highest standards of transparency to ensure that autonomy, dignity and privacy were protected in the data protection law.

“We believe that the formulation of a privacy statute for our republic must be a public process with the widest possible citizen and stakeholder engagement, aimed at putting in place and enforcing the highest standards of privacy oversight and rights regarding data for all Indians,” the group wrote in a letter dated June 8.

The draft bill speaks about storage and the collection of personal data only for certain purposes and the time required to fulfil those purposes. It also allows for data subjects, i.e. citizens to request their data to be deleted from servers.

The draft law also calls for informing the subjects of surveillance who undergo the interception of communication about the said interception within 60 days. The authorised officer seeking permission for surveillance has to approach the appropriate Surveillance and Interception Review Tribunal and get an order before going ahead with the interception.

Additionally, the law also envisages the formation of a privacy commission whose members will be appointed by the President. This commission will work as the supreme body in judging the matters of data privacy violations and providing permissions or revoking them when it comes to the collection, storage or processing of personal data. The draft bill seeks to have a director general of surveillance and interception reform apart from a number of other additional, joint, deputy or assistant directors general and other such officers who may be required to carry out the commission’s duties effectively.

The bill also proposes "exemplary” penalties for those who refuse access to essential goods and services such as subsidised foodgrains to citizens who do not have a certain identity document but have an alternative method to establish identity.

“The data subject shall be entitled to exemplary damages where an essential service has been denied despite the existence of pre-existing alternative means of identifying the data subject,” the draft bill states. “No essential services, by whosoever provided... shall be withheld on the ground that consent to share personal data in a particular manner for the purpose of identification, has not been obtained or has been withheld or such data has not been collected at the time the data subject claims the service.”