No foolproof anonymity: Justice B N Srikrishna on data protection

Retired Justice B N Srikrishna on Thursday said anonymous data is not foolproof and can be de-anonymised in future.

Legislation can only make entities de-anonymising the data answerable to the law, he added.

Justice Srikrishna headed the committee on framing data protection norms, set up by the Ministry of Electronics and IT.

The government in the draft personal data protection bill has favoured processing of anonymous data to protect privacy of individuals.

He further said the personal data protection bill is before a joint parliamentary committee and it will be good if it comes out soon.

"What is thought to be anonymous can be de-anonymised tomorrow. Therefore, there is no foolproof anonymity. All that law can say is take it as anonymous, if you do de-anonymity, identify the person, then you will be answerable to the law," Justice Srikrishna said at a FICCI event.

The draft of the personal data protection bill, approved by the Cabinet in December 2019, proposes a penalty of up to Rs 15 crore and up to three-year jail term for company executives for violating privacy norms.

Justice Srikrishna said that he sees a triangle of forces where citizens are at the apex, state on one side and on the third side is trade and business.

"We have to find resultant in the forces of the triangle which will take forward the society and not scuttle either progress or individual rights," he added.

In response to a query, he said the data protection issue is too complex and therefore the bill has been sent to a parliamentary committee.

"Data is the buzzword today because people have realised that the data can be monetised," he added.

The bill was introduced in the Lok Sabha in February and has been referred to a Joint Parliamentary Committee of both the Houses, headed by BJP MP Meenakshi Lekhi.

The draft approved by the Cabinet in December mandates storage of critical data of individuals by internet companies within the country. Sensitive data can be transferred overseas only after explicit consent of the data owner.

Critical data will be defined by the government from time to time. Data related to health, religious or political orientation, biometrics, genetic, sexual orientation, health, finances, among others, have been identified as sensitive data.