Sweeping powers to govt under data protection Bill a step backwards, say experts

The Personal Data Protection Bill giving investigating agencies unbridled powers to carry out surveillance on private data has spooked companies and experts who argue that such overarching access is against established principles and is a dramatic step backwards.

The Personal Data Protection Bill, 2019, was introduced in the Lok Sabha on Wednesday, and the government proposed sending the Bill to a joint select committee of both Houses of Parliament amid protests by the opposition.

"Critically, this latest Bill is a dramatic step backward in terms of the exceptions it grants for government processing and surveillance," said Mozilla, the not for profit entity behind the web browser Firefox.

The biggest concern, it rued, is the Bill's expansion of the broad exceptions that were present in the 2018 draft of the data protection bill for the government processing of data.

Crucially, the requirement that government processing of data be "necessary and proportionate" has been cut. Furthermore, a provision was added granting the government complete discretion to exempt any entity or department from any part of the law, it said in a blogpost.

Mozilla argued that this "leaves the current legal vacuum around India's surveillance and intelligence services intact, which is fundamentally incompatible with effective privacy protection".

Software Freedom Law Centre, India (SFLC.in) said it believes that granting access of personal data to the State, without appropriate safeguards and judicial oversight is against established constitutional principles and should not form part of the Bill.

It also expressed concern that Data Protection Authority (DPA) - a regulatory body proposed under the Bill - will be completely dependent on the Centre for its formation and membership.

"We believe that to ensure the independence of the DPA, there should be sufficient involvement of judicial members in the selection committee as well as in the DPA. This will guarantee judicial review and will quell concerns of conflict of interest," it said.

On the same issue, Mozilla said under the structure proposed it will be harder for the DPA "to be empowered and effective as the entire governing structure will be appointed exclusively by the government".

The Bill proposes that personal data will not be processed without consent of the owner of the information, and that no personal data will be processed except for clear and lawful purpose.

However, one of the provisions of the Bill will "empower the central government to exempt any agency of government from application of the proposed legislation" - which experts say will give sweeping powers to government agencies to collect data of citizens.

The Bill states that the Centre can - in the interest of sovereignty, security of the state, and public order - "direct that all or any of the provisions of this Act shall not apply to any agency of the Government in respect of processing of such personal data..."