The draft Digital Personal Data Protection bill has skipped “Right to Privacy” in the preamble and provides unrestrained powers to the government, advocacy group CUTS International has claimed.
CUTS said that the draft weakens the regulatory, supervisory, and enforcement architecture by replacing the previously proposed data protection regulator with a board that will be directly in control of the government.
“Moving away from its previous version, the bill skips mention of the fundamental right to privacy in its preamble and narrows the scope of the law from data protection to digital personal data protection excluding non-personal data, which is rather desirable. In doing so, the bill takes away the categorisation of personal data, especially sensitive personal data, thereby painting all personal data with the same regulatory brush,” CUTS said in a statement.
The preamble of the draft Personal Data Protection Act 2018 mentioned of “right to privacy” as “a fundamental right and it is necessary to protect personal data as an essential facet of informational privacy”.
“The bill provides a broad scope and unrestrained powers to the government to prescribe on critical issues at a later date. Such powers, if not carefully and judicially used, can do more harm than good,” CUTS International, Secretary General, Pradeep S Mehta said.
CUTS said that allowing the transfer of personal data outside India appears to be a step forward but the bill provides significant unreasonable discretion to the central government to notify trusted countries for such transfer, without necessary principles or procedural safeguards.
“It also empowers the central government to exempt instrumentalities of state from its provisions without adequate checks and balances, ignoring principles of legality, necessity, and proportionality, as laid down in the Puttaswamy judgement,” CUTS said.
The government had opposed declaring the “Right to Privacy” as a fundamental right while the judgement in the Puttaswamy case has pronounced “The right of privacy is a fundamental right” which “protects the inner sphere of the individual from interference from both State, and non-State actors and allows the individuals to make autonomous life choices.”
CUTS appreciated the evolution of significant data fiduciaries from only the number of registered users as in intermediary rules to include factors such as volume and sensitivity of personal data processed, risk of harm to data principal, risk to electoral democracy and public order among others.