CVV CONTRIBUTORS

Patron

Vanisree Ramanathan

Assocaite Professor, Political Sociology

Advisors

Nagaraj Neerchal

Professor of Statistics and Vice-Chancellor

Gauri Mahulikar

DEAN, CVV

P. Krishna Kumaran Thampi

Expert in Cyber Forensics and Security Auditing

Controller of Examinations, CVV

N M Sundar

Former Director, Information Technology, Barclay„s Bank, Singapore

Executive-Secretary to Trustee, CVV

Neeraj B Bhai

Director of IT Services, CVV

Maitreyi Hegde

Advocate, High Court of Kerala and Supreme Court of India

Language Editors

Saurabh Singapalli,

Assistant Professor of English, CVV

Neethu S Kumar

Assistant Professor of English, CVV

Academic Inputs:

Ananthu B, Anuroop G Asokan, Anu V V, Bidisha Sahu, Krishna S, Rakesh R K,

Shrikumar K Menon, Sreelakshmi Iyer, Srinivas Krishnan, Sunil J, Zeeshan Alam

(LL.M. Legal Theory Students)

Abdul Nabeel A, Alexander V J, Antony Judy, Austin Joseph, Febin Raj T S,

George V Markose, Gopika S, Pradeep, R Santosh Jose Prasad, Sruthi Das, Sumi Liza

(LL.M. International Trade and Commercial Students)

Vandana Venugopal, Muhammed Suhas A, Arul Kurian, Jovin P John,

Prateek Yadhav, Jayaprashant T

(M.A. Public Policy and Governance students)

Venkat Raghavan, Abha Mohan, Vinayak Rajat Bhat, Satheesh Varma

(Faculty Members)

Acknowledging External Support

Dhanuraj D

Antony Dawson D‟Silva

Swapna J

Centre for Public Policy Research Ernakulam

Abhilash Gopinath

Centre for Economy, Development and Law, Thrissur

Adv. Sreenath Namboodiri

Sandesh One, NGO

iv

Table of Contents

Introduction 07

Part I – Conceptual Framework of the 2018 & 2019 bills 08

I.01 - Personal Data: Sensitive, Critical and the Rest 08

I.02 - Reductionist Conception of „Data Processing‟ 10

I.03 - Separate Legal Regimes dealing with purpose

of State and other purposes 10

Part II – Theoretical Background Constituting the 2018 and 2019 Bills 12

Part III – Interpretation of Important Provisions of the 2019 Bill 15

III.01 Personal Data, Data Principal, Data Fiduciary

and Data Processor 15

III.02 Sensitive Personal Data 16

III.03 Processing 16

III.04 Obligations of a Data Fiduciary 18

III.05 Consent and Explicit consent 19

III.06 Grounds for Non-consensual Processing and Exemptions 21

Part IV – Recommendations 28

Annexure xxviii

Copyright Policy and Disclaimer

© 2020 Chinmaya Vishwavidyapeeth

All rights reserved. Permission is hereby granted, free of charge or fees, to any person using this

publication or any part of the same, for academic and non-commercial purposes, with due

acknowledgment of the title, authorship and the publisher. Subject to the permission granted, no part of

this publication may be reproduced or transmitted in any form or by any means without the permission of

the permission of the Registrar, Chinmaya Vishwavidyapeeth, Veliyannad, Kochi, Kerala 682313. This

document is an output of the research and study undertaken independently by the faculty and students of

this University, and the views expressed herein are solely that of the authors and are based solely on

information available publicly/internal data/other reliable sources believed to be true by them. The

University does not endorse the output of this independent academic study and the attached

recommendations. The recommendations are provided for assistance and are not intended to be and must

not alone be taken as the basis for any decisions.

v

MEETINGS LEADING TO REPORT

Personal Data Protection Bills

2019 2018 &

Focus Group Discussion with LLM

and MA Public Policy students

201 th December 29 9

Personal Data Protection Bills

2018 & 2019

Presentation of Initial Findings

before Experts of Information

Technology and Data Sciences

17 th January 2020

Legal Bases of Information Privacy: A talk on the Personal Data Protection Bills

( University Seminar ) 29 th January 2020

vi

CVV- CPPR CONSULTATIVE MEETING

on LEGAL BASES OF INFORMATION PRIVACY

&

PERSONAL DATA PROTECTION BILL 2019

27th February 2020

(PUBLIC DISCUSSION ON THE FINDINGS & SUGGESTIONS)

7

Does the Proposed Personal Data Protection Bill 2019 compromise individual

rights as well as state interests?

Introduction The Personal Data Protection Bill, 2019 was introduced in the Lok Sabha on December 11, 2019

and was put forth for discussion. Prior to this Bill, The Personal Data Protection Bill, 2018

(hereafter 2018 Bill) was under the consideration of the parliament. The 2018 Bill was prepared

by a committee of experts headed by Justice B. N Srikrishna, who recently criticised the new Bill

for granting excessive powers to Government authorities. The 2018 Bill proposed by this

committee had two primary objectives: (1) to protect personal data as an essential facet of

information privacy; and (2) to create a collective culture that fosters a free and fair digital

economy respecting the information privacy of individuals while ensuring empowerment,

progress and innovation in the economy.

It is important to note that while ensuring the growth of the digital economy is an important facet

of the economic development of any modern nation-state, the Bill on Personal data protection

need not necessarily retain „growth of digital economy‟ as one of its primary objectives guiding

the design of the law. The objective to promote the digital economy compromises the very

purpose of the Bills introduced for the protection of personal data. The influence of the said

agenda has overtly altered the standards and procedures prescribed under several provisions in

both the Bills. The present work aims to bring such significant inconsistencies to the forefront of

public discussion. Both the Bills are compared in the light of the report of the Justice B. N.

Srikrishna Committee, and are examined in the context of facts pertaining to the world of

information technology and the digital economy.

Part I of this report examines and explains the conceptual framework and design on which the

Bills are drafted. Upon analysing the conceptual framework of the Bills, it becomes necessary to

look into the theoretical bases on which the Bills were drafted. Hence, Part II aims to analyse the

appropriateness of the theoretical background constituting the Bills and their conceptual

framework. Part III aims to provide a clause-by-clause interpretation of significant sections of

the Bill, and discusses the current status of the Bill. It also analyses the pros and cons of such a

Bill being passed into an act, significantly affecting the lives of the individuals.

8

PART I

Conceptual Frameworks of the 2018 and 2019 Bills

After the Puttaswamy judgement in 2017, which was seen to be an authoritative judgement that

conclusively held the Right to Privacy as a fundamental right, it became a positive duty imposed

upon the government to protect the privacy of the individuals. The Government of India, upon

recognizing the importance of data protection, and to ensure growth of the digital economy,

constituted a committee of experts under Justice B. N. Srikrishna to identify key data protection

issues in India and recommend methods for addressing them. The office memorandum

constituting the committee specifies the Terms of Reference (ToR) to be two-fold: a) To study

various issues relating to data protection in India, b) To make specific suggestions for

consideration of the Central Government on principles to be considered for data protection in

India and suggest a draft data protection Bill.

However, in the report, the Committee claims to address the objective of “unlocking the data

economy, while keeping data of citizens secure and protected”. The committee‟s self-professed

restatement of its ToR takes cue from the contextual paragraph of the office order (for reference,

see Annexure A of the Committee report).

The committee‟s report titled “A Free and Fair Digital Economy - Protecting Privacy,

Empowering Indians” now stands much removed from the primary goal of data protection. It

relegates this key goal to an auxiliary status, while it presumes the promotion of digital economy

as its indispensable objective. It is this context which necessitates an analytical study of the

conceptual framework, the legal techniques and the standards used by the proposed 2018 Bill. It

is further important to learn how this conceptual framework has permeated into the new Bill

introduced in December 2019 and also to discern the differences between both the Bills. Justice

B. N. Srikrishna has recently commented that the new Bill has diluted the safeguards which the

2018 Bill had envisaged for the protection of the rights of individuals. Starting from the

Puttaswamy Judgement to the new 2019 Bill, a significant reduction in the protection accorded

to individuals can be observed in successive stages of legislative policy discussions, and drafting.

The impact of such reduction becomes more visible if one analyses the conceptual framework

the new Bills build upon. This report recognises three important distinctive principles as the arms

of the conceptual framework:

1. Qualification of personal data into „sensitive personal data‟, and „critical personal data‟

and the design of separate legal regimes dealing with each.

2. An all-encompassing conception of data processing.

3. Separation of the purposes of the State and others for data processing.

I.01 Personal Data: Sensitive, Critical and the Rest

According to the 2018 Bill, personal data means data about or relating to a natural person, who is

directly or indirectly identifiable by such data. This data can be any characteristic, trait, attribute

or any other feature which makes a natural person identifiable. Also, a combination of such

features, or any combination of such features with any other information, which may lead to

9

identification of the individual, is classified as personal data. Personal data has been further

qualified into sensitive and critical personal data affording separate legal regimes for the

protection of the same. The bill supposedly envisages varying grades of protection to all the

three categories of personal data [(1) personal data (basic/general- assumed to be non-sensitive),

(2) sensitive personal data, (3) critical personal data)].

While personal data not classified as sensitive personal data may be processed on the basis of

consent that is free, informed, specific with regard to the scope of consent, clear, and capable of

being withdrawn, sensitive personal data should be processed only with explicit consent.

Passwords, financial data, health data, official identifiers, sex life, sexual orientation, biometric

data, genetic data, transgender status, intersex status, caste or tribe, religious or political belief or

affiliation are some of the personal data identified as sensitive personal data by the 2018 Bill.

Personal data is qualified as sensitive on the basis of the significant harm it may cause to the

individual, legitimate expectation of confidentiality, and the risks associated with it. The

promoters of the Bill find the normal provisions dealing with the protection of non-sensitive

personal data inadequate to address and remedy the significant harm caused to individuals by the

processing of such data. However, the extent of inadequacy is not really discussed nor explained.

It must be reckoned that though the Bills profess these two categories of personal data, there is

hardly any variance in the protection accorded to these two categories, except for one difference

in the standard of the consent to be obtained from individuals who are parting with their privacy

rights, i.e., Sensitive Personal Data should only be processed on the basis of „explicit consent‟.

Nevertheless, the provisions of the Bills are not very clear about the distinction between

„consent‟ and „explicit consent‟. The consequences and implications of this ambiguity shall be

dealt with in detail in Part III.

Apart from these two types of data, the Bills empower the central government to notify

categories of personal data as critical personal data, that shall only be processed in a server or

data centre located in India. This is to prevent cross-border transfer of such data.

Also, it needs to be noted that, the chapter dealing with processing of sensitive personal data (Ch

IV) in the 2018 Bill is silent with regard to whether such data can be processed without consent,

although the report backing the Bill maintains such a position explicitly. It is also silent about

whether non-state entities can process such data or not. The Chapter contains three separate

sections dealing with the processing of sensitive personal data for the purposes of functions of

the state, for judicial and legal proceedings, and for undertaking prompt action. It is not clear

from the Bill whether these sections mutually exclude or cross-fertilise each other.

On the other hand, the new 2019 Bill makes it clear that processing for state functions can be

non-consensual. It does not improve clarity on the question of whether private entities can

process such data. No additional safeguards or restrictions on the processing of such data have

been prescribed anywhere in the Bill, and the entirety of it has been left to the Authority being

established. Annexure 1 to this report contains a table featuring the grounds for personal data

processing and their impact on the categories of personal data and sensitive personal data. The

chart in the annexure shall also provide a quick comparison between the 2018 Bill and the 2019

Bill.

10

I.02 Reductionist Conception of „Data Processing‟

The term „processing‟ as defined under the 2018 Bill takes a reductionist approach and defines

processing as inclusive of all processes related to the handling of data. According to both the

Bills and the report, “processing”, in relation to personal data, means an operation or set of

operations performed on personal data, and may include operations such as collection, recording,

organisation, structuring, storage, adaptation, alteration, retrieval, use, alignment or combination,

indexing, disclosure by transmission, dissemination or otherwise making available, restriction,

erasure or destruction. This all-encompassing definition of „data processing‟ fails to explain the

distinct processes that form parts of the idea of „data processing‟ and to comprehend the distinct

legal implications they may hold.

Upon analysing the data life-cycle stages, processing activities like collection and recording of

personal data stand as the base for further activities to be performed. Though the collection of

data is an extensive activity in the present unregulated digital space and such collection on

presumed or implied consent has become order of the day, it is the most crucial stage of the data

life-cycle. It is where process-able personal data is born and the interference with the right to

privacy of the individual begins. Unfortunately, the Bills consider these activities as supposedly

posing least threat to privacy and have failed to provide for distinct legal recognition to these

matters. It could be argued that this is the global model; nevertheless, Indian legislative designers

have a chance to take a revisit the design if it is fundamentally flawed.

Laying down function-specific safeguards with regard to data collection would have been the

best way to prevent misuse of personal data, from the first stage. Further activities like

structuring and storage of personal data, which have a higher level of threat to the autonomy of

the individual providing such data, require appropriate safeguards with respect to each. This is

also absent in the Bills. Although the two categories discussed above, i.e. collection-recording

and storage-structuring are entirely different and pose varying levels of threat to personal data

privacy, the Bills have incorporated all of them under the single term „processing‟, and specified

that consent for such „processing‟ can be obtained as a whole.

It is surprising that functions like alteration, dissemination and deletion, which pose the highest

level of threat to individual privacy, are also part of the reduced terminology of „processing‟. The

absence of legal provisions providing activity-specific granular consent shall create

unmanageable ambiguity in establishing the clarity of such consent. The same has been

overlooked by the Bills. It shall be very difficult to address, litigate or remedy any breach of

consent rule, as technologies become more pervasive.

I.03 Separate Legal Regimes dealing with purposes of State and other purposes

Both the Bills seem to have classified data processing broadly into two: i.e., for the purposes of

the State and for non-state purposes. The entire idea of non-consensual data processing seems to

flow from the distinction between State (public) and non-State purposes. The Bills have

established categories in state purposes such as ordinary functions of the state, surveillance and

law enforcement functions, delivery of public services, emergency and disaster management,

public health emergencies, security and integrity of the State, foreign relations, etc., and provide

for non-consensual data processing in these cases. As an extension of the list, public-spirited

purposes such as research activities, journalism, whistle-blowing, prevention and detection of

11

any unlawful activity, including fraud, are also listed. For all the above-mentioned purposes, data

can be processed without obtaining consent from the concerned individual. Furthermore, for a

majority of the above purposes, the Bills grant a general exemption from data protection

obligations addressing the rights of the data principal, as well as exemption from compliance

with transparency and accountability measures, for data fiduciaries and processors.

Though this design seems to be well-thought-out and well-planned, the Bills are silent about

non-State purposes for which data processing may be used and how it should be performed. For

example, the phrase „commercial purposes‟ gets minimal reference in the Bill. The distinct

activities involved in personal data processing in a developing digital economy, and the

commercial aspects associated with it, get no mention in either of the Bills. The commercial

aspects involved or hidden in the above public-spirited functions also get no space in the

conceptual framework of the Bills. The extent to which data can be collected, stored, analysed,

altered and disseminated in the course of the commercial activity is regulated only by the general

provisions of the Bills. The issues related to each of these stages of data processing for a

commercial purpose have not been addressed in the Srikrishna Committee report either.

Furthermore, the Bills do not speak about the contracting-out of data processing work for State

purposes to private parties. Although the Bills have envisaged a distinction between a data

fiduciary and a data processor, the responsibilities of the data processors are nevertheless very

limited when compared to that of the data fiduciary. None of the provisions of the Bills

prescribing penalties shall apply to the data processors, other than a contributory compensation

in the case of a personal data breach. Even in the case of compensation, the liability of the data

processor is limited to acts done contrary to, or outside the scope of, the instructions of the data

fiduciary.

Considering the scale of functions to be performed, the State is recognised as a significant data

fiduciary under sections 38 and 26 of the 2018 and 2019 Bills respectively. At the same time,

extensive outsourcing of data processing to private entities is also expected. But the Bills are

silent about the activities undertaken by private data processors and the responsibilities

associated with such activities. Given that no limitation has been placed upon the state in

contracting-out its functions, the state may even contract-out its core functions such as policing,

surveillance, law enforcement and other security-related functions. This is a serious violation of

the legitimate expectations of the individuals about good and responsible governance.

In conclusion: the combined effect of the legal provisions and chapters reduces the difference

between legal regimes dealing with data processing for State functions and non-State functions

and also, as previously discussed, the gap between sensitive personal data processing and

personal data processing. The Bills, though inspired from the notions of a digital economy, also

fail to develop a separate legal regime dealing with personal data processing for commercial

purposes. These uncertainties associated with the Bills, related to personal data processing and

its various categories, shall definitely adversely affect the capacity of the individual in protecting

their data. The standards used in the latest Bill also seem to be much lower than that of the 2018

Bill. This shall be discussed in detail in Part III.

12

PART II

Theoretical Background Constituting the 2018 and 2019 Bills

The conceptual framework which has been used by the Bill and the ambiguity intrinsic to the

legal provisions developed from the framework necessitate an investigation of the theoretical

origins of the Bill. As we have discussed earlier, the fundamental intention for which the

committee was constituted was based on securing the individual‟s interest by protecting thier

right to privacy. However, the secondary objective of „unlocking the data economy‟ radically

relegates the primary goal of personal data protection to an ancillary provision. The drafting

committee has overlooked this crucial transformation and has decided to proceed further with

their twin objectives of protecting personal data and promoting the data economy.

It is interesting to point out that the theoretical bases, which have driven this work, have been

chosen very selectively and subjectively. The committee has based the personal data protection

Bill on the idea that rights are not deontological categories and that they should yield for

common constitutional objectives. Scholars like Joseph Raz and Ronald Dworkin have been

explicitly quoted and marked in the report. The committee seems to believe in the idea that the

growth of the digital economy would provide the individuals a „real choice‟ and not the illusory

notion of it. The committee seems to have accepted the realities of the present unregulated digital

space and economy as normal and sometimes even normative. The fairness and reasonableness

of the present-day activities of the digital economy have not been tested by the committee.

The committee seems to believe that a compromise of individual autonomy is essential in

making the digital economy a real choice, and it also believes that the purpose of creation of a

digital economy has the backing of constitutional objectives. It quotes Richard Pildes in saying

that rights must be subjected to a decision of state action in a given context that is necessary to

serve the common good. Such a theoretical stand has cost the Indian data protection law at least

on two counts. It compromises not only individual rights but also sovereign interests in an urge

to promote the private and mercantile interests of the digital economy.

Firstly, the proposed Bills reduce the inherent fundamental right to privacy of the individual to a

trade-able commodity. Personal data is treated as a commercial good, whereas it simply is not.

Personal data is part of one‟s own self and individuality, and no one can be compelled to transfer

or give away information regarding their self to another individual or to other entities. The sole

exception is the requirements of sovereign function, where the State is the recipient and holder of

such information shared by individuals for better governance. Thereto the modern civilized law

embodied in the Constitution keeps reasonable restrictions and limitations. The needs of the State

to have surveillance capabilities cannot be counterpoised for developing a conception of the

digital economy whereby everyone has to trade or part away with personal data. Unfortunately,

that is what the committee report and the Bills do. What is even more disappointing is that after

commercialising personal data, the committee fails to reconcile the distributional effects of the

legislation they propose.

A free and fair digital economy is one where entities are responsibly share data, and everyone

uses such data, which has immense potential for empowerment, in a manner that promotes

overall welfare. In fact, the conception of the personal data as a commodity enabling the

13

possibility of digital economy, in turn furthering the economic development of society and the

nation itself, is flawed. Tradable goods and commodities are objects which can be privately

owned and enjoyed by the holders to the exclusion of others and the holder cannot be forced to

part away with such goods. However, the Bills seem to argue that personal data is a developing

area of trade and commerce and the autonomy of the individual to decide what to do with his

personal data is important merely because it constitutes the common good of a free and fair

digital economy. Therefore, the Bills lay down no meaningful limitations on the collection,

transfer and processing of the data. They only address the misuse of personal data or personal

data breach. Only very limited preventive mechanisms are prescribed by the Bills.

Secondly, the Bills do not protect State interests either. The wide discretionary powers given to

the State, to exempt certain categories of data processing from the provisions of the proposed

law, are not sufficient to safeguard against possible breaches of data held by or on behalf of

government. It absolves employees or private parties from all responsibilities and lets them

remain self-regulated or answerable for contractual liabilities only. The Bills have failed to

recognize the State‟s role in the digital space in its entirety. This is perhaps due to a

preoccupation with the perception of the digital world as market and economy, rather than a

public space. The State‟s role, functions and interference are much more voluminous and

extensive in a public space than in a market. It is pretty discernible that the committee and Bills

have failed to identify the constitutional objective behind the terms of reference. The committee

has diluted the public interest by looking at the matter solely from the perspective of economic

interests.

The Bills and the committee report, if analysed threadbare, present a remarkable case-study on

how the demoting of individual rights loosens sovereign interests as well. The moment

individual rights are conceived as less important, private and sectorial interests capture the legal

and judicial space. A major portion of the texts of the 2018 and 2019 Bills has been spent on

specifying the responsibility of digital fiduciaries (mainly the state), i.e., obligations to respect

the rights of the data principal, transparency and accountability measures, penalties, and

compensations. Data processors (predominantly likely to be private business enterprises) who

really handle the data have received very little attention. The texts seem to have no objection in

alienating core state functions, requiring data processing, to private parties. It does not even

make an attempt to establish liabilities upon these processors, whereas the legal consequences of

the actions of the individual offering personal data are all fixed in the Bill.

This means if we take the spectrum of entities providing data, processing data, and receiving

data, the entities processing data (mostly profit-making service providers) and their actions are

less regulated, while entities providing personal data (natural persons) and entities receiving data

(especially significant data fiduciaries such as the State) and their actions have fixed

responsibilities and consequences. Even there, the natural persons are struck with loose

provisions, whereby the State can waive off all its responsibilities towards the data principal.

The rights and remedies under the act have reduced the individual‟s inherent right to privacy and

the right of self-determination into an endowment which the individual receives as a holder of

personal data. This means the State can take away, abridge or alter an entire set of rights and

obligations at its will. Going by the provisions of the Bills, an individual is not offered a „real

choice‟ as to the retention or giving away of his personal data to data processing entities. An

individual is implicitly mandated and forced in most of the cases to provide the data required by

14

the entities. He may or may not get some remedies or compensation in case a data breach occurs,

when he applies for it. But he is literally incapacitated from taking any measures to prevent the

data breach. The legislative Bills seem to have only a curative aspect to it. The preventive

mechanisms are not elaborate and effective.

15

PART III

Interpretation of Important Provisions of the 2019 Bill

The provisions of the Bills providing for personal data protection contain certain conceptual

ambiguities, which definitely need to be discussed. It is necessary to pay significant attention

towards such ambiguities and get them clarified. This is possible only with a clause by clause

interpretation of the Bills. This part shall bring forth significant sections of the 2019 Bill and

discuss them in a detailed way so that lack of clarity can be measured and remedied. This shall

initiate further analysis and appreciation.

III.01 Personal Data, Data Principal, Data Fiduciary and Data Processor

According to section 3(28) of the 2019 Bill, "personal data" means data about or relating to a

natural person who is directly or indirectly identifiable, having regard to any characteristic,

trait, attribute or any other feature of the identity of such natural person, whether online or

offline, or any combination of such features with any other information, and shall include any

inference drawn from such data for the purpose of profiling. The Bill further identifies an

individual providing such personal data for the purpose of processing as the “data principal”.

According to section 3 (14) "data principal" means the natural person to whom the personal

data relates. As per section 3 (13), "data fiduciary" means any person, including the State, a

company, any juristic entity or any individual who alone or in conjunction with others

determines the purpose and means of processing of personal data.

Apart from these two entities there exists another entity called the „data processor‟ and section

3(15) defines a “data processor” as any person, including the State, a company, any juristic

entity or any individual, who processes personal data on behalf of a data fiduciary.

It is to be understood that a data processor performs the activities of processing on behalf of the

data fiduciary. It is the data fiduciary who is still responsible for misuse of personal data. The

data fiduciaries hence face the consequences of non-compliance with the provisions of the Bill.

Comments

A data principal can be any natural person to whom such personal data relates. Processing of

personal data would ultimately affect (either positively or negatively) the individual providing

such data. Hence, the data principal is seen to be the focal actor of the digital economy. The

report of the committee clearly identifies that it is entirely based on fundamental expectation of

trust, an individual provides data to an entity. Hence such entities have been referred to as “data

fiduciaries” under both the Bills. These terminologies are different from what is being used

under other jurisdictions. For instance, the EU GDPR uses the term “data subject” to refer to an

individual whose data is being collected and “data controller” to refer to the entity that

determines the purpose and means of processing the data.

The Bills recognise the relationship between the data principal and the data fiduciary and state it

as necessary to ensure a free and fair digital economy. Free here means to protect the autonomy

of individuals and fairness aims to reduce the inequalities of bargaining power. But looking at

the provisions of the Bills, it clearly fails to address the question of „how‟ to protect the

autonomy of individuals (right to privacy, in this case). The committee report and the draft Bills

16

are clear as to what needs to be protected and the system of classifying them effectively for

differential treatment, but at the same time fail to specify the means of protecting such personal

data by applying different protection measures. Therefore, it remains unclear how the Bill

protects the autonomy of an individual.

III.02 Sensitive Personal Data

Not all personal data, when processed by the data fiduciaries, result in similar consequences to

the data principal. Therefore, further classification of personal data is done based on the intensity

of importance of such data, and on the extent of harm the data principal might need to suffer

while facing the consequences of processing of such data. According to the 2019 Bill, as per

Section 3 (36), financial data, health data, official identifier, sex life, sexual orientation,

biometric data, genetic data, transgender status, intersex status, caste or tribe, religious or

political belief or affiliation are some of the personal data identified as sensitive personal data.

Further, according to Section 15 of the 2019 Bill, the Central government may notify such

personal data to be sensitive personal data on the basis of significant harm that it may cause to

the individual, on legitimate expectation of confidentiality, and the risks associated with it.

Comments

However, it needs to be understood that intensity of importance of any personal data is highly

subjective and it doesn‟t mean that only sensitive personal data can cause significant harm or risk

to the data principal. Sensitivity of personal data should be determined either on the basis of an

individual‟s consideration or based on requirement. For example, X may be very sensitive about

his genetic data and feel that it needs to be highly protected. At the same time, Y may feel data

regarding his genetic identity is least important for him and may be freely willing to share such

data in the public domain. The above example explains the determination of sensitivity by the

data principal. As the example discusses, not every data principal perceives sensitive personal

data the same way as prescribed under the Bills.

Another illustrative example could be that of a Human Rights defender wanting to keep his

family‟s address and location hidden from a popular vigilante. If his address is not considered as

sensitive, an address shared by him for receiving e-commerce services may be disseminated and

made available in the public domain. The risks associated thereafter need to be faced by him and

hence it is the requirement of his profession for his personal data to be sensitive. Therefore, the

choice of determining sensitivity and the choice of consenting for the processing of such data

needs to lie in the hands of the data principal, rather than with the Authority or State or any other

entity. After all, being the focal actor of all processing activities, it is the data principal who

would face the consequences of breach of such sensitive data.

It is to be noted that “passwords” were also recognized as sensitive personal data under the 2018

Bill. The 2019 Bill has not incorporated it as sensitive personal data referring to the laws of other

jurisdictions.

III.03 “Processing”

According to Section 3(32) in the 2019 Bill, "processing" in relation to personal data means an

operation or set of operations performed on personal data, and may include operations such as

collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, use,

17

alignment or combination, indexing, disclosure by transmission, dissemination or otherwise

making available, restriction, erasure or destruction.

Comments

The definitions of the term „processing‟, as proposed by both the Bills, are highly reductive.

Activities under „processing‟ may include collection, recording, organising, structuring, storage,

alteration, dissemination, erasure or deletion. It needs to be understood that incorporating

entirely distinct functions under a single term makes it ambiguous as to the meaning it conveys

in different contexts. Activities like collection, storage, analysis, and dissemination are different

activities involved in the idea of processing, generating significantly different consequences. The

2019 Bill is silent when it comes to defining these distinct functions that are part of the term

„processing‟. These activities or the stages of data processing involving these activities need to

be properly defined under the Bill and clearly mentioned wherever necessary. They are:

Collection: Being the very first stage of the data life-cycle, it is the most critical element to be

considered while addressing data privacy. Though mere collection of personal data doesn‟t cause

any significant consequence to the data principal, it stands as the base for further activities to be

performed. As discussed earlier, collection is where processable personal data is born and the

interference with the right to privacy of the individual begins. Although section 6 of the 2019

Bill states personal data shall be collected only to the extent that is necessary for the purposes of

processing of such personal data, the extent of necessity here is to be determined by the data

fiduciary. This means that the data fiduciary can determine any personal data as necessary for

providing a service and request the data principal to provide the same. It is the right of an

individual not to provide data if he/she feels insecure about providing such personal data. Hence

it is important to prescribe statutory measures regulating this very initial stage of collection in

order to ensure effective protection of personal data. The Puttaswamy judgement recognizes

collection regulations as the primary rule of the data protection regime.

Storage: Storage of personal data is yet another distinct activity to which significant attention

needs to be paid in the current age of rapid technological development. After the identification of

data into different types, it becomes essential that the distinct protection measures to prevent data

breach be clearly laid out. The Bill also lacks conceptual clarity when it comes to cross-border

transfer and storage. Technologies like blockchain and cloud storage do not store data on a single

server but on multiple servers across the globe. Such complications have not been discussed in

the Bill. This further adds to the ambiguity with regard to incorporating new and developing

technologies used in the processing of data.

Analysis: This activity of processing is the core purpose for collection, organisation and storage

of data. It is for this purpose of „analysis‟ that the above-mentioned activities are carried out.

Further, this activity is carried out to meet the purposes of processing of personal data and to

arrive at results, implications, inferences and conclusions which satisfy the needs of the data

fiduciary. Hence, it is critical to prescribe data protection measures at this stage, whereas the Bill

speaks of no such distinct measures with regard to this activity as well.

Dissemination: This activity of processing poses the highest level of threat to an individual‟s

privacy, as it involves sharing of personal data widely. It is also one of the critical elements of

processing, which can directly cause significant harm to the data principal. The Bill has

incorporated all of the above-mentioned activities under the single term „processing‟ and consent

18

for such „processing‟ can be obtained as a whole. This ignores the possibility that an individual

might have consented for collection and storage but not for dissemination. The individual is

denied the choice of providing granular consent where he/she can provide consent for each of

such above-mentioned distinct activities that form a part of processing.

Other similar activities such as „alteration‟ and „modification‟, which have different

consequences when performed, are also defined separately. The drafters of the Bill have failed to

specify the protection measures that need to be undertaken at each of the stages of processing.

These measures and other regulations need to be clearly laid out in the Bill, rather than being

specified later by the Authority, as this would be the core purpose of this Bill being put forth for

discussion and implementation. Although the Bill clearly lists out as what needs to be protected

and is clear as to why data needs to be protected, a Bill titled „Personal Data Protection Bill‟

cannot be so vague in laying out specific protection measures to be undertaken for the different

types of data especially those identified by the same Bill.

III.04 Obligations of a Data Fiduciary

While processing personal data provided by the data principals, the data fiduciaries have certain

obligations which the law expects them to fulfil. Section 4 of the 2019 Bill allows for personal

data to be processed only for a lawful purpose that is specific and clear by stating that “No

personal data shall be processed by any person, except for any specific, clear and lawful

purpose”. Additionally, Section 5(a) of the Bill provides for personal data to be processed in a

fair and reasonable manner and ensure the privacy of the data principal. As per Section 5(b),

the purpose of processing is limited for the purpose consented to by the data principal or which

is incidental to or connected with such purpose, and which the data principal would reasonably

expect that such personal data shall be used for, having regard to the purpose, and in the context

and circumstances in which the personal data was collected.

Section 6 of the 2019 Bill states that personal data shall be collected only to the extent that is

necessary for the purposes of processing of such personal data. In compliance with Section 7,

every data fiduciary shall provide the data principal with a notice, at the time of collection of the

personal data, or if the data is not collected from the data principal, as soon as reasonably

practicable, containing information about the purpose of collection of their personal data, nature

and categories of such data being collected, the identity and contact details of the data fiduciary,

data processor (if any), process and consequences of withdrawal of consent and other necessary

information as mentioned under the section.

Comments

It needs to be observed that under Section 6, it is fair for collecting such personal data that is

only necessary for processing. But the necessity of such data is totally left to the data fiduciary

i.e., to determine what is necessary and what is not. This way there is a high risk of the data

fiduciary classifying irrelevant (unnecessary) personal data to be necessary for processing and

request access to those from the data principals. Also, no other provision of the Bill provides for

the review of the actual necessity of personal data for processing, as determined by the data

fiduciary.

19

It should be noted that Section 7 of the Bill includes the phrase “at the time of collection of the

personal data” which provides scope for the data fiduciary to not comply with the information

provided as per the notice. This is again because, further provisions of the Bill don‟t speak about

„whom to‟, „when to‟, and „how to‟ inform about any change in the information which was

provided earlier in the notice. Furthermore, using the clause “as soon as reasonably practical”,

the proposed law is providing for instances of no-pre-consent mode of data collection, storage,

analysis and dissemination.

III.05 Consent and Explicit consent

Consent is seen to be necessary for the processing of personal data. Though written consent is

not explicitly mandated, according to Section 11(2) of 2019 Bill, consent obtained from the data

principal needs to be:

a) Free – must meet the standards specified under section 14 of the Indian Contract Act,

1872. This means that consent should not be caused by coercion, undue influence, fraud,

misinterpretation or mistake.

b) Informed – The data principal needs to be provided with the information required as per

Section 7 of the 2019 Bill, through a notice. This section, as discussed earlier, requires

information such as information regarding purposes for processing, categories of data

collected, contact details of data fiduciary and data processors, procedure for grievance

redressal, etc. to be informed to the data principal.

c) Specific - The Bill stipulates that the data principal can determine the scope of consent in

respect of the purposes of processing or not.

d) Clear - The Bill require the consent to be indicated through an affirmative action that is

meaningful in a given context. As mentioned earlier, there must be clarity of consent, it

must be clear and explicit on the document evidencing such consent, and should not be

read into by interpreting subsequent practice or conduct.

e) Capable of being withdrawn – Consent once given must be capable of being withdrawn

by the data principal, having regard to whether the ease of such withdrawal is comparable

to the ease with which consent may be given. This means that withdrawal of consent

should not be a strenuous process when compared to the procedure with which consent

was given.

In addition to the above conditions, as per Section 11(3), explicit consent is necessary for

processing sensitive personal data. Explicit consent here means consent which is obtained after

the individual who gives such consent is made aware of the significant consequences of

processing such data. The Bill clarifies that the consent must be clear without having recourse to

inference from context. The clarity of such consent therefore should not be based on any

secondary interpretation. Such consent also needs to be specific about whether the data principal

is given the choice of separately consenting to the purposes or operations performed under

„processing‟. It is to be noted that a written consent is not a must.

Comments

A fiduciary relationship is a situation where one has a duty to protect the interest of the other

without using one‟s influence to one‟s own advantage. However, as per section 11(2)(a), when

consent is required to be free, it is important to note that many data fiduciaries request online

consent, which is to be compulsorily provided by the data principal in order to avail the service

20

offered by the data fiduciary. The denial of such consent would mean denial of service. This

means there is always the element of undue influence present in the agreements providing for

access to personal data. There is always a dominant position enjoyed by the data fiduciary.

Though the denial of service is outlawed in the Bill, the service providers are given complete

autonomy to decide the extent of personal data required to perform the functions undertaken by

them, and the data principals are made completely responsible for not providing consent for

accessing such personal data as determined by the service providers. This leaves the provision

prohibiting denial of services defunct.

We have seen that consent for processing includes a general permission to the data fiduciaries

and processors to do whatever they deem fit in handling such data. It must be further noted that

the laws provide for self-regulation by the data fiduciaries when it comes to limitation of data

collection, notice of data collection, and retention of personal data. The Bills do not stipulate

anything which could effectively regulate the exercise of self-regulatory capabilities provided to

the fiduciaries. The explanation given for clarity of consent is also quite ambiguous when

compared to the definition given for the clarity of explicit consent.

Explicit consent simply means the individual who gives such consent must be made aware of the

significant consequences of processing such data. The Bills do not mandate a written consent,

although it comes up with high standard for „clarity‟. The Bills state that the consent must be

clear without having recourse to inference from context. The clarity of such consent therefore

should not be based on any secondary interpretation. It must be clear and explicit on the

document evidencing such consent and should not be read into by interpreting subsequent

practice or conduct. However, these explanations make the provision prescribing standards of

consent in Section 11 clause (a) and the requirements of notice of Section 7 ineffective. It leads

to the negative interpretation of these provisions. A notice under section 7 therefore can be

argued as not requiring an explanation of the significant consequences of processing personal

data to the data principal. This means the standard of „informed‟ consent differs in the cases of

personal data and sensitive personal data processing, while the difference between personal data

and sensitive personal data is of no consequence in deciding the standard of informed consent. It

allows the data fiduciaries to keep silent about the harmful or negative consequences of the

processing even when they have perfect knowledge about such consequences.

Similarly, consent obtained in the case of processing of personal data can be argued to not to

involve the standard of clarity as required by sensitive data. There is simply no intelligible

difference between these two categories of data having a rational connection with the differential

prescription of standards of clarity. The standard fixed for sensitive personal data, i.e. explicit

consent, is further defined as consent which is evincible without secondary interpretation of the

agreements and that has been given following a comprehensive understanding of the

consequences of such consent and the legal remedies. However, the drafters fall short in not

mandating „granular consent taking‟, stating the issue of consent fatigue.

Though granular consent is prescribed under the section 13(3)(c), the language used in the texts

does not bother about whether the individual actually exercises it or not. Once again, when it is

the data fiduciary deciding about the necessity of data, legal provisions safeguarding against

denial of service cannot function effectively. Even allied or ancillary functions can be clubbed to

the main function or service feature provided the data fiduciary, and compel data principals to

consent to all of the options given. Though the report of the Justice B. N. Srikrishna Committee

21

considers this issue of consent fatigue, i.e. users of the digital instruments feeling annoyed or

demotivated upon reading numerous clauses before they give consent, it doesn‟t prescribe any

innovative solutions to circumventing the same.

Looking closely at the differences in legal regimes of personal data, sensitive personal data and

critical personal data, consent needs to be explicit according to the above-mentioned conditions

when it comes to processing of sensitive personal data, whereas when it comes to the processing

of personal data, it need not be. Nevertheless, the Bills are ambiguous about what they mean by

explicit consent.

III.06 Grounds for Non-consensual Processing and Exemptions

The committee report recommends that personal data and sensitive personal data shall be

processed without consent in certain specific cases. These cases include: functions of the state,

compliance with law, order of court or tribunal, purposes of employment, in situations where the

individual is incapable of providing consent and other reasonable purposes. It is to be noted that

the data fiduciary obligations, data principal rights, transparency and accountability measures are

still applicable in these cases. Nevertheless, certain other functions are additionally exempt from

these obligations and measures as well. This gives a significant leeway for certain data

fiduciaries and processors to circumvent all the regulations put in place by this legislation. The

following are the grounds providing for such processing, along with a discussion of their

implications.

a) State functions and the security of the State:

According to section 12 of the 2019 Bill, the State may process data without consent if it

is necessary for any function of Parliament / State legislature. It is to facilitate the

provision of any service or benefit to the data principal from the State. It is also for

certification and licensing purposes. The Bill does not distinctively treat personal and

sensitive personal data in this regard, and allows for both to be processed without consent

to perform state functions. While the Bill provides this broader category of general State

functions as grounds for non-consensual processing, it establishes security of the State as

a separate category and empowers the state to exempt the data processors and fiduciaries

processing personal data. According to section 35 of the 2019 Bill, for protecting the

interest of sovereignty and integrity of India, the security of the State, friendly relations

with foreign States, or public order, the central government may by order exempt any of

these agencies of the state. The order issued shall also prescribe such procedure,

safeguards and oversight mechanism to be followed by the agency. Interestingly, the Bill

does not seem cognisant enough about the boarder category of state functions, which may

include widely disparate operations such as policing, surveillance, economic re-

distribution and development activities, etc. To provide for blanket exemption to all these

categories from the rule of consent is excessive in nature.

It is important to note that the earlier Bill of 2018 didn‟t empower the state from waiving

off its obligations with respect to three specific sections. These included directions to

respect the individual‟s right to privacy, promote free and fair processing, follow the

safeguards to be prescribed by Data Protection Authority, were still applicable. But the

provisions of the 2019 Bill have given additional powers to the central government to

exempt all the agencies of the government from all the obligations under the Bill. This

22

can be reasonably presumed to be the same case even when a private party is contracted

for outsourcing of State functions involving data processing.

Furthermore, the scope of the section 35 is such that the data principal loses all the rights

enshrined under this law. This means he is no longer eligible to realise his rights to

confirmation, access, correction, erasure, data portability and even the right to be

forgotten in the case of exemption declared by the State. This means a data principal can

be even denied to access and confirm the personal data provided by him, correct incorrect

data, or even furnish incomplete data. The data principal loses even the right to be

forgotten which makes this provision absolutely unreasonable.

It is to be kept in mind while imagining the impact of this provision that already

according to the proposed provisions of the Bill data processors have no penalties or

consequences legislatively fixed, except for the contributory compensation to be paid to

the data principal in cases of personal data breach. This means a large number of

institutions which are collecting, storing, analysing and disseminating personal data are

left to be regulated only by the contractual relations they may undertake with the data

fiduciaries. Most of these contracts are drafted by highly paid lawyers and come with

stringent clauses limiting the liabilities of these processors. The nature of contracts also

differs from case to case; for example, it may be a professional services agreement or a

service execution arrangement. The liability clauses differ in both. This leaves the rights

of individuals in jeopardy, because the proposed Bill does not fix even minimum

standards of processing responsibilities for data processors.

Justice B. N. Srikrishna himself commented that this provision “will weaken the Bill and

turn India into an Orwellian State”. This poses a high threat to the privacy of an

individual. When private data processors are exempted from any (or all) of the sections of

the Bill, personal data becomes highly vulnerable for misuse and security measures in

such cases may not be applicable, and in the end, it would be the data principal facing all

its consequences without having adequate remedies.

b) Judicial and legal proceedings:

According to section 12, non-consensual data processing is permitted with regard to

judicial and legal processes explicitly mandated by law. The Bill states that data can be

processed without consent, if it is „necessary‟ for compliance with law or any order of

any court or tribunal. This is done to avoid inconsistency with obligations under other

laws, regulations and judicial orders. Though personal and sensitive personal data can be

processed without consent in this regard, other provisions are still applicable.

Apart from this, according to section 36, personal data processed for legal proceedings

with regard to the interests of prevention, detection, investigation and prosecution of any

offence or any other contravention of law have been exempted from certain specific

chapters of the Bill. Chapters II to VII of the 2019 Bill have been exempted for

processing on the above-mentioned grounds. These exempted chapters, as mentioned

earlier, are the ones establishing data fiduciary obligations, grounds for non-consensual

processing, data principal rights, transparency and accountability measures, and

23

restrictions on cross-border transfers. Among these chapters, the only applicable sections

include section 4, which speaks about processing for a specific, clear and lawful purpose,

and section 24, which speaks about security safeguards to be opted.

At this point, it is important to look at those provisions which are exceptions to the

provisions providing for the above mentioned exemptions. Section 24(1) of Bill 2019

states that “having regard to the nature, scope and purpose of processing personal data

undertaken, the risks associated with such processing, and the likelihood and severity of

the harm that may result from such processing, the data fiduciary and the data processor

shall implement appropriate security safeguards including—

(A) use of methods such as de-identification and encryption;

(B) steps necessary to protect the integrity of personal data; and

(C) steps necessary to prevent misuse, unauthorised access to, modification,

disclosure or destruction of personal data.”

It is to be noted that the section which is applicable to all cases (except in the case of

exempted state purposes), fails to lay out minimum guidelines as to what the „appropriate

measures‟ are or how they need to devised. The Bill neither prescribes nor obligates the

Data Protection Authority to establish such guidelines. The steps which are necessary to

be taken by the data fiduciaries to protect the integrity of personal data or to prevent its

misuse have not been mentioned anywhere, and it has been totally left to the data

fiduciaries to determine and apply them.

Further, the Bill doesn‟t prescribe any models for periodic review of these safeguards,

self-designed and implemented by data fiduciaries and processors. It does not even fix the

periods after which reviews need to be undertaken. Section 24(2) provides that after a

periodic review, data fiduciaries and processors may follow appropriate measures

accordingly. Nevertheless, the appropriateness is again determined by the fiduciaries and

the processors. It is also doubtful and unclear as to what may be recognised as

appropriate measures.

c) Prompt action requirements

According to section 12(d), (e), (f) of the 2019 Bill, personal data can be processed

without consent during the times of public health, medical and disaster emergencies. This

is because an individual may be incapable of providing consent in such critical situations.

It is to be noted that both personal and sensitive personal data can be non-consensually

processed only when it is „necessary‟, with no differential treatment. The necessity of

accessing sensitive personal data for prompt action needs to be reviewed and then

incorporated into this section. Nevertheless, the proposed law which allows for this rule

uses the language of exemption, not that of process regulation. These unregulated

exemptions with easy thresholds provide for expansive use of personal data, sometimes

for unintended purposes as well. The personnel of data fiduciaries and processors

handling such data during these emergencies need to take special care and precautions for

not compromising the right to privacy of the individuals concerned.

24

d) Employment purposes

According to section 13 of the 2019 Bill, personal data for employment purposes may be

processed without consent, when the processing under consent would involve

disproportionate efforts (for the employer) or the employment relation makes such

consent inappropriate. Employment purposes may include recruitment, termination,

assessment of performance, verifying attendance, and for providing any service or benefit

to the employee. According to the Bill, only personal data can be processed without

consent for employment purposes, where necessary. Sensitive personal data cannot be

non-consensually processed for employment purposes. A clear distinction has been made

for the first time for differential treatment of personal data and sensitive personal data.

Nevertheless, the Bill fails to mention that the employee should not be forced to part with

his personal data for receiving mandatory social security or employee benefits.

e) Reasonable purposes

Personal data can be processed without consent under the grounds of reasonable

purposes. These purposes may be specified by the Authority being established, along

with safeguards. The Authority may specify such reasonable purposes after considering

(A) the interest of the data fiduciary in processing for that purpose;

(B) whether the data fiduciary can reasonably be expected to obtain the consent of

the data principal;

(C) any public interest in processing for that purpose;

(D) the effect of the processing activity on the rights of the data principal; and

(E) the reasonable expectations of the data principal with regard to the context of

the processing.

The Bill provides for both personal and sensitive personal data to be processed without

consent in the case of reasonable purposes. These reasonable purposes may include

prevention and detection of unlawful activity, including fraud, whistle blowing, mergers

and acquisitions, network and information security, credit scoring, recovery of debt,

processing of publicly available personal data and operation of search engines. It is to be

noted that non-consensual processing for the operation of search engines has been

provided for only in the 2019 Bill and not in the previous version. This has now increased

the threat to personal data in the digital arena. The Authority needs to ensure that the

specified appropriate safeguards have been complied with, so that misuse of personal

data, under the guise of reasonable purposes, can be prevented.

The Bill here essentially fails to recognise that credit scoring and the operations of search

engines involve lot a commercial interest. The benefits which credit scoring agencies and

search engine providers receive by generating large data pools and resources are not

taken into account by the Bill. The credit scoring undertaken by an agent at the request of

the credit provider is different from the credit scoring undertaken without a specific

request. Similarly, data processing for the purposes of search engines to optimize search

25

results also varies when it comes to optimisation requested and not requested. Often, the

purposes of search engines are to provide targeted delivery of goods and services to the

consumer. When these are not essentially requested by the consumer, or when the

consumer has not been given an opportunity to opt out, it is a blatant violation of

consumer law principles.

There is nothing provided in the Bills to address such issues. A significant mass of the

statutory text is used to provide exemptions for the law, whereas there is little when it

comes to regulatory standards to be applied in the relationship between various

stakeholders in the data economy.

f) Public-spirited activities like journalism and research purposes:

According to section 36 (e), processing of personal data found necessary for or relevant

to a journalistic purpose, is exempted from chapters II to VII. Applicable restrictions

include lawful purposes and security safeguards, provided under sections 4 and 24

respectively. However, it is necessary for such a journalistic purpose to be in compliance

with any code of ethics issued by the Press Council of India, or by any media self-

regulatory organisation. This exemption is granted protecting the fundamental right of

freedom of speech and expression.

According to section 38, where processing of personal data is necessary for research,

archiving, or statistical purposes, the Authority may, by notification, exempt such class of

research, archiving, or statistical purposes from the application of any of the provisions

of this Act as may be specified by regulations. However, processing of personal data for

research, archiving and statistical purposes is exempted from any provision only when:

(A) the compliance with the provisions of this Act shall disproportionately divert

resources from such purpose;

(B) the purposes of processing cannot be achieved if the personal data is

anonymised;

(C) the data fiduciary has carried out de-identification in accordance with the code

of practice specified under section 50 and the purpose of processing can be

achieved if the personal data is in de-identified form;

(D) the personal data shall not be used to take any decision specific to or action

directed to the data principal; and

(E) the personal data shall not be processed in the manner that gives rise to a risk

of significant harm to the data principal,

Sections regarding fair and reasonable purposes, security safeguards and data protection

impact assessment, which were earlier part of the 2018 Bill, are not applicable under the

2019 Bill. The Authority being established has to specify such exempted categories of

research, archiving or statistical purposes which are exempted from the provisions.

In this case, proper clarity needs to be established with regard to the type of research

which is being undertaken. For instance, the protection of personal data need not be

compromised for a research for business purpose. Such a research may not benefit the

data principal directly or even significantly. Therefore, the Authority must look into the

benefit of such research to the data principal before exempting such class of research

26

from any of the provisions. It must be also noted that section 38 is in conflict with earlier

provisions exempting search engine operations from the consent requirement. The search

engine collection and analysis of data could have been regulated under this section or

using similar principles which would effectively set limitations or regulations dealing

with automatic search engine operations and targeted delivery of advertisements or

search suggestions.

g) Purely personal and domestic purposes:

Personal data processed by a natural person in the course of a purely personal or domestic

purpose, is exempted from chapters II to VII (contents have been discussed earlier).

Again, applicable restrictions include lawful purposes and security safeguards, provided

under sections 4 and 24 respectively. This exemption is not applicable when processing

of such personal data involves disclosure to the public, or is undertaken in connection

with any professional or commercial activity. Hence the term „purely personal‟ was

coined by the committee. It is clear that a restriction cannot be imposed on the smallest

level of intrusion of privacy using mobile cameras, audio recorders or CCTVs. The

activities which are considered to be purely personal or domestic need to be clearly listed

out by the Bill while exempting them from provisions of the Bill. However, it is doubtful

that whether these exemptions can apply when the domestic collection and processing of

personal data involves third party‟s personal data.

h) Manual processing by small entities:

According to section 39 (1), the provisions of sections 7, 8, 9, clause (c) of sub-section

(1) of section 17 and sections 19 to 32 shall not apply where the processing of personal

data by a small entity is not automated. Not all personal data is digitally processed by

automated means. Personal data can be processed by small entities which need not

comply with the above-mentioned sections. These sections essentially speak about

requirement of notice, quality of personal data processed, restriction on retention of

personal data, specific data principal rights, and all transparency and accountability

measures. It also needs to be noted that a "small entity" means such data fiduciary as may

be classified, by regulations, by Authority, having regard to— (a) the turnover of data

fiduciary in the preceding financial year; (b) the purpose of collection of personal data

for disclosure to any other individuals or entities; and (c) the volume of personal data

processed by such data fiduciary in any one day in the preceding twelve calendar

months. Therefore, it is again the Authority who needs to specify such entities who can

manually process data as per these exemptions. As per this provision, the purposes for

which small entities process personal data can be determined by such an entity and they

need not provide a notice as required by section 7. It also doesn‟t fit into the restrictions

placed on retention, i.e., storage of such data. Hence this would give small entities a

chance to compromise the privacy of an individual by non-consensually processing

personal data without complying with protection measures as specified by the Bill.

It is contended that the purely domestic, personal and manual processing needs no

exemptions from all the provisions of the Bill. On one hand, the provisions which may

unreasonably burden such activities need not continue to apply in these cases, while all

27

adequate levels of precaution and remedies in the cases of personal data breach may still

apply. The right to privacy of the individuals need not be compromised for these

purposes.

These provisions have a cultural outlook, whereby the proposed law is seeking to protect

community and family interferences with the personal lives of the people. While such

interferences with the right to privacy per se need not be treated with contempt, there

should certainly be some reasonable limits to set to such interferences as well.

28

PART IV

RECOMMENDATIONS

Conceptual Core

“Shadkarnath Bidhyethe Mantrah:”

“That which is heard by a third pair of ears is no more personal or private.”

(Chanakya)

The below are the recommendations made to resolve certain issues identified above.

1. Separate legal regimes for the distinct stages of processing need to be developed and

incorporated into the provisions of the Bill. For instance, major stages involved in

“processing” may be reasonably classified into Collection-related activities, Storage-

related activities, Analysis-related activities and Dissemination-related activities. The

legislation can issue directives in order to take different activity-specific protective

measures at each stage. 2. The doctrine of essentiality: Personal data should be processed only on the grounds of

'essentiality' rather than the current standard of 'necessity'. Not only access and collection

but also the scope of activities such as organisation, storage, analysis, and dissemination

should be limited under the same rule. Individuals must have the right to contest the

decision of essential requirements by the data fiduciary or processor.

3. Single Standard of Informed Consent for the processing of the all types of data: The

consent to be obtained should be

a. free, having regard to whether it complies with the standard specified under

section 14 of the Indian Contract Act, 1872;

b. informed, having regard to whether the data principal has been provided with the

information required under section 7 of bill 2019 and the purpose of, or operation

in, harm to the data principal, and estimated probability of such occurrence of

such harm;

c. unambiguous and clear, having regard to whether it is indicated through an

affirmative action that is meaningful in a given context and without recourse to

inference from conduct in a context;

d. granular, providing the data principal the choice of separately consenting to the

different stages of processing; and

e. withdraw-able, having regard to whether the ease of such withdrawal is

comparable to the ease with which consent may be given.

The Data Protection Authority may specify field-specific additional requirements, after

analysing the special needs of the said field.

4. Self-determination of sensitivity: An individual should be able to deny consent for the

processing of personal data based on what he considers as sensitive for his life, and his

privacy. Denial of consent by the person on the grounds of sensitivity should not lead to

denial of service. The Data Protection Officer of the Data Fiduciary or Processor must

attempt reconciliation strategies. Any dispute may be referred to the Adjudicator‟s office.

29

The fees charged at the Adjudicator‟s office must be reasonable and affordable. Legal aid

may be sought by aggrieved individuals.

5. Default machine settings or consent on usage restrictions: Active choice option needs

to be present for obtaining consent from the data principals. No person shall be

automatically dragged into a situation where consent is assumed or implied just by

availing a service.

6. Statutory Liabilities for Data Processors: Statutory liabilities for Data Processors are

the only way by which state interests, as well as human rights, can be safeguarded.

7. Single Legal Regime for Data Fiduciaries and Data Processors: All data recipients

(whoever receives or works with personal data of data principals) should be statutorily

liable and should not escape from the scope of law by way of characterising their roles

differently as fiduciary, processor, controller, agent, or others.

8. Expand Access to Justice: The legislation of the present model, without exception,

must call for tribunals in every state and Adjudicators in every district.

9. Indicate Provisional Measures: Since data breach or privacy violation is most likely to

be continuous in nature, the legislation must provide for provisional measures to be taken

by Data Protection Officers, Adjudicators, Tribunals, and Data Protection Authority,

pending any decisions on the issues they are handling.

10. Duty of the Data Principal: Along with the various rights of the data principal, it

should be a duty of the data principal to follow digital discipline by becoming aware of

the digital world, its players and create digital content judiciously.

xxviii

ANNEXURE 1

xxix

xxx

xxxi