New Delhi: The Editors Guild of India (EGI) and DIGIPUB expressed a series of concerns they have over the Digital Personal Data Protection Bill, 2023, saying it carries various provisions that can have an adverse impact on press freedom.
In a statement published on August 6, the EGI said the Bill could be used to widen the government’s existing powers of censorship because Clause 37(1)(b) will allow the Union government to “censor content on vague and unspecified grounds ‘in the interest of the general public'”.
“We are deeply concerned about the lack of exemptions for journalists from certain obligations of the law, where the reporting on certain entities in public interest may conflict with their right to personal data protection. The Justice Srikrishna Committee report had noted that ‘If journalists were made to adhere to the grounds of processing personal data, it would be extremely onerous for them to access information’, and that ‘mandating grounds of processing like consent would mean that accounts that are unfavourable to the data principal would simply not get published’,” the statement says.
The EGI also raised concerns that the Bull could “unreasonably widen the scope of exemptions” available to public information officers of government ministries and departments to reject RTI applications on the simple basis that the information sought ‘relates to personal information’.
“While exemptions provided to the government and its instrumentalities are near-absolute, the Data Protection Board [DPB] to be constituted thereunder has not been provided sufficient independence and rulemaking powers,” the statement adds, noting that because that all members of the DPB will be appointed by the Union government, its “independence remains in doubt”.
DIGIPUB, a foundation formed by digital-only news organisations, echoed similar concerns, adding that the proposed requirement for children to have parental consent for access to online news publications, especially for children from the ages 13 to 17. DIGIPUB said that this will “greatly restrict their access to legitimate news sources”.
“Additionally, the requirement preventing Data Fiduciaries from processing the data of children will mean that merely in order to access news, they will have to register/login. The approach towards protection of Children online needs to be reconsidered, in order to not hamper their access to knowledge,” the statement said.
Read the full statements issued by the Editors Guild of India and DIGIPUB below.
§
The Editors Guild of India is deeply concerned about the Digital Personal Data Protection Bill, 2023, which has been presented before the Lok Sabha on August 3, 2023 by the Hon’ble Union Minister for Electronics and Information Technology, Mr. Ashwini Vaishnaw. The bill carries various provisions
that can have an adverse impact on press freedom.
We highlight some of the primary concerns below:
A. Concerns over democratic process
We note the irregularities in the manner in which the Bill has been brought before the Parliament. Bypassing democratic processes, such as transparency in the public consultation process as well as lapses in parliamentary procedure in tabling the Bill before the Parliamentary Standing Committee, have contributed to the drafting of a Bill that provides significantly lower protections than those envisaged initially by the Justice BN Srikrishna Expert Committee and by the Supreme Court in its landmark Privacy Judgment of Justice K.S. Puttaswamy v. Union of India.
B. Concerns over surveillance over censorship and lack of surveillance reform
We note, with dismay, that while the Bill, ostensibly to promote data protection, has failed to make any provisions that bring about the surveillance reform that is urgently needed, and in fact creates an enabling framework for surveillance of citizens, including journalists and their sources. While clause 17(2)(a) allows the Union Government to issue a notification exempting any “instrumentality of the State” from the provisions of this Bill, thereby out of the ambit of data protection restrictions, including internal sharing and processing of data, Section 17(4) allows the government and its instrumentalities to retain personal data for an unlimited period of time. Additionally, under Section 36, the Government can ask any public or private entity (Data Fiduciary) to furnish personal information of citizens, including journalists and their sources.
C. Concerns over widening of censorship powers:
The Bill provides the Union Government with an opportunity to widen its existing powers of censorship. Clause 37(1)(b) of the Bill will allow the Union Government to censor content on vague and unspecified grounds ‘in the interest of the general public’. This will increase censorship powers well beyond what is presently provided for under Section 69A of the Information Technology Act, 2000, and may even be unconstitutional for going beyond the reasonable restrictions on free expression enumerated under Article 19(2) of the Constitution of India.
D. Concerns over lack of exemptions for journalistic activities
We are deeply concerned about the lack of exemptions for journalists from certain obligations of the law, where the reporting on certain entities in public interest may conflict with their right to personal data protection. The Justice Srikrishna Committee report had noted that “If journalists were made to adhere to the grounds of processing personal data, it would be extremely onerous for them to access information”, and that “mandating grounds of processing like consent would mean that accounts that are unfavourable to the data principal would simply not get published.” It had thus provided a framework for balance between personal data protection and public interest, which we note is missing from the current bill. This will lead to a chilling effect on journalistic activity in the country.
E. Concern over impact on the Right To Information (RTI)
As has been already been pointed out by some activists, certain provisions of the Bill, Clause 44(3) for instance, unreasonably widen the scope of exemptions available to Public Information Officers of government ministries and departments to reject RTI applications under Section 8(1)(i) of the Right to Information Act, 2005, on the simple basis that the information sought ‘relates to personal information’. The RTI Act in its present form strikes a balance between privacy and the right to public information. This provision shifts the balance in favour of non-disclosure of information, including information which is being sought by journalists in public interest, thereby reducing accountability. It is necessary that the RTI Act
not be weakened.
F. Concerns over the composition of and appointment to the Data Protection Board
While exemptions provided to the government and its instrumentalities are near-absolute, the Data Protection Board to be constituted thereunder has not been provided sufficient independence and rulemaking powers. Lawyers, scholars and even judgments of the Supreme Court have noted that Tribunals (such as the Data Protection Board) must remain independent of control by the executive, to maintain their effectiveness and credibility. However, given that all members of the DPB will be appointed by the Union Government (Clause 19(2)), its independence remains in doubt. Considering the huge fines that can potentially be imposed, the independence of the Board from executive interference is vital to preserve liberty.
The Guild urges Ministry of Electronics and Information Technology to reconsider the provisions that Editor’s Guild of India has highlighted, and work to offer a data protection legislation to Indian citizens that does not compromise their right to free expression, right to information and right to a free press. Further, the Guild urges the Speaker of the Lok Sabha, to place the Bill before the Parliamentary Standing Committee for deliberation on the issues raised, as well as to reconsider those provisions.
The Guild has already written to the Prime Minister, the speaker of the Lok Sabha, Chairman of the Rajya Sabha, leaders of political parties in both the houses, as well as the Minister of Electronics and Information Technology, highlighting our concerns.
§
DIGIPUB is concerned about the Digital Personal Data Protection Bill, 2023 introduced in the Lok Sabha on August 3, 2023, as its provisions could potentially impinge on citizens’ and journalists’ rights to privacy, information, and freedom of expression. The passing of this Bill in the current form will greatly undermine press freedom, and Digipub echoes the concerns raised by the Editors Guild of India, alongwith highlighting some additional concerns.
Censorship
Clause 12(3) enables a person who consented to share personal data with a news publication/journalist to exercise right to erasure, and have personal information and/or the news article removed even if public interest is greater. More often than not, those who want to be forgotten are the ones who need to be remembered. The Bill needs to ensure that this clause doesn’t become a mechanism for censorship.
Additionally, Clause 37(1)(b) also allows the Union government to censor information without any clearly specified grounds. This gives the government censorship powers beyond the existing provisions under Section 69A of the Information Technology Act, which itself operates without any transparency and public accountability, thereby restricting freedom of expression and is an attack on the freedom of the press. This censorship clause has no place in a Personal Data Protection Bill.
Exemptions for publicly available data
The Bill, via Clause 3(c)(ii) exempts publicly available personal data from its provisions of the bill. This means that artificial intelligence and surveillance/profiling companies can use automated tools to scrape and profile data of every Indian citizen from their social media profiles, as well as from news publications, without their consent. This is particularly worrying when you consider the rapid deployment of CCTVs in the country, along with the increasing sophistication of facial recognition systems.
This exemption not only enables the usage of automated tools to profile citizens, including journalists, it also potentially enables the scraping of content of media publications and reports about individuals, which amounts to a violation of copyright. At the same time, scraping tools are commonly used in Data Journalism, in public interest. Given that we are in an environment of rapid acceleration of AI development, we would urge that any such clauses need careful consideration of their impact on privacy, fair use and copyright.
Surveillance
At a time when there is a compelling need for surveillance reform in India, the Bill can lead to significantly hampering journalistic activities in the country by enabling surveillance of journalists and their sources. At present, surveillance systems like the Centralised Monitoring System enable the Indian government surveillance of phone calls and messages. The Bill allows the government to exempt any “instrumentality of the State” from the ambit of the Bill, as per Clause 17(2)(a), allowing them to share and process personal data without transparency or accountability. Section 17(4) makes exemptions for the Union government and its ‘instrumentalities’ to retain personal data for longer periods of time, even when the individual has withdrawn their consent or demanded to erase their data. Section 36 also empowers the Union government to call for information from any data processing private entity, thereby converting every private company into an instrument of surveillance, thus compromising not just the privacy of journalists and their sources, but the privacy of all citizens of India. This is a violation of safeguards provided to citizens under the Puttaswamy vs Union of India judgment by the Supreme Court of India, and the Bill needs to be amended to include clauses for surveillance reform.
Lack of exemptions for journalists
At times, journalism about individuals is at odds with their need for personal data protection, and information sought to be kept private needs to be made public, in public interest. An earlier version of the Bill drafted by the Justice Srikrishna Committee took this into account while recommending exemptions for journalists, saying that said that journalists would find it very difficult to access information if they had to adhere to the legislation, and that making consent always mandatory for the processing of personal information would mean that information unfavourable to certain individuals “would simply not get published.” The current version of the Bill, however, makes no exceptions for public interest journalism, and as such, opens up media organisations to legal risks when they report on activities of certain individuals. This will hamper journalistic activity and greatly weaken the fourth estate. We urge the government to consider creating exemptions for journalists in public interest.
Impact on right to information
The Right to Information Act has been a critical tool for journalists to hold the government to account in public interest. Clause 44(3) widens the scope of exemptions given to Public Information Officers in the government to reject requests for information, by substituting Clause 8(1)(j) of the Right to Information Act. This provision weakens the RTI Act since it allows Public Information Officers to reject RTI applications if the information pertains to the personal information. We’re already seeing RTI requests from journalists being rejected on frivolous grounds, and being overturned only on appeals. This change will significantly hinder the ability of journalists to seek information of importance to reporting in public interest, and should be deleted from the Bill.
Access to news by children
Children today are digital natives, and their access to information is essentially online. We’re concerned that the requirement of parental consent for access to online news publications, especially for Children from the ages 13 to 17, when they’re beginning to form their world view, will greatly restrict their access to legitimate news sources. Additionally, the requirement preventing Data Fiduciaries from processing the data of children will mean that merely in order to access news, they will have to register/login. The approach towards protection of Children online needs to be reconsidered, in order to not hamper their access to knowledge.
Composition and lack of rulemaking powers of the Data Protection Board
The proposed Data Protection Board of India’s independence is in question, as the Union government holds the power to appoint the Board’s members. The Board can inquire into complaints of breaches and impose huge financial penalties. A parliamentary panel had earlier recommended that a selection committee should nominate the members of an independent Data Protection Authority, which would ensure the body is credible and free from any influence. In addition, in order to safeguard the privacy of individuals, it is important that the Board have the ability to make rules and regulations in response to privacy concerns in an evolving digital domain, and also hold the government to account. A Bill is as effective as its enforcement, and the Personal Data Protection Bill, 2023 will be ineffective in the absence of an empowered Data Protection Authority. The construct, role and powers of the Data Protection Board need to be reconsidered.
DIGIPUB urges the Ministry of Electronics and Information Technology to review the concerns highlighted by us and other organisations and activists, and have a Parliamentary Standing Committee reconsider the Bill and formulate a legislation that does not encroach on peoples’ rights. Furthermore, we request the Parliamentary Standing Committee to take the issues raised by DIGIPUB into account.
Note: DIGIPUB’s statement was added to this article after it was published.