Justice Srikrishna Committee’s draft of Personal Data Protection Bill 2018 is introducing a new right – the right to be forgotten, to remove, very old, irrelevant and unnecessary information links from social media networks. This concept is prevalent in the EU and France, though it was not preferred in the US over the more valuable press freedom.
Mario Costeja Gonzalez wanted Google and a newspaper La Vanguardia, to remove a 1998 news item about him selling a property to pay off debts. An EU court in 2009 upheld his right not to be reminded of that unpleasant part of his life. A US court, however, did not agree with William James Sidis, a former child prodigy who did not want The New Yorker to publish about his past. There is a social value in publishing facts.
In India, after a person got a certificate of marriage with a woman’s name who never married him, her father’s plea to annul that marriage certificate was accepted by the Karnataka high court. A rape victim has a right that her past be forgotten. At the same time, a criminal cannot claim that he has the right to insist that his conviction should not be referred to by the media, the Gujarat high court has said.
According to Srikrishna Committee’s Bill, an adjudicating officer – who is not a judge but a bureaucrat – will be the one to decide. According to section 27 of the Bill, a data principal (for instance, a former minister convicted earlier) has a right to prevent data processor or data fiduciary (could be a TV, web portal or newspaper) from using such data (or information) that has served its purpose for which it was made (he suffered prison term) or which is no longer necessary, or for which consent given earlier has been withdrawn, or if it is contrary to any law.
Section 27(2) states that the adjudicating officer can decide on the question of disclosure when he thinks that such disclosure will override the freedom of speech and the right to information of a citizen. In determining this, the adjudicating officer has to consider five factors listed in sub-section (3).
They are: (a) the sensitivity of the personal data; (b) the scale of disclosure and the degree of accessibility sought to be restricted or prevented; (c) the role of the data principal in public life; (d) the relevance of the personal data to the public and (e) the nature of the disclosure and of the activities of the data fiduciary, particularly whether the data fiduciary systematically facilitates access to personal data and whether the activities would be significantly impeded if disclosures of the relevant nature were to be restricted or prevented.
Aggrieved by the order of the adjudicating officer, one can file for review. In case the adjudicating officer reaffirms the decision, an appeal can be filed with the appellate tribunal. This is fine as far as data protection is concerned. However, when the data principal is a public servant (for example a former minister), and the data fiduciary is a newspaper or a web journal, the freedom to criticise public personalities for their public policies based on their past statements and activities will be in jeopardy, and a journalist has to wait for the decision of the adjudicating officer to get permission for writing about it. A citizen seeking access to such information will be confused about whether to approach the Central Information Commission or the Data Protection Authority (DPA). Adjudicating officers are subordinate to members of the DPA.
Exceptions to data protection rights and the right to be forgotten in the Bill might spell danger to press freedom. Chapter VI of the Bill on the rights of data principal, including the right to be forgotten, is exempted if the purpose of data processing is in the interest of the security of state. However, the Bill states, the parliament should pass a law explaining procedures to determine the interests and to create another authority to decide the disclosure. These rights will not apply to the processing of data in the interests of prevention, detection, investigation and prosecution of any offence or any other contravention of law. For that also, the parliament has to make a law to consider and achieve such interests. Srikrishna Committee did not suggest any draft for these two additional legislations contemplated under sections 42 and 43. Even for this, section 4 (right to privacy needs to be respected) and section 31 (fair and reasonable processing duties) will apply.
‘Journalistic purpose’ exemption
An exemption “for journalistic purpose” is provided in section 47 saying that where the processing of personal data is necessary for or relevant to a journalistic purpose, the provisions of Chapters II to VIII of the Act shall not apply, except SS 4 and 31. Section 27(2) disappoints. It says that section 27(1) will apply only where journalist demonstrates that the processing is in compliance with any code of ethics issued by: (a) the Press Council of India, or (b) any media self-regulatory organisation. This means a journalist has to prove that privacy was taken care of and all the safeguards prescribed were complied with. A journalistic publication will thus be dependent upon the opinion of a dealing clerk or an adjudicating officer. These are additional prepublication restrictions on citizen and media which were never contemplated by the constitution and rejected by the judiciary.
The penalty provisions are severe and costly. Section 74 gives the power to impose a penalty to the adjudicating officer after an inquiry, besides facilitating compensation (Section 75). Failure to adhere to security standards (Section 31) might lead to a penalty of up to Rs 5 crore (Section 69). A penalty of up to Rs 1 crore can be imposed where any person fails to comply with any provision of this Act, for which no separate penalty has been provided in the Act (Section 73). This can easily be used against journalists.
Is this constitutional? Article 19(2) of the constitution did not provide “privacy” as a ground for imposing restrictions. This Bill fails on constitutional verification by the judiciary, unless “privacy” is added in Article 19(2) by a major amendment to the constitution. The Data Protection Bill is going to be a serious threat to press freedom and RTI.
This article originally appeared in the Indian Express and is being republished with the author’s permission.
M. Sridhar Acharyulu is the central information commissioner.