New Delhi: A group of lawyers and privacy policy analysts on Friday (June 8) put out a draft model law on privacy and data protection, in what appears to be a community-led attempt at hastening and informing legislative process.
Called the ‘Save our Privacy’ campaign, the broader initiative behind the draft law describes itself as a “community and public interest project” that is spearheaded by the Internet Freedom Foundation (IFF), a non-profit organisation aimed at protecting digital rights.
Over the last eight years, India has seen multiple aborted attempts at enacting data protection and privacy legislation. In the last year, momentum has gathered in the form of the Justice Srikrishna Committee on data protection, which will soon present a draft bill to the ministry of electronics and information technology.
The IFF’s intervention, at this point, is important for two reasons.
Firstly, as lawyers associated with the campaign note, it strives to look at issues relating to privacy and user rights in a more holistic manner in comparison to the Srikrishna Committee, whose mandate is limited to data protection.
As The Wire has documented and analysed, the panel of experts and their white paper have done an inadequate job in a number of areas, in particular on the nature of government-controlled mass surveillance and how a user-centric data protection framework would tackle this problem.
The draft model bill released on Friday, which the campaign calls the ‘Indian Privacy Code, 2018’, adheres to seven core principles which were “built off rigour, debate and the best global practices adapted to India”. The bill, as it stands today, envisages a penalty provisions of up to Rs 1 crore and a prison sentence of three years for people who “collect, receive, process or hold personal data” in contravention of the provisions of the proposed law. The punishment goes up to Rs 10 crore and five years in prison for ‘sensitive data’.
Secondly, the campaign and the draft bill also comes at the end of a crucial ten months.
While mostly viewed as a positive development, the Srikrishna Committee, since its inception in August 2017, has also sparked a certain amount of wariness and uneasiness amongst civil society.
For instance, two months after the data protection panel was constituted, a group of 22 legal academics and activists shot off an open letter that criticised its composition and choice of experts. The letter in particular expressed concern over what it saw as “inadequate representation” within the committee with regard to civil society stakeholders and truly independent privacy experts.
“A committee created to look at a fundamental issue which will impact this country needs to be balanced and cannot be biased towards one position, particularly when there might be conflicts of interests…” the letter noted. As The Wire noted at the time, with the exception of Justice Srikrishna and one other member, the rest of the individuals on the committee are either part of the government or part of organisations that have worked closely with government on other issues.
Attempts to have Justice Srikrishna co-opt an independent expert or member from civil society – which were made after this letter was sent – and bring them onto the panel have been gently rebuffed.
Since then, concerns have also been expressed over the sheer length of the white paper, the nature of the feedback process and the decision to hold public consultation meetings before an official draft bill had put in the public domain.
What has added to civil society worries is the existence of a draft data protection bill prepared by the ministry of electronics and information technology. According to an RTI reply, this draft bill has been circulated to members of the Srikrishna Committee but has not been made public. It is unclear whether the data protection panel has taken the views of ministry’s bill on board.
The ‘Save our Privacy’ campaign, of course, does not directly address the concerns laid out above but does make note of the concerns expressed over the Srikrishna Committee’s composition and transparency and emphasises that it was “necessary to support a civil society project to build awareness on privacy and data protection in India”.
Over the next few months, the campaign invites endorsements and comments on the draft model bill that it has put out. It hopes that by doing this, it will “facilitate greater public and expert participation”.
As for the Srikrishna Committee, latest reports indicate that it should be out shortly, although there is no official deadline for the submission of its draft law to the IT ministry.