Data Privacy Defanged

The Srikrishna Committee report has too many loose strings that need to be fixed before it becomes law.

- Rajeev Dubey

YOU DON’T own your data, your data can reside in a foreign land – and, you could be liable for withdrawing consent. Those are just some of the shocking clauses in the much delayed “The Personal Data Protection Bill 2018” architected by the Justice Srikrishna Committee. Despite submitting a draft report way back in November 2017, this is far from a complete Bill. “The Bill could have been prescriptive. But it’s still very open-ended,” says Vidur Gupta, Partner, Cyber Security, Government, Ernst & Young India.

In fact, a few from the 10-member panel say the committee did not even consider the Telecom Regulatory Authority of India (Trai) recommendation that ownership rests with the individual (data principal in this Bill), everybody else is a mere custodian. Instead, who owns the data of individuals is a question not even answered by the Srikrishna Committee. “It’s better to separate it from ownership and look at rights,” says Rahul Matthan, Partner, Trilegl. That’s at the core of the glaring shortcomings in the Bill. Here are a few more.