India's Data Law: A privacy promise or surveillance tool?

In an era where data is fast becoming the new oil, the underlying tension between state surveillance and individual privacy is getting increasingly complicated.

- RITIKA GOSWAMI

With the introduction of the Digital Personal Data Protection Act, 2023 (DPDPA), India took a huge leap towards codifying a legal framework to govern data processing and safeguard the digital rights of Indian citizens.

Yet, numerous legal experts, privacy rights defenders, and human rights organizations have posed an uncomfortable but necessary question—does this law go far enough in safeguarding citizens from the surveillance powers of the State?

THE PROMISE OF THE DPDPA

The Digital Personal Data Protection Act, 2023 was conceived of as the end of a very long road that started in earnest after the Supreme Court's historic judgment in Justice K.S. Puttaswamy v. Union of India (2017), which recognized privacy as a fundamental right under Article 21 of the Constitution.

In that ruling, the Court not only recognized the requirement for data protection law but also emphasized the fact that any interference with privacy must satisfy the tests of legality, necessity, and proportionality.

The DPDPA brings in key concepts of Data Fiduciaries, Data Principals, Consent Managers, and enacts obligations for legal data processing.

It provides certain rights to the individual—such as the right of access to information, correction, and erasure of personal data—and assures penalties for breaches.

A Data Protection Board is instituted to ensure compliance and impose duties.

On the face of it, these provisions look progressive and in line with international data protection standards.

The actual problem lies in what the law decides to exclude, particularly the surveillance by the government.

GOVERNMENT EXEMPTIONS: THE ELEPHANT IN THE ROOM