Work in Progress

India’s data protection Bill has implications for citizens, companies and the government. But many questions need answers before it can near implementation

GOUTAM DAS

Depending on who you speak to, the Personal Data Protection Bill, 2019, draws out extreme responses. Justice B.N. Srikrishna, a former judge of the Supreme Court of India, dubbed the latest version of the Bill, cleared by the Cabinet, “dangerous” and one that could turn the country into an “Orwellian state”. In the Bill, the central government gets powers to access personal data in the interest of integrity, sovereignty, security, and public order among others.

At the other end is Omkar Rai, Director General of Software Technology Parks of India (STPI). He tweeted: “The clearance of #PDPB by the Union Cabinet is a historic step towards striking a balance between the sprinting digital revolution and exigency of personal #dataprotection while strengthening India’s position on citizens’ #datasecurity”.

There are many stakeholders in data protection – citizens, who are the data providers to private and public companies as well as the government; data processors, or organisations that use the data for business or other purposes; and the government, which is interested in law enforcement and possibly a bargaining chip in dealing with large multinationals, particularly the social media companies who are difficult to tame.

The legislation, therefore, is complicated, and evolving. The Bill has now been referred to a Joint Committee of the Houses (JPC), which could recommend tweaks, and more clarity. The Bill’s principles, however, wouldn’t change.

Indians didn’t care much about data privacy – it has largely been a Western construct. This is now changing. Data localisation is a reality both multinationals and Indian companies have to brace for even though what data needs to be processed and stored in India can be fine-tuned. The government and the private sector, particularly businessto-consumer companies, have to start investing in people, processes and technology that protect privacy and monitor compliance while identifying defaulters. Compliance has a cost. Storage and processing, setting up processes, capacity building needs money and time but also opens up business opportunity.

The Bill, in short, has good parts, some red flags, and a promise that it could generate business and jobs. Overall, this is also a notice, to get ready.

The Good

Member of Parliament Rajeev Chandrasekhar, a techie and a tech investor in his previous avatars, knows the importance and the far reaching implications technology policies can have. “In telecom, we had legislations and policies that were only pro-business. It had no protection or rights for consumers,” he says. Users suffered for two decades because of poor quality of service and call drops. The Personal Data Protection Bill, he holds, must therefore work for every stakeholder. “Since the Supreme Court has already ruled that privacy is a fundamental right, consumers are coming into this conversation with that right. They would like a legislation that respects privacy and gives the reasonable restrictions the government wants.” Chandrasekhar is part of the JPC that will hold consultations with every stakeholder over the next three-four months.