After nearly two years of deliberation, the Narendra Modi government this week made public its version of the Personal Data Protection (PDP) Bill, a piece of legislation that seeks for the first time to regulate on a wide range of issues related to an individual’s privacy. The final version, which will now go to a joint select committee consisting of MPs of both the Rajya Sabha and Lok Sabha, has sparked criticism from legal experts and privacy advocates.
Much of the PDP bill comes from a draft version produced by a government committee that was headed by Justice B.N. Srikrishna, but there have also been changes that have become controversial. In an e-mail interview with The Wire, the retired Supreme Court judge talks of his disappointment in the final version and how it goes against the grain of the ‘right to privacy judgement’.
Edited excerpts follow.
The version of the Bill presented recently in Parliament contains significant changes when compared to the initial draft put out by you last year. The most controversial change is with regard to the exemptions. The Centre has given itself the power to exempt any government agency from these privacy rules under certain circumstances, a move that critics say lays the ground for unaccountable surveillance. Your thoughts?
The committee headed by me had considered this carefully. The ‘right to privacy’ is a fundamental right as now declared by the Supreme Court in the Puttuswamy case. It would therefore be necessary to ensure that there is no abridgement of this fundamental right. We had, therefore, in the draft bill stated that there should be no access to an individual’s data without his consent by the state unless authorised by a parliamentary legislation that would be constitutionally valid. Meaning thereby that such law should comply with the constitutional tests laid down in the said judgement by the Supreme Court.
The bill as laid before Parliament gives virtual carte blanche to the government to exempt any or all of its agencies to access personal and non-personal data of individuals and other entities on the mere declaration that there exist circumstances such national security reasons, criminal investigations etc.
As long as any executive officer authorises such access, there is the danger of sliding into the Orwellian raj with the Big Brother snooping on citizens. That would be a serious abridgement of the fundamental right to privacy guaranteed under Article 21 of the constitution.
By removing the need to make sure exemptions are backed by a law made by Parliament, one that is necessary and proportionate to the interests being achieved, the final bill goes against the principles set forth by the Supreme Court?
Indubitably so, as explained above.
Why is it imperative that we have judicial oversight of government access to personal data?
Checks and balances are a must in a constitutional democracy. No amount of self-certification by the executive is sufficient to prevent abrogation of the rights of the citizens.
As to whether there exist any such extraordinary circumstances warranting the curtailment of any fundamental rights must be examined and approved by an agency independent of the executive and that can only be by judicial oversight.
New clauses in the PDP bill also give the Centre the power to ask for ‘non-personal data’ from technology companies for governance purposes. Many stakeholders have raised concerns, should this also be given more thought?
This also leads to the same result. The government can now legally seek all such non-personal data held by the companies on the vague ground of policy requirements and governance purposes.
Do you believe the bill should have been sent to the standing committee on IT rather than a joint select committee of both houses? Will you depose before the joint committee to offer your advice?
That the Bill needs to be examined by an expert committee set up by Parliament is certain. But whether it should be the Standing or the Joint Select Committee is for Parliament to decide.
What actions do you believe the government should take with regard to the recent WhatsApp-Pegasus snooping revelations? Does the diluting of the PDP bill with regard to government surveillance lay the ground for more such future episodes?
I am not sure how and why the Pegasus breach occurred. If that was because of any action of government, it proves my point.
Yes, the dilution of the PDP Bill leaves it open to misuse and make it a cakewalk for government surveillance and profiling of citizens, both of which are anathema to civilised governance and constitutional democracy.