FINANCE Jul 28, 2014
The privacy of India’s citizens is under threat, thanks to a weak state. By weak state one means the absence of a strong basis in law for most of the acts allegedly carried out on behalf of the state. A strong state is one where every action of the state or its representatives is grounded in law, which itself is intended to protect the citizens from arbitrary official action.
India is a weak state as it enables powerful people manning various state or private institutions to use gaps in the law to impose mindless new costs and regulations on citizens without commensurate benefits.
Thanks to the absence of a law on privacy, and weak implementation of whatever law that exists, the Indian citizen has now been left vulnerable to fraud, blackmail and other forms of harassment by state or non-state actors. And no one can actually help you if you are a victim of one.
Consider the amount of data now being collected from private citizens either without the authority of law, or by agencies that supposedly act within the law, but which cannot mandate protection of your information or data.
The Unique Identification Authority of India collected biometric and other data from over 600 million Indian residents without any law mandating the safekeeping of your private data. Now that the Modi government has made peace with UIDAI’s Aadhaar and plans to use it for its own schemes, one wonders how it can do so without legislating a law to protect this data from misuse. When private parties collect my biometric data, what is the guarantee this won’t remain in private hands, and lend itself for misuse?
Every bank, every mutual fund and every financial institution with whom citizens have dealings demands a lot of financial and other details from citizens: father’s name, mother’s name, mother’s maiden name, date of birth, account details, annual income. Today’s Mint newspaper (dated 28 July) discusses how mutual funds are seeking details of income and from 1 August you cannot buy a mutual fund without giving these details in a second form.
As of now, you can still fib about your income, but what if tomorrow they demand salary slips and more details? All this is possible because market regulator Sebi is expected to play a policing role on behalf of the taxman. Mutual funds are supposed to report suspicious transactions to the Financial Intelligence Unit – which means spying on you by demanding income statements.
What if this information, now lying unprotected with mutual funds, lands up with the local gangster who can now kidnap kids and demand ransom, secure in the knowledge of how much he can demand from whom?
Even mobile companies now demand bank statements as address proof. So copies of your bank statements showing incomes and salary inflows are now with mobile and phone companies. The data itself is collected by direct selling agents or staff who keep moving in and out of companies for marginal increases in pay. Who will protect our financial data given to mobile phone companies? What if the info leaks? Who is accountable?
Of course, we are not only talking about data demanded officially, but also private players. From Google to Flipkart to every transaction site, a lot of your personal data is now with private agencies who now know all your financial details, the passwords you tend to use, the things you are interested in, etc. If this data leaks out or is misused, every transaction of yours can be compromised.
The sheer amount of personal information – especially financial information – collected by all kinds of unaccountable agencies and private parties is now so staggering that no citizen can feel safe about sharing information that is demanded almost at every street corner. Even shops and cable operators now demand to know you PAN number – the former if your purchases exceed a certain level, the latter routinely.
The problem with India’s state agencies and regulators is that they collect loads of data without knowing what they will use it for, and how it will be protected.
The Radia tapes affair showed how even information legitimately collected can leak into the public domain and make waves. This clearly shows that before we impose any more rules on the kind of data we need to collect (for tax purposes, KYC, payment of subsidies, etc) we must legislate a powerful privacy protection law.
The law must cover the following aspects.
One, it must clearly emphasise that the data given under any law or rule is the property of the private citizen and it can be used only for the specified purpose by the agency collecting it. If a bank statement is given to a mobile company, the info is only for the purpose of ascertaining the address, and not for anything else. If a mutual fund collects income statements, it is only meant for checking for any inconsistency in investments and income show. The data again cannot be shared with any outside party.
Two, breaches of privacy must carry heavy penalties. Leaks of any data should not only incur fines, but for more serious breaches, it must lead to prosecution and jailing of the officials concerned.
Three, all agencies – public or private – collecting data from the public must be forced to follow internal processes that specifically protect the data. Just as government departments have information officers to give out information sought through RTIs, there must be designated privacy protection officers who will be accountable for data leaks.
Four, institutions using private parties and direct selling agents (DSAs) to collect data will be liable for any lapses on the parts of their agents. Use of private agents cannot absolve the principal of liability if things go wrong. In the case of the UIDAI, all biometric and other data already collected must be fully protected. This means UIDAI must go back to their data collecting agencies and ensure that any data still left in private hands is either destroyed, or accounted for with full past and future liability.
The point of all this is simple: in these days of phishing and other kinds of internet frauds, the availability of so much unprotected data offers crooks and scamsters lots of options to hack into citizens’ accounts and make a killing. Moreover, financial data in the wrong hands can lead to blackmail, extortion and other forms of demands.
Just consider: when everything from date of birth to mother’s maiden names to salary info is available easily, wouldn’t hacking of accounts become easy with minor efforts?
Also, if all future payments under NREGA, etc, are made through payment banks or other mass disbursal agencies, would it be very difficult to skim 99 paise from every account without the poor account-holder guessing what is happening to her in village Rampur? A million accounts skimmed and shown as miscellaneous bank charges is unlikely to be questioned by any party – and that is a million bucks to somebody on the basis of skimming just under Re 1 from millions of account.
The government has to start taking the privacy issue seriously. The UPA never did. Will Modi’s government be different?
