14242 - Government's approach to data is dangerous, says Justice Srikrishna -

Home » Justice Srikrishna, Personal Data Protection Bill, privacy

 

Government's approach to data is dangerous, says Justice Srikrishna

• Aditi Agrawal

By  Aditi Agrawal ( @aditi_muses aditi@medianama.com )     August 27, 2019   
Share This:            Share via Email   

Justice B.N. Srikrishna believes that the government’s approach to data as an asset is dangerous. He wants the public and civil society to put pressure on the government to pass a data protection law, believes that MeitY can now easily reveal details of public consultation on the Draft Personal Data Protection (PDP) Bill, and thinks linking Aadhaar to electoral rolls is a bad idea. Justice Srikrishna had headed the committee that had drafted the Personal Data Protection Bill 2018.

Speaking at Privacy Supreme, an event organised by the Mozilla Foundation and Internet Freedom Foundation (IFF) to mark the second anniversary of the Puttuswamy judgement that upheld the right to privacy as a fundamental right on August 24, Justice Srikrishna gave his opinion on a variety of topics

On how data collation enables profiling: “The difficulty is not collection of data, particularly in regard to Aadhaar; the difficulty is that if you can collate the data, you can profile human beings. For example, it was being argued, and rightly so, that DNA, fingerprints are collected from all the people who have to be in the police station. Now, anytime a fingerprint is lifted from a crime scene, that is tied to this larger database. Now, this is one way of doing it. If the fingerprints of all the citizens are there, then it is easy to figure out who has committed the crime. Now similarly, if the DNA evidence is there, it’s easy to figure it out. Now look at the flip side of that, if my fingerprint is there, and if somebody does some goof-up, if somebody deliberately does a mismatch, I am the one who is going to be thrown in jail.”

On whether electoral rolls should be linked to Aadhaar: “You had a Cambridge Analytica, you will get a Delhi Analytica, a Mumbai Analytica, a Calcutta Analytica. That is the danger. Are we happy with what Cambridge Analytica did? We made so much noise about it. We called them all kinds of bad names. Now you’ll have that here, in your country, in your backyard. I don’t think that’s a good idea. And I don’t trust the Election Commission with its mutton-headed ways.”

On the government’s motives with data, as outlined in Chapter 4 of the Economic Survey, “Data of the people, by the people, for the people”: “That chapter on data privacy … should be [called] ‘Data of the people, by the people, for the government’. … [Nowhere] they have said that data is being collected today as well. Now, data are being collected by different agencies of the government and they are in silos. … Thus, the same data will be collected by the education department, the agriculture department, the traffic department. Now, isn’t it better if they had it all together so that ‘we can give you the benefit of our wisdom’? Now, that’s a very nice way of putting it, very attractive, very seductive way of putting it. But look at it from the point of view of the citizens — it’s bad enough that I have to give you this data, give it in quadruplicate when it is not necessary … Now all of you are going to put it in that data, so what remains of me? Nothing remains with me, so all my data is in your pocket. It is a dangerous situation.”

If community data should be a part of the Personal Data Protection Bill as the MeitY is already considering: “We had recommended that community data should be available to every one of the citizens. Now, for example, community data means what? The data that is put into the net by individuals. For example, take your Google Maps, that’s community data. So it should be available to everyone, and everyone should have a right to access it. Not the government, we have not said that the government has a monopoly on that. Every citizen says what is happening today is this. Now whether I have a barbershop here or not comes up on Google Maps because I put it there, or somebody else put it there. It should be permitted.”

On MeitY denying access to minutes of the meeting and to the submissions made to the PDP Draft Bill: “Government takes a long time to get over its inertia. I suppose an RTI application was made, but it was rejected. One thing is there, with regard to a work in progress, it is unfair to ask every time that what is happening. But once it is over, it should be available. Now it should be available, there is no any difficulty.”

On data localization and the way the government is handling it: “I am not happy with it, with the way the government is handling a number of things.”

On politicians using CCTV surveillance as a political tool in the absence of a data protection law: “You know, I am scared about it because [people] are arguing that marital rapes should be stopped, so far that purpose, how do you stop? Put a CCTV in my bedroom? Yes, it should be stopped, but by a method that does not impinge upon my privacy.”

On operationalising consent in the Indian context: “Consent can be operationalised by telling the person that I need informed consent, [that is by telling him/her] for what purpose, how am I going to use it, how long for. … But in a country like ours, where we have … 20-30 official languages, and each language is radically different from the other and the person who speaks each language, refuses to recognise another language, what are we going to do? Take consent in each language? This is a big problem. We understand that there can be some kind of a universal language in which we can ask for consent. There is a person who don’t even know what to do except leave their thumb impression on a piece of paper. They are not able to understand. How do you teach them to give informed consent? Therefore, the report talked of visual symbols. How do you do visual symbols? You see this on signals and crossings. You communicate to them that [s/]he is entitled to give me consent, [s/]he is entitled to refuse consent. It is about making the person understand what is consent, and what isn’t. That is going to be a very major challenge in this country. And as far as people who are educated are concerned, people who are capable of understanding the implications are concerned, we had recommended something like consent dashboards. And for children, up to a particular age, parental consent was to be taken, because law doesn’t permit any kind of contract with a minor to be valid. Children otherwise will be deprived of access to internet.”

On why the committee report was titled “A Free and Fair Digital Economy” instead of singularly focussing on the right to privacy: “The focus is on digital economy because thanks to the focus on digitisation in every field, economy is going to be impacted by digitalisation, whether it is this department, or that department, including the law and judiciary, even the courts are going to be digitalised, one way or another. Therefore, the emphasis was on that and rightly so. But the question is that digitisation and right to privacy are seen as antithetical concepts, so even assuming that they are antithetical, where is the line to be drawn and how far should the line go? Should it go nearer to digitisation, or nearer to right to privacy? That was the issue to be considered, and that is what the bill has tried to work on.”

On the government acting on individuals’ data in the absence of a PDP law (with reference to NCRB’s Automatic Facial Recognition System and the sale of vehicular data to private companies): “In the absence of the law, … what happened was that data privacy came from Puttuswamy. Before that nobody debated it. There were just vague references in the Supreme Court. This was happening regularly. Data was being collected by the government regularly. So how did you oppose it at that time? Therefore, build up pressure to say [to the government] that you pass the law, with your overwhelming majority which is just like an ATM machine where a bill goes in and comes out as law. Such a complex subject, my hope is that one day it will pass. My only question is about the form in which it will be passed. There’s a very famous Sanskrit saying [about] how a person started to make a Ganesh, but created a monkey instead. Let’s hope that we’re not made monkeys ultimately.”

On whether he is confident about the PDP Bill in its current form: “I am not very confident. In fact, I was [discussing] with a few judges that there should be a pre-judicial determination, but then the answer given to me was that if the secretary of financial matters can’t handle it, the judges will never be able to handle it. So I stepped back and said, just make sure that you don’t have access unless there is a parliamentary act which permits you to [so] in which the case the parliamentary act will have to say who can do it, for what purposes, under what circumstances, and what is the method of doing it. Just take for example, you are infringing the personal right of a human being under Article 21 by preventive detention. See how preventive detention has been put into straitjacket. I was hoping that something like that would come. Then the other alternative was something like the FOIA [Freedom of Information Act] in the United States, but when I studied it, I said that it didn’t make much sense because it is a very secret thing, RTI people have more access to that record.”

On the rise of surveillance and fall of RTI: “The only exception under RTI Act is under Section 8(1)(j) which is that personal data ought not to be accessed unless there is another exception to the exception, that is, if the officer comes to the conclusion that it is overwhelmingly necessary in the public interest to do so, or that this information is already available in the public domain. This is precisely what the drafted bill also said. Now, to turn this into a situation of RTI versus the right to privacy, is an absurd one. And I don’t think that’s the correct way of going about it. And I am not sure. Today, I don’t know what the government’s stand is … I don’t know what the government’s version is.”

On whether the government’s draft bill is following the parameters for data security his report laid out: “When you talk of security, two aspects are there. One is how technically sound the security is. Now that’s a question that technical people will be able to answer. And the other question is, even if it is technically secure, does the government treat it as a tool for playing the Big Brother breathing down your neck all the time. Now that’s possible. … You want it [the data], but then there should be [something] to ensure that you can’t use it for the opposite reason. This is one danger that I envisage. … When I had a discussion in the committee, I was told that somebody at the level of department secretary would take care of this. I asked the secretary of the department. In this wire-tapping business, he said that in a day, ‘500-600 matters come to me’. I said, ‘Do you really have the time, patience or the ability to run through [all of them]?’ Otherwise, what happens in a criminal procedure court, the court requests a judicial application of mind. … [And the judge determines if s/]he is a criminal and therefore I allow the warrant by which he can be put under surveillance, or by which his residence can be raided. That’s the prism I am looking through. Now, reverse it. If it’s in the hand of an executive, which executive in this country at whatever his[/her] level, whether [s/]he is the cabinet secretary or a desk officer, will go against the government wanting to do it? … But let me tell you, do you think that data is not being collected today? Forget the data privacy bill. When you phone somebody, data is just taken away. Therefore, it is necessary to have a barrier. This is an act that empowers the citizens, not because you get benefits under something or the other, make sure that your privacy remains with you.”

On the process through which his committee put out the draft PDP Bill and his expectations from the process: “When I started this, I kept saying from Day 1, till Day X, when I finished it, that here, look, are we now creating something that is going to gobble up the person for whose benefit we are making it? What should be done in order to ensure that this does not turn out to be a Frankenstein ultimately. I was able to persuade the committee to put whatever we were thinking before the public. Therefore, first … we had the white paper [where] we looked at all that was happening in different jurisdictions. … We looked at England, GDPR, South Africa, Singapore, Australia and all that. This was exactly the exercise that was carried out when the Constitution of India was drafted. …  Let the public understand what your tentative thought process is, and let them react to it. And therefore, the committee went and had interactions with the public in 5 or 6 metropolises. And, everybody was invited — right from academicians to technicians to law students to economics graduates and everyone like that. And after taking inputs from them, we churned over the inputs. … And then we produced a report. And then I said, let’s tell the public at large what’s the tentative nature of the bill that should be there. … Let there be a draft bill. The intention was that the draft bill would also be in public domain and there will be a debate on that, there will be inputs on that, and of course, there will be a debate in the parliament. And I expect that on a complex subject like this, there should be a reference to a select committee, evidence taken before the select committee and things like that.”       

On whether internet should be declared a public utility, and governed/regulated as one: “You’ll have a regulator sitting on your head all the time. … Are you happy with how [existing regulators] are functioning? Actually, there is going to be a regulator in this field also. Data Protection Authority is a regulator. I think it would be a wrong idea to declare it as a public utility because then you’ll have unnecessary problems. … If it becomes a part of public utility, you have had it. It will lead to greater surveillance; you’ll have greater restraint on your freedom.”

On Google and Facebook’s global dominance over internet: “Competition law should be applied to them. Competition is not always in terms of money only, it is also in terms of how the market is being used, how your dominance in the market is going to make difficulties for the consumer.”

On future-proofing with respect to location data and IoT data, which Reliance had saidwould be a ₹20,000 crore market: “The point is this: is the data mine? Do I have control over the data? Then I don’t care if you have a 2 billion operator, or a 200 billion operator. You shall not do anything to my data without taking my permission. That is the bottom line. Now on that bottom line, what kind of superstructure you want to build, is again up to the manner in which the parliament debates it.”

13714 - Privacy law: Framework of Aadhaar divides Justice Srikrishna committee - Business Standard

Privacy law: Framework of Aadhaar divides Justice Srikrishna committee

A majority of the members are said to be backing the position that the law should not apply retrospectively

Mayank Jain  |  New Delhi 

Last Updated at June 19, 2018 06:46 IST

• ALSO READ
  Securing Aadhaar: Letter to BS on UIDAI introduces 16-digit 'Virtual ID'
  Fudging Aadhaar
  Aadhaar, banking data leaked? UIDAI trashes reports: Top 10 developments
  EPFO temporarily shuts Aadhaar seeding portal after reports of data theft
  Improved privacy

The B N Srikrishna committee, asked to examine issues on data protection and to draft a privacy law, is in the final stages of producing a report.

Before it finalises this, it has to address a couple of issues which have divided the members, say sources.

The committee, constituted in July 2017, met on Monday. An official with knowledge of the matter says the panel has been witnessing heated debate around the inclusion in the proposed privacy framework of Aadhaar, the citizen identity number based on personal detail.

If the suggested code is made applicable with retrospective effect, as some want, the unique identity project will be affected. For, the data collected under Aadhaar will come under the purview of the privacy law. A majority of the members are said to be backing the position that the law should not apply retrospectively. That apart, it is still being discussed as to how the law will function with regard to Aadhaar.

“The committee is trying to give final touches to the report, making sure every member is on board with the recommendations, a difficult task,” said an informed source.

ALSO READ: 1.21 bn Aadhaar generated till June 16, UMANG sees 6 mn downloads: Prasad

The retrospective clause is important because Aadhaar is continuously collecting data of new citizens being enrolled in the system, as well as data of authentication made by existing Aadhaar holders. The committee is trying to suggest a framework by which Aadhaar data could be governed.

Another issue being debated by the members is on data localisation (storage within the country), where there is again a divide. The reluctance of entities in the relevant sector has been noted, subsequent to the Reserve Bank rule that storing of all financial data pertaining to Indians must be in this country only.

Sources indicate the members are broadly in favour of data localisation. What is unclear is if the final report will recommend hard or soft localisation.

“A hard data localisation policy says you can only store data in India — all financial, personal, Aadhaar, biometric and health data cannot go out of the country for even an on-the-spot transaction,” said a person associated with the stakeholder meetings. “The committee has seen industry demands where they broadly agree to storing a copy of the data in India — this still allows global platforms to be used for processing. There’s no final view on this yet.”

Apart from this, the committee is expected to recommend the formation of a data and privacy regulator. This authority will have powers to regulate data collecting entities through monitoring, controls, issuing suspension notices and penalising for breach of the privacy norms.

The committee was expected to give its report two weeks ago but these points of difference delayed it. “They are not running against the timeline of a specific date of submission but, by the looks of it, if there are more meetings beyond Monday, this week will go in finalising the report. So, the submission can get delayed to early next month but that’s the extreme case,” according to a source.

Read our full coverage on aadhaar card

First Published: Tue, June 19 2018. 06:46 IST

13706 - India’s landmark data privacy law won’t apply to the very cause behind its existence— Aadhaar - The Print

India’s landmark data privacy law won’t apply to the very cause behind its existence— Aadhaar

MANEESH CHHIBBER 18 June, 2018

The draft report says the legislation will ‘not apply to any processing activity that has been completed prior to this law coming into effect’.

New Delhi: The Justice B.N. Srikrishna Committee, constituted in the wake of the Supreme Court’s landmark ‘Right to Privacy’ judgment to come up with a data protection framework, is all set to recommend that the proposed law should not be enforced retrospectively.

Simply put, this means the data collected under Aadhaar would be out of the scope and purview of the proposed law. This recommendation may not find favour with those who have opposed the unique identification system on the ground that the collection and dissemination of Aadhaar data leaves citizens vulnerable.

In its draft report, accessed exclusively by ThePrint, the committee headed by the former Supreme Court judge has concluded that, in the interest of “effective enforcement and fairness to data fiduciaries”, the first-of-its-kind data protection law will “not apply to any processing activity that has been completed prior to this law coming into effect”.

Not only this, the draft report also talks of giving adequate time to data fiduciaries (to whom data is entrusted) to ensure seamless implementation of the new law. This, it says, is needed since the data protection law would be a new legislation and require the creation of a new regulatory framework.

Sources told ThePrint that the committee was scheduled to meet later in the day Monday, where a decision will be taken on whether this report is final or requires further deliberation.

Some acts that the panel wants listed as crimes include obtaining, transfer, disclosure and sale of personal and sensitive data if it causes harm to the person whose data it is (data principal), and re-identification and processing of previously de-identified personal data.

The draft report recommends punishment for “intentional or reckless behaviour” that leads to the crimes, which it wants to be made cognisable and non-bailable. In case the crime has been committed by a company or body corporate, including government departments, the responsibility would lie with the person in charge of conducting the company’s business or the head of a government department.

It wants compensation to be paid to data principals in case any harm is caused to them for infringement.

But, in a move that is certain to rile activists working for stringent privacy and data protection laws, the committee’s draft report absolves the in-charge of all responsibility if he or she shows that the crime was committed without his/her knowledge or that all reasonable efforts had been taken to prevent the crime from being committed.

Other significant recommendations include:

• All cross-border transfer of personal data to be done only through proper contracts, with the sender being liable for any leak or harm caused to such data.
• Personal data deemed ‘critical’ can’t be taken outside India. Critical personal data will include all data necessary for the smooth functioning of the economy and the nation-state.
• The report makes it clear that this data would include Aadhaar number, genetic data, biometric data and health data.
• The differentiation between critical and non-critical personal data, the draft report says, will lead to effective law enforcement, curb foreign surveillance, avert vulnerabilities to the optic cable network, and help in building a robust artificial intelligence ecosystem.
• There will be an independent regulatory body called the data protection authority (DPA), whose functions will include monitoring and enforcement of the proposed law as well as investigation and grievance-handling.
• All data collectors would have to get registered with the DPA.
• The DPA’s powers would include issuing warnings and reprimands, and ordering data fiduciaries to suspend work or collection of data, if found violating the law.
• There will be a ‘data ombudsman’ to adjudicate complaints between data principals and data fiduciaries. Appeals against orders of the data ombudsman will be made to an appellate tribunal. The Supreme Court will hear appeals against orders of this appellate tribunal.
• Consent will be required to collect any kind of personal data. Such consent will be invalid if not based on informed choice that is specific, clear and capable of being withdrawn.
• For sensitive personal data, the consent will also have to be explicit.
• There will be a fiduciary relationship between the “data subject” and “data controller”.

Right to be forgotten:

The draft report allows data principals to approach the data ombudsman with requests for the right to be forgotten, which will be granted on the basis of criteria laid out in the draft law.

However, the right to be forgotten will not be available if data ombudsman feels such a request interferes with the constitutional right to freedom of speech and expression, and/or right to information of any other citizen.

 What is Justice Srikrishna committee?

The Committee of Experts on a Data Protection Framework for India was set up on 31 July 2017 to examine issues related to data protection, recommend methods to address them, and draft a data protection law.

It released a white paper on 27 November 2017.

Thereafter, it held several rounds of meetings with stakeholders, as well as four regional conferences.

However, the white paper itself came under attack from several quarters, with former Supreme Court judge M. Jagannadha Rao writing to the panel that the document referred to collection of data but “not to the boundaries of the right to collection of data which is the essence of the SC judgment”.

Earlier this month, some lawyers and privacy rights activists made public a draft model law on privacy and data protection.

13681 - Why a 77-year old ex-judge has Facebook, Google, Amazon nervous in India - Bloomberg

Why a 77-year old ex-judge has Facebook, Google, Amazon nervous in India

Bloomberg | Jun 11, 2018, 13:25 IST

HIGHLIGHTS

• Retired SC judge B N Srikrishna is leading the effort to draft new data-privacy laws for India that will regulate how tech giants from the US and elsewhere operate in the country
• Srikrishna plans to navigate a “middle path” between the laissez-faire US approach and the stringent GDPR just imposed in Europe

NEW DELHI: B N Srikrishna is a genial, 77-year-old former Supreme Court judge who recites Shakespeare and Sanskrit scriptures with equal facility. But he’s making the likes of Google, Amazon and Facebook more than a little nervous. 

Srikrishna is leading the effort to draft new data-privacy laws for India that will regulate how tech giants from the US and elsewhere operate in the nation of 130 crore. His recommendations carry particular weight because India is already the biggest market for companies like Facebook Inc. + and offers enormous potential for dozens more. The committee Srikrishna helms will send its bill to the government this week. 

They’re going well beyond the hands-off American approach that preceded fiascoes like the Facebook breach, which facilitated Russian meddling in the 2016 US presidential election , or the Equifax hack, which exposed personal information of about 14.5 crore people. He and his colleagues are determined to modernize the country’s standards and protect all citizens. 

“India has accelerated from a ‘bail gaadi’ economy to a silicon-chip economy,” said Srikrishna, using the Hindi expression for ox cart. “But privacy and data regulation rules are still far behind.” 

India has been careening into the digital age. The number of people with smartphones soared to 37 crore users at end 2017, from 2.5 crore in 2012, according to Counterpoint Research. The government has also developed one of the world’s most ambitious biometric identity systems- Aadhaar, which assigned unique 12-digit numbers to 110 crore Indians and registered their fingerprints, iris scans and demographic details. That data is now used for everything from tax returns and property purchases to welfare disbursals and WhatsApp payments. 

But this flood of data -- and an absence of regulation -- has fueled concern among privacy activists and citizens groups. That’s been aggravated by government practices, including a recent misstep by the southern state of Andhra Pradesh that inadvertently exposed the demographic and bank details of more than 1.3 lakh people. 

“Data-poor India is rapidly becoming a data-rich economy so having a data protection law is critical,” said Srikanth Nadhamuni, chief executive officer of startup incubator Khosla Labs and former chief technology officer for Aadhaar. 

The diminutive, grey-haired Srikrishna discussed the debate during an interview in his Mumbai office, which is so compact that chairs for visitors prevent the door from opening fully. He plans to navigate a “middle path” between the laissez-faire US approach and the stringent General Data Protection Regulation (GDPR) just imposed in Europe. “India is India, after all,” he said, seated in front of a MacBook and pile of papers. 

The 10-member committee he heads -- comprising academics and government officials -- is putting the finishing touches to their bill. The draft will need parliament approval to be enacted. 

Currently, foreign companies and hundreds of home-grown startups collect, aggregate, store and process Indian user data unhindered. The Google-backed delivery app Dunzo, for instance, requires access to a customer’s contact list, location, messages, media files and call information at the time of installation. Such information is gathered "only to improve the user’s experience of initiating/running a task on the Dunzo App," the startup said in an email. 

Srikrishna’s framework would rein in such practices. It will detail what is fair use, whether technology giants can transfer data across the border, and how to enforce accountability and penalties for violations. It will also establish whether users can access and control their own data, like with the EU’s GDPR. 

“Like we keep diabetes and blood pressure in check, controls are needed for data,” Srikrishna said. “Companies like Amazon, Google, Microsoft, and Flipkart are extremely nervous.” 

13323 - Tough provisions, SEBI-like regulator in draft data law in a few weeks, says panel chairman - Factor Daily

https://factordaily.com/sebi-like-data-regulator-india/

Tough provisions, SEBI-like regulator in draft data law in a few weeks, says panel chairman

An expert committee tasked by the Union government to recommend a data protection law for India is gravitating towards stringent provisions in the draft framework in the aftermath of the Facebook-Cambridge Analytica data scandal but will stop short of copying European Union regulations that are widely seen as the gold standard for user privacy.

It proposes to put in place a data regulatory structure on the lines of the Securities and Exchange Board of India or Insurance Regulatory and Development Authority with an appellate authority and designated courts of appeal.

And, it expects to submit its report to the government by the end of April or early May, the panel chairman B N Srikrishna has said in an interview. “It is for the government to take it from there,” he said.

In the Facebook data breach, analytics firm Cambridge Analytica harvested personal information of some 87 million Facebook users since 2014. In light of the role that fake news and advertisements on Facebook played in the 2016 US presidential elections, data privacy rules have become the focus of lawmakers and users of platforms such as Facebook, Google and others the world over.

The Facebook scandal is the second context-altering event for the Justice Srikrishna-headed data protection committee. Weeks after it was set up by the government end of July last year, a nine-member bench of the Supreme Court ruled that privacy was a fundamental right under the Indian Constitution with reasonable restrictions.

“Today, anybody can take (data) and use it for anything. No one is answerable,” said Justice Srikrishna on phone from Mumbai. “The law has to be agnostic to technology. If it is wedded to one, after two days, the technology will become obsolete and the law will have to be changed. And, you know how difficult that will be with how much the Parliament functions these days.”

After the Facebook-Cambridge Analytica data scandal, there has been a debate on the kind of rules that India’s data privacy law should have and how privacy should be central to the design of platforms. Some experts have pointed to EU’s General Data Protection Regulation (GDPR) as model rules for data protection, while others have called it too stringent. The GDPR law lays down fines of up to the greater of €20 million or 4% of global revenues of companies that violate privacy rules in the EU, among other tough measures.

Justice Srikrishna said the Indian privacy law recommendations, too, would have hefty fines and punishment but stopped short of saying GDPR was a model law for India. “A user will have the right to say that ‘I don’t want to be part of Google, I am deleting my account and make sure that all my data is deleted.’ If subsequently it is found that it was not done, the company will be answerable.”

Most internet companies have sent in their suggestions based on a white paper by the data privacy panel and held public discussions on in New Delhi, Hyderabad, Bengaluru, and Mumbai. “They say GDPR is too strict, we can’t have a law like that,” the retired Supreme Court judge said.

While appreciating the maturity in and thinking behind GDPR, Justice Srikrishna the Indian concept of privacy may not be ready for as strict legal measures. “We need a special law but something like the GDPR in our country to work will be very hard. One size does not fit everybody. We have to make laws for us. Our concept of privacy is very different from the European concept of privacy. We are evolving.”

The key factor in framing the Indian data privacy law will be enforceability. “In India, we are long on law and short on enforcement. We have all kinds of laws but how are they interpreted and enforced. At the same time, without it (a data privacy law), people will say, ‘There is no law. What have I done wrong?’”

The punitive measures in the draft law have not been finalised but they will be stringent and tough, the 76-year-old former judge said. “Every law has to have teeth. How heavy it should be, whether there should be proportionality… all that is up to debate (before the panel),” he said.

“Every law is intended for the benefit of our citizens, benefit of the country. Of course, the benefit of the country also requires improvement of business, ease of business in this country. You can’t take it to one extreme or the other.”

Justice Srikrishna, who chaired the committee on the Financial Sector Legislative Reforms Commission (FSLRC) in 2013, said he expected unanimity in the final recommendations of the 10-member panel. “I don’t see a problem unless somebody votes against me,” he said with a laugh, adding there may be dissenting notes. He pointed out there were a few dissenting notes in the FSLRC committee’s recommendations.

Besides Justice Srikrishna, the committee’s members are: IT and telecom secretary Aruna Sundararajan; Ajay Bhushan Pandey, CEO, UIDAI; Ajay Kumar, additional secretary, IT ministry; Rajat Moona, director, IIT Raipur; National Cybersecurity Coordinator Gulshan Rai; R T Krishnan, director, IIM Indore; Arghya Sengupta, director, research, Vidhi Centre for Legal Policy; Rama Vedashree, CEO, Data Security Council of India; and a joint secretary of the IT ministry who serves as the member-convener.

“I don’t hold the government’s brief. Nor am I an activist. I am a judge. I have to be objective,” Justice Srikrishna said.

To get more stories like this on email, click here and subscribe to our daily brief.

Images: Carnegie India on Twitter and Supreme Court of India website.

Disclosure: FactorDaily is owned by SourceCode Media, which counts Accel Partners, Blume Ventures and Vijay Shekhar Sharma among its investors. Accel Partners is an early investor in Flipkart. Vijay Shekhar Sharma is the founder of Paytm. None of FactorDaily’s investors have any influence on its reporting about India’s technology and startup ecosystem.

13150 - Protect right to privacy: How to plug a Cambridge Analytica shaped hole in India’s privacy laws - Times of India Blog

Protect right to privacy: How to plug a Cambridge Analytica shaped hole in India’s privacy laws

March 27, 2018, 2:00 AM IST 

Amba Kak in TOI Edit Page | Edit Page, India, World | TOI

When you order through a food delivery app on your phone, it might retain your address without your explicit consent, so that the next time they know where to send your order. The app might also send discount coupons to the same address without fresh consent. So far so good.

But what if your food delivery history, and location data has also been tracked via your mobile so that it’s possible to identify what times and locations you’re most likely to make large purchases. That data is then shared with an e-commerce website and suddenly you can’t figure out why you see a higher quote for the same product as compared to your friend.

And what if the food delivery app shares your consumption preferences with your health insurance company. They conclude that your excessive intake of fast food indicates high likelihood of certain diseases, and therefore more expensive premiums.

Maybe you were ordering pizzas for your office, and so it’s an inaccurate inference. But you might never have the opportunity to challenge it.

                         Illustration: Uday Deb

Of course the privacy settings of the delivery app had an “opt out” to third-party data sharing. But you never went so deep. You were just ordering pizza.

In the wake of the Cambridge Analytica scandal the cry has gone out that “something” must be done. The Indian government has joined the chorus, and Union minister Ravi Shankar Prasad has wagged a finger at Facebook CEO Mark Zuckerberg warning that there would be “stringent action” if his company was found complicit in the “theft” of Indian people’s data.

Despite these allegations, this is not a story of unforeseen hacks or breaches. Much like the food delivery example, it is about an entirely foreseeable problem that flows from a lack of accountability through the chain of entities that process vast amounts of personal data, and a failure to ensure informed consent.

If ever there was a moment to recognise that the market for personal data will not self-correct itself, it is now. What India needs is a strong data protection law, and Justice Shrikrishna’s Committee, tasked with creating the draft, is looking at international experience closely.

If ever there was a moment to recognise that the market for personal data will not correct itself, it is now. What we need more than a summons to Zuckerberg, is a strong data protection law.

In May this year the General Data Protection Regulation (GDPR) is set to come into force in Europe, with variations in several other Asian countries. These already give us the right language to call out the problem, and some tools with which to tackle it.

Here is what we would need to start with:

Purpose limitation: We need the legal principle of “purpose limitation” to restrict unbridled access to personal data. The app economy is fuelled by data sharing – for example, maps that use your location, or communication apps that access your contact list, which may be acceptable. But app developers should only be permitted to collect data that they can demonstrate as proportionate and necessary for the stated purpose of their service.

Consent: As the collective outrage to the Cambridge Analytica revelations demonstrates, people were shocked at the permissive settings on their own Facebook accounts. Default opt-in, what is termed “consent based on silence”, seemed unjustifiable.

India’s privacy law needs clear standards for consent. The European GDPR mandates that this must be freely given, specific, informed and unambiguous. It clarifies that language should be clear and plain, use no unfair terms, and must allow separate consent to be given for different data processing operations. It should be possible to consent to one but refuse it to another. (South Korean law in fact requires active opt-in to any marketing uses of personal data.)

Even-if consent: The fine-print cannot be viewed as a contract that encapsulates the sum total of our rights. Our rights to privacy emanate from the Constitution, and the Supreme Court’s landmark privacy judgment recently reminded us that any interference into privacy must be necessary and proportionate.

Regardless of the user’s consent there must be obligations to fulfil fairness and proportionality. For example, consent should never legitimise the collection of data in excess of a specified purpose.

Legitimate interests of the business: India’s law will need clear standards for what businesses claim to be “legitimate interests”, offered as an alternative to consent. If individuals could not reasonably expect their data to be used in certain ways, or if it would cause a violation of their right to meaningful opt-out, then that should override the business interest. Combining distinct databases, where data was initially collected in other contexts, and for other purposes, and which create complex profiles of individuals without their knowledge, is not legitimate, proportionate or necessary.

The Cambridge Analytica episode demonstrates that enforcing the substance and spirit of privacy law might be a challenge. However, this pessimism should only get us to stronger regulation. A toothless regulator is far easier to ignore – both at the stage of enforcement but even at the prior stage of compliance.

A strong data protection authority with clear standards and punitive powers will have tremendous influence over the legal risk calculus of companies providing services to Indians.

Summoning Mark Zuckerberg may not.

DISCLAIMER : Views expressed above are the author's own.

13137 - Centre collecting, using personal info illegally, says govt committee - TNN

Centre collecting, using personal info illegally, says govt committee

Chethan Kumar | TNN | 

Mar 26, 2018, 04:29 IST

BENGALURU: At a time when discussions on data privacy have put the Centre in a spot in the Supreme Court, the Committee of Experts (CoE) under Justice (retd) BN Srikrishna has said the government is “collecting and using personal data in certain contexts, like intelligence gathering and counter-terrorism, without the backing of any law”.

“The public and private sector are collecting and using personal data on an unprecedented scale. While data can be put to beneficial use, unregulated and arbitrary use of data, especially personal data, raise concerns relating to centralisation of databases, profiling of individuals, increased surveillance and a consequent erosion of individual autonomy,” the paper notes.

The committee, which released the paper in November 2017 and is currently in the process of conducting consultations, has also considered the SC judgment on privacy, whose lead petitioner, Justice (retd) KS Puttaswamy, told TOI that collection and use of data without laws can lead to erosion of privacy as it leaves the citizen with no forum to challenge.

While stating that processing of information in the interest of national security, or the security of the state, is permissible as long as the government is able to demonstrate that it is necessary to achieve the purpose, the committee says the challenge lies in ensuring the derogations to an individual’s right to privacy must be permissible only if it is necessary for these objectives.

Speaking about prior legislation for data protection, the paper points to the Information Technology (IT) Act of 2000 and notes that there are many discrepancies despite the introduction of Information Technology (Reasonable Security Practices and Sensitive Personal Data or Information) Rules, 2011, known as SPDI Rules.

“SPDI Rules apply only to corporate entities and leave government and government bodies outside its ambit; the rules are restricted to ‘sensitive personal data’, which includes attributes like sexual orientation, medical records and history, biometric information et al and not the larger category of personal data,” the paper notes.

The committee said that the absence of effective enforcement machinery raises concerns about the implementation of the SPDI Rules, making a comprehensive law to protect personal data.

Arguing that certain exemptions — as in the UK and European Union’s General Data Protection Regulation (GDPR) — must be provided to the government when it comes to using data for national security, it bats for proper regulation. “The law may provide exemptions for Information collected for investigation and prosecution; Maintenance of national security and public order. But exemptions must be defined to ensure that data processing is done only for the stated purpose. It must be demonstrable that the data was necessary for the purpose. In order to ensure that the exemptions are reasonable and not granted arbitrarily, an effective review mechanism must be devised,” the paper notes.

13107 - Centre collecting, using personal info illegally, says govt committee - TNN

Centre collecting, using personal info illegally, says govt committee

Chethan Kumar | TNN | 

Mar 26, 2018, 04:29 IST

BENGALURU: At a time when discussions on data privacy have put the Centre in a spot in the Supreme Court, the Committee of Experts (CoE) under Justice (retd) BN Srikrishna has said the government is “collecting and using personal data in certain contexts, like intelligence gathering and counter-terrorism, without the backing of any law”.

“The public and private sector are collecting and using personal data on an unprecedented scale. While data can be put to beneficial use, unregulated and arbitrary use of data, especially personal data, raise concerns relating to centralisation of databases, profiling of individuals, increased surveillance and a consequent erosion of individual autonomy,” the paper notes.

The committee, which released the paper in November 2017 and is currently in the process of conducting consultations, has also considered the SC judgment on privacy, whose lead petitioner, Justice (retd) KS Puttaswamy, told TOI that collection and use of data without laws can lead to erosion of privacy as it leaves the citizen with no forum to challenge.

While stating that processing of information in the interest of national security, or the security of the state, is permissible as long as the government is able to demonstrate that it is necessary to achieve the purpose, the committee says the challenge lies in ensuring the derogations to an individual’s right to privacy must be permissible only if it is necessary for these objectives.

Speaking about prior legislation for data protection, the paper points to the Information Technology (IT) Act of 2000 and notes that there are many discrepancies despite the introduction of Information Technology (Reasonable Security Practices and Sensitive Personal Data or Information) Rules, 2011, known as SPDI Rules.

“SPDI Rules apply only to corporate entities and leave government and government bodies outside its ambit; the rules are restricted to ‘sensitive personal data’, which includes attributes like sexual orientation, medical records and history, biometric information et al and not the larger category of personal data,” the paper notes.

The committee said that the absence of effective enforcement machinery raises concerns about the implementation of the SPDI Rules, making a comprehensive law to protect personal data.

Arguing that certain exemptions — as in the UK and European Union’s General Data Protection Regulation (GDPR) — must be provided to the government when it comes to using data for national security, it bats for proper regulation. “The law may provide exemptions for Information collected for investigation and prosecution; Maintenance of national security and public order. But exemptions must be defined to ensure that data processing is done only for the stated purpose. It must be demonstrable that the data was necessary for the purpose. In order to ensure that the exemptions are reasonable and not granted arbitrarily, an effective review mechanism must be devised,” the paper notes.

12795 - Aadhaar data breach: Why robust redressal system is needed to solve grievances with UIDAI - Money Control

Feb 13, 2018 04:20 PM IST | Source: Moneycontrol.com

Aadhaar data breach: Why robust redressal system is needed to solve grievances with UIDAI

Since a large quantum of data, including biometric data of individuals is stored with Central Identities Data Repository, the possibility of data theft is palpable with Aadhaar.

Moneycontrol News

@moneycontrolcom

By Supratim Chakraborty & Sneh Lata

The public consultation meetings on the white paper, framed by the committee of experts headed by Justice BN Srikrishna, in relation to data protection framework for India has been an eye opener in many respect.

The consultation sessions held in cities like New Delhi, Hyderabad and Bangalore have often meandered towards venting of grievances against Aadhaar by the public.

So much so, that the committee members had to intervene at times to clarify that the consultation meet was not to discuss the Aadhaar related issues but was for a larger goal of determining the data protection framework for India.

It became apparent from these sessions that amidst the controversies and questions surrounding data privacy and protection, Aadhaar has taken the centre stage today.

Whilst the hearing on the need and validity of Aadhaar in India has resumed in the Hon’ble Supreme Court, it is important to discuss some of the critical issues of Aadhaar and its implementation in India.

Taking a cue from some of the rather emotional discussions at the white paper consultation meets, one can state with conviction that there are several gaps in the implementation of the Aadhaar scheme.

These issues are certainly acting as roadblocks for the Government’s ambitious project to take a quantum leap and have a uniform digital identity proof in India.

Critical Hurdles for Aadhaar

One important roadblock in relation to Aadhaar is the lack of clear understanding about the various facets and legal framework associated with Aadhaar.

It is being observed that subsidies, benefits and services are being refused on the ground that individuals do not possess a valid Aadhaar.

The aggrieved individuals are often left with no recourse as there is a lack of understanding and clarity amongst the general public as well as the officials entrusted with the implementation of Aadhaar.

People are unaware that authentication of an individual by the Aadhaar number is not the only mode of authentication of identity of an individual and that the Aadhaar Act itself contains provision that allows for alternate and viable means of identification.

However, it is also a fact that the government is increasingly implementing measures that would ensure that obtaining of Aadhaar becomes mandatory, in effect.

This aspect has been flagged out in the white paper which states that Aadhaar is being viewed by many as coercive collection of personal data by the State.

It has also been frightfully argued before the Hon’ble Supreme Court recently that Aadhaar has empowered the State with a switch with which it can cause civil death of a person.

Aadhaar implementation has also been facing serious hurdles in relation to data security issues.

One such issue is that no authentication procedure has been provided for verifying the identity of the Aadhaar number provider for checking the bank details associated with a particular Aadhaar number.

Any person who knows an individual’s Aadhaar number can find out the name of the last bank linked to such Aadhaar number.

Since a large quantum of data, including biometric data of individuals is stored with Central Identities Data Repository (CIDR), the possibility of data theft is palpable.

Though it may be argued that the superior encryption used for such data would make it impregnable, however, in light of the rapid strides towards quantum computing, this premise could easily be negated and rendered redundant in future.

Whereas UIDAI is attempting to continuously boost security measures for authentication of individuals under Aadhaar by using technologies such as dummy numbers, facial recognition, etc, it is true that despite such attempts there is a possibility of breach, as counter to such technological security attempts are also continuously evolving. Also, the apprehension is - whether it is too little, too late!

The white paper in this regard points out that despite adequate security safeguards, no database is one hundred percent secure. Such enormous amount of valuable personal data acts as a significant motivation for miscreants to hack and, therefore, this concern has to be given due regard.

A Solution in the Making?

In light of all these, it would be important to set up a robust grievance redressal mechanism that would promptly address the issues.

Currently, as per the Aadhaar Act, the courts are to take cognizance of complaints for breach provisions of the Aadhaar Act, only when Unique Identification Authority of India (UIDAI) files a complaint.

It is the need of the hour to devise a framework that allows hassle-free functioning of Aadhaar whereunder one does not have to rely on the integrity or whims of human functionaries implementing the Aadhaar or on the advancement of technology.

This can be achieved through the new data protection law that is in the offing. If the new law, which is equally applicable to both private parties and the government, provides adequate safeguards to maintain confidentiality of individual’s information, holds wrongdoers strictly accountable and provides for adequate grievance redressal mechanism, then some of the important lacunae highlighted in relation to Aadhaar may stand effectively redressed.

If the larger concern of data protection of individual is adequately addressed, the concerns relating to Aadhaar, being a subset of the larger issue, will automatically stand resolved.

(Authored by Supratim Chakraborty (Associate Partner) and Sneh Lata (Associate) at Khaitan & Co LLP. Views are personal)

12971 - Justice B.N. Srikrishna Committee Discloses Minutes Of Meetings; Reveals Circulation Of Draft Data Protection Bill By MeiTY - Live Law

http://www.livelaw.in/justice-b-n-srikrishna-committee-discloses-minutes-meetings-reveals-circulation-draft-data-protection-bill-meity/

Justice B.N. Srikrishna Committee Discloses Minutes Of Meetings; Reveals Circulation Of Draft Data Protection Bill By MeiTY

After initially refusing to disclose the minutes and agenda papers of meetings of Justice B.N. Srikrishna Committee for a data protection framework for India, Ministry of Electronics & Information Technology (MeitY) has now disclosed under the RTI Act, 2005 the minutes and agenda papers of two of its meetings dated 8 September, 2017 and 3 October, 2017. The minutes were revealed on an RTI application filed by Mr. Paras Nath Singh.

The disclosure comes as a welcome change after a group of 24 legal academicians and advocates had recently written to the Committee, demanding inter alia release of information on its proceedings, meeting notes and draft bill, as well as the comments received by it.

A perusal of the minutes of the first meeting shows that Justice B.N. Srikrishna, Chairman of the Committee, has emphasized on the fact that Aadhaar is only a subset of total data protection law. The Committee, he opined, is looking for a broader picture of data protection- a sort of an umbrella law. The Chairman also suggested that smaller working groups be formed to deal with different facets of data protection laws. The Committee has, therefore, formed the following four working groups:

1. Big Data Ecosystem and other emerging technologies- This will include technical members from the Committee and will form the context for the report, looking into benefits and harms of data collection and use practices. Prof. Rajat Moona and Prof. Rishikesha Krishnan are members of this working group.
2. Scope and Exemption of Law- This will include policy questions of territorial operation, data localisation and exemption, with significant effect on industry. Dr. Ajay Kumar and Ms. Rama Vedashree are members of this group.
3. Grounds of processing and right and obligation of parties (combining above two areas): As per the minutes of the meeting, this is the group that will examine the critical legal aspects of data processing. Currently, its biggest point of discussion would be the Aadhaar ecosystem. Justice B.N. Srikrishna, Dr. Arghya Sengupta and Dr. Ajay Bhushan Pandey are members of this working group.
4. Enforcement- This group will examine the enforcement part of the proposed law and is comprised of Ms. Aruna Sundarajan and Dr. Gulshan Rai.

Minutes of the second meeting held on 3 October, 2017 reveal that a draft Data Protection Bill has been circulated by MeiTY. This draft Bill proposes TDSAT and its Adjudicating officer as prosecution and adjudication mechanisms.

Dr. Gulshan Rai, as the 4^th Working Group member on enforcement, opined that the present scope and applicability of the Draft Bill is very limited and does not reflect the strategic importance of information and data to our social, political and economic well-being. He further opined that TDSAT, at present, has limited capacity and its Adjudicating Officers have no criminal jurisdiction. He, therefore, said that this provision needed to be revisited and strengthened in the Bill. According to him, the present draft Bill has left out very critical areas; that consent framework and its applicability as well as the exceptions need to be revised; and that coverage for objects, device, sensors or phenomena should be considered.

Prof. Rajat Moona, from the 1^st working group, asserted that the consent must be traceable, provable, non-repudiable and must stand the test of law. He proposed introduction of an independent function of “consent management”, opining that such mechanism may empower data sharing. The Committee deliberated on “consent management” concept and discussed whether such management may cause additional burden on the organization without proportional outcomes. The Chairman then highlighted the difference between a consent-driven model and a rights-driven model, and opined that the liability should be on the data controller and processor in the whole chain.

Dr. Arghya Sengupta, from the 3^rd Working Group, stated that at present consent form for collecting personal information amounts to a “contract of adhesion” as they provide only a “take it or leave it” option. He proposed the concept of “dashboard based consent repository”. The dashboard issue was discussed among members and it was argued whether sharing of consent on such a dashboard would itself require consent. It was further argued whether this may lead to breach of privacy by such aggregator dashboard provider. It was then suggested that digital locker itself can be used as a dashboard.

The Committee, in its second meeting, inter-alia recommended that each working group shall provide specific comments/amendments on clauses of the draft Data Protection Bill circulated by MeitY. They also need to suggest changes that may be required, if any, to other allied legislation such as the Aadhaar Act, 2016 or the Information Technology Act, 2000.

12955 - Big Data, Large Concerns - Indian Express

Big Data, Large Concerns

Consent and accountability should be at the core of the new privacy law.

Written by Amba Kak , Jason Schultz | Updated: February 12, 2018 1:50 am

 The risk of a single breach grows with each new wave of data scooped up or shared.

The Supreme Court recently affirmed a fundamental right to privacy. The government is now moving to enact a data privacy law, the Justice Shri Krishna Committee has released a comprehensive report and the consultation process is coming to a close. Multiple legal challenges against Aadhaar — many involving citizens’ privacy — are being heard before the Supreme Court. The government is keen to assure the judges and the public that there are enough safeguards to keep the programme legal. But the privacy law will impact more than the future of Aadhaar. It will set the terms on which Indians share intimate data about themselves with both the government and a growing number of private companies.

Already, the Committee might be walking a troublesome path. It has suggested that while in the past “it was possible to limit the collection of data to satisfy a particular purpose”, in the era of big data “this may no longer hold true”. While the Committee does well to endorse the importance of user consent generally, when it comes to big data they suggest, “consent may not be as relevant”. Its effort to distinguish big data’s privacy modes from other data instead seems to echo an increasingly popular argument in policy circles globally — what Helen Nissenbaum refers to as “big data exceptionalism”. It’s the belief that regulating the collection of big data is impossible and undesirable. So the focus should be exclusively on preventing harmful uses and outcomes data. In India, prominent tech lawyer Rahul Matthan has argued that India should adopt an “accountability framework” rather than a consent framework. Why not both?

Big data exceptionalism is an attractive position, no doubt. Creating a regulated process to govern data collection can seem impractical, especially when the data is often an unexpected byproduct of everyday interactions — every step we take with our GPS-enabled phone, every post we “like” on Facebook, every purchase we make, every advertisement we watch. Supporters of big data exceptionalism also make the positive “profit” claim that unfettered data collection can unlock innovation. But this is just as likely to create real threats. Some of our research with Kate Crawford (cited by the Shri Krishna Committee) explores the far reaching consequences of big data and its “predictions” on our personal rights, especially when they are used to decide what to sell us, which businesses will interview us for jobs, and even what news we are allowed to see. A more forensic assessment of the threats of big data exceptionalism is needed.

Firstly, unregulated collection of data dramatically increases the risk of breach. If unlimited quantities of data are gathered and stored — even if they are never analysed or applied to any uses — the risk of a single breach grows with each new wave of data scooped up or shared. The frequency and fallout of data breaches becomes more apparent each day, from Aadhaar in India to Equifax in the US. Second, unregulated data collection opens up new modes of surveillance, both government and corporate, that can have an extreme chilling effect on online freedoms. The European Court of Justice noted, the mere collection of data “is likely to generate in the minds of the persons concerned the feeling that their private lives are the subject of constant surveillance”.

The concept of big data exceptionalism abandons two globally recognised privacy principles — principles India should be embracing. First is “collection limitation”: The principle that there must be a legal basis for any collection of data. User consent is a powerful basis because we can withdraw it when a company abuses our data or its power over us. Even if we accept that consent fatigue is a reality (no one reads privacy policies), there are other bases to regulate data collection. Indeed, most data protection laws around the world already acknowledge that the benefits of big data can be recognised through other means than consent if the circumstances are appropriate, such as when the data collection is in the vital interest of the individual, or fulfils a legitimate interest of the data controller. So concerns over squelching innovation are likely overblown. The second is “data minimisation”, the principle that entities must only collect as much data as is narrowly tailored to the purpose they seek to achieve, and no more. Mandating data minimisation as a design principle compels inquiry into proportional data collection right at the outset — a philosophy often referred to as privacy by design.

For the sake of citizens’ privacy, we hope the committee will not abandon these traditional privacy rules under the cloud of big data exceptionalism. It is easy to remove protections; it is hard to put them back in place.

Kak and Schultz are Mozilla technology policy fellows. Schultz, a professor of clinical law, is research lead for the AI Now Institute at New York University