At the Ministry of Electronics and Information Technology press event, the Justice BN Srikrishna committee submitted its report on data protection, titled “A Free and Fair Digital Economy- Protecting Privacy, Empowering Indians,” along with a draft on Data Protection Bill 2018 to the Union Minister holding Law and Justice, and Electronics and Information Technology, Ravi Shankar Prasad on Friday.
According to the reports, without finalizing a timeline, Prasad said, “The entire Parliamentary process will be followed.”
The government had set up the committee under the chairmanship of retired Supreme Court judge Srikrishna in August 2017. “The citizen’s rights have to be protected, the responsibilities of the states have to be defined but the data protection can’t be at the cost of trade and industry,” said Srikrishna.
ALSO READ: Vice-president Venkaiah Naidu to visit Karunanidhi in Chennai hospital
Highlights of the report:
- Restriction on processing and collection of personal data: the committee has recommended only that data which is necessary for such processing is to be collected from anyone.
- Processing of personal data for the functioning of the state: it is the most problematic and criticized suggestion as it allows the government to process your data if it considered necessary for the functioning of Parliament or State Legislature.
- Right to be forgotten: this prevents any display of personal data once the purpose of disclosing the data has ended or withdrawn consent from disclosure.
- Data Localization: this means personal data will need to be stored on servers located within India, and transfer outside the country will be subject to safeguards. Critical personal data, however, will only be processed in India.
- Processing of sensitive data to require explicit consent: this means “sensitive” personal data (such as passwords, financial data, sexual orientation, biometric data, religion or caste) should not be processed unless someone gives explicit consent.
- Data Protection Authority: the committee has recommended to prevent misuse of personal data and ensure compliance with the safeguards and obligations under the data protection framework by corporations, governments or anyone else processing personal data (known as “data fiduciaries”).
- Aadhaar Act Amendments: the committee has suggested to the Aadhaar Act 2016 to ensure the autonomy of the UIDAI and “bolster data protection”. These include offline verification of Aadhaar numbers and new civil and criminal penalties. The ability to file complaints will remain with the UIDAI alone.
- RTI Act Amendments: the committee recommends the amendment amend section 8(1)(j) of the RTI Act that pertains to the disclosure of personal information in the larger public interest.
Read full report and bill- Personal Data Protection Bill, 2018
However, has left it to the Central government to notify categories of personal data that will be considered as critical. Additionally, personal data collected, used, shared, disclosed or otherwise processed by companies incorporated under Indian law will be covered, irrespective of where it is actually processed in India. But, it also empowers the Centre to exempt companies which only process the personal data of foreign nationals not present in India.
The committee’s recommendations on key issues such as consent, setting up of a data authority, the definition of personal data and sensitive personal data along with data localization are keenly awaited for their implications on tech majors such as Google, Facebook, and Twitter among others.