Access to everything is bad (?)

The government recently tabled the Personal Data Protection Bill 2019, fulfilling the need for a much needed law in an industry very loosely regulated, dominated by powerful players, the combined effect of both leaves the common consumer of internet with few options than to accept what they do and sulk in case of loss of privacy.

With a Supreme Court ruling in 2017 establishing the right to privacy as a fundamental right, it is necessary to hold tech companies accountable for what data they collect, how they collect, from whom they collect, how do they use it, and to whom they sell the data or analytics based on that data.

The bill sets guidelines for processing of personal data by government, companies incorporated in India, and foreign companies dealing with personal data of individuals in India. The bill also categorizes certain personal data as sensitive personal data.

We've always heard, access to everything is bad. But now is the time to question, access to what and by whom and to what end?

The bill also goes on to set up a Data Protection Authority which may take steps to protect interests of individuals, prevent misuse of personal data and ensure compliance with the Bill. It seems to be defined heavily in favour of the average consumer of internet, with the possible exceptions of the sections defining the grounds for processing data and the exemptions from the Bill.

The Bill allows the use of personal data without consent if required by the State for providing benefits to the individual, legal proceedings or to respond to a medical emergency.

While these three reasons might not be as worrisome as many fear them to be, combined with the power vested in the central government to exempt any of its agencies from the provisions of the Bill in interest of security of state, public order, sovereignty and integrity of India and friendly relations with foreign states surely gives it the form of what a surveillance state might look like.

While it may seem very intuitive and straight forward to some that the government and its security agencies might at times need to override an individual’s consent to use their personal data while acting in the interest of national and public security, some might argue that such actions might amount to snooping and violate the right to privacy of the individual.

One might want to look at two separate incidents that blew into major controversies owing to access to personal data.

The accused in the Boston Marathon bombings were identified, and their iPhones were critical data points to prove their guilt of the crime. However, when the security agencies reached out to Apple, the company that manufactures and sells iPhones, sensing an opportunity to prove its loyalty to its customer base and its commitment to their privacy and data security, refused cooperation. The matter went legal and turned into a full-blown controversy and could have turned worse had not the agencies been able to crack the encryption on the device by themselves.

However, another event, closer home and closer in time, unfurled with revelation by instant messaging platform Whatsapp that its systems were compromised, and taken advantage of by Israeli tech Pegasus which by its own admission is mostly used by governments for surveillance purpose. The most shocking aspect was the revelation that most of the people targeted were noted public figures related with the Bhima-Koregaon protest and subsequent violence. What's concerning is the belief held by Justice BN Srikrishna, who led the committee that drafted the bill, that in its current form the bill is dangerous and can turn India into an Orwellian state.

Putting these two events in your mind in quick succession, you need to question yourself, how fair is state surveillance and how far can it be allowed to go and under whose supervision and what can we do to maintain the right balance.

The question the government means to put across to the citizens here is, is the right to privacy of an individual, one that might be a potential risk to public law and order, greater than the right to security of the rest of the public?

There might not be a simple yes or no answer to this question, and this is the reason why the state machinery needs to finetune the Bill while it is still referred to a joint parliamentary committee of both houses as much as possible and remove ambiguity if any.

The onus lies on the law makers and the bureaucracy to ensure that the question raised above is answered, and answered to the best of the state’s abilities.