Digital Personal Data Protection Act Is An Outlier, Not In A Good Way : Apar Gupta

On August 12, 2023, the Digital Personal Data Protection Act received the assent of the President of India, clearing the way for the act to come into force when notified by the central government. It is the first law made for processing data in India and it brings several amendments to the Right to Information Act and the Information Technology Act. According to the preamble of the act, the objective is to provide for the processing of digital personal data in a manner that “recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes” and for other connected matters. There is no gainsaying that this act will have a profound impact on the way data generated by internet users will be collected and used, among other things. But, despite being the first of its kind, the act is not without its concerns. In conversation with Live Law, advocate and digital rights activist Apar Gupta said that the law is an outlier when contrasted with contemporary legislations in other jurisdictions, and not in a good way. According to Gupta, the bill – which has now been passed and signed into law but remains to be enforced – was intended by the government to give effect to the Supreme Court's 2017 K Puttaswamy judgment which read the right to privacy into Article 21 of the Constitution. However, the endeavour by the government has largely been unsuccessful. The interview was conducted two days before the Digital Personal Data Protection Bill received the presidential assent and the full interaction may be watched on YouTube. Here are the highlights from the interview: Exemptions to Data Processors under the Act While explaining the framework of the law, Gupta highlighted what he said were extremely broad exemptions in the act that essentially rendered the consent of the data principal entirely meaningless. The act defines a data principal as the individual to whom the personal data relates, as well as the lawful guardian of a minor, and the lawful guardian of a person with disability who is acting on their behalf. This is the footing on which the common people is placed, under the new law. Although the data principal is intended to be the primary beneficiary of a data protection law, Gupta expressed apprehensions over its consent requirements. As an example of the 'broad exemptions' under the act, Gupta pointed to Section 7(g), which states that no consent will be required for the government to process data for taking measures to provide medical treatment, or health services during an epidemic, outbreak of disease or any other threat to public health. Similarly, he highlighted the broad exemptions under Section 7(i) for use of the data for the purposes of employment. This was particularly alarming because India is a country where the government is the single largest employer of people. “Exemption of certain legitimate uses where consent is presupposed is in variance with several international data protection statutes,” Gupta said, after using these illustrations. Duties, Positive Obligations and Penalties for Citizens Gupta pointed out that data protection statutes do not impose duties in terms of penal action for breaches by ordinary people. Section 15 of the Act creates obligations of the data principles to comply with all provisions of this law. These obligations, specifically in Section 15(b) of the Act, also create a broad obligation to not impersonate another person while providing their personal data, which may create room for penalisation in bad faith for persons who may not have digital literacy, such as senior citizens, who depend on their relatives for operating their electronic devices. Next, Gupta spoke about Section 15(c), which creates a positive obligation on citizens to not suppress any material information while providing personal data for documents to the State. He explained that many people often provided incomplete information relating to their home addresses, and deliberately left other private details out to protect themselves against stalking or harassment. And this law creates room for penalising these citizens in bad faith. A fine of up to Rs. 10,000 can be imposed on an ordinary citizen for non-compliance of any of the duties under Section 15 of the Act. 'Complete Outlier' in Contemporary Data Protection Legislations Because of the host of positive obligations of the data principal, the act is a complete outlier when compared with data protection legislations in other countries, Gupta said. Another reason the DPDP Act is an outlier, Gupta explained, was because of Section 17(3), which gives the central government the power to exempt some data fiduciaries or class of data fiduciaries from certain obligations under this act as a data process, owing to the 'volume and nature' of personal data processed. For more context,...

Digital Personal Data Protection Act Is An Outlier, Not In A Good Way : Apar Gupta

Anuj Nakade

Tags