Naavi.org

(This is a continuation of the discussion on the seeking of scrapping of DPDPA and DPDPA rules by three petitioners in the Supreme Court)

One more objection raised by Reporter’s Collective which is bizarre and sinister is the interpretation that while the Search Committee may recommend some candidates either for the Chairman’s position or the members of Data Protection Board, The Government may appoint some body other than the recommended  persons.

It is not clear where from they got this creative idea which is unsubstantiated and completely ridiculous.

The petition goes further and states that sincethe DPB may act through a “Digital office” it  is “exclusionary” forgetting that the law is meant only for “Digital Personal Data” and the related disputes and further that the disputes with Data Principals if any for personal remedy may be handled not by DPB but by the Adjudicating officer of ITA 2000.  When the suject matter of the dispute itself is “Digital”, it is difficult to understand how the dispute can be settled without touching a “Digital Office”. The petitioner has just invented a reason to raise the dispute.

To support its view it has referred to several judicial decisions which have no relation to the formation of DPB through a process involving selection by a search committee consisting of three secreatries and two exernal persons.

Finally the petitioner thinks that the penalty of Rs 50 crores to Rs 250 crores are exaggerated forgetting  that the recommendation is “Upto” Rs 50 crores or “Upto” Rs 250 crores. The law does not mandate specifically that the minimum penalty should be Rs 50 crores. The law also provides an option for Volunatary undertaking which could mean that in some instances, no finacial penalty may be impsoed at all and only certain remedial directions may be issued.

Petitioners also need to reflect that under GDPR penalties are at levels of 1 billion US dollars in some cases and comparitively the maximum penalties under the DPDPA are much lower.

The petitioners assume that though the Act provides that Government may exempt specific classes of fiduciaries or specific classes of data from parts of the act, and such selective  exemptions may be for SMEs, or even for Religious institutions such as Temples or even for the Journalists, the Government is not empowered to grant such powers. This sort of statements are malicious and meant only to make the Court believe what is not true.

The petitioners need to be asked to justify some of these assetions or admit that they are committing “perjery”.

Thus on several grounds the petition from Reporter’s collective  is considered as based on false premises meant to mislead the Court. It should ideally be rejected with a penalty.

We would have appreciated if the Reporter’s Collecive had restricted itself to express its concerns and seem specific remedies rather than asking for scrapping of the entire Act. This demand betrays that the petitioners have come with a pre-conceived conspiracy to get the act scrapped and prevent the Indian public rom getting whatever benefits they would have expeted from the “Right to Protect Personal Data” which the Act tries to provide.

We have our prescriptions on how the act and the rules may be inerpreted to the effect that none of the concerns expressed can be considered as not addressable with a suitable interpretation.

Naavi

(This is a continuation of the discussion on the seeking of scrapping of DPDPA and DPDPA rules by three petitioners in the Supreme Court)

The Reporter’s Collective petition goes much beyond the “Dilution of RTI”, “No exemption for Journalistic work”, “Exemption to Government for enabling mass surveillance” and attacks Section 36 as an instrument of violation of the “Right to Freedom of Press”. This is an interesting but malicious argument meant to fool the Supreme  Court which the Court should identify and penalize.

Section 36 of DPDPA is an innocuous single line section which states

36: Power to call for information.: The Central Government may, for the purposes of this Act, require the Board and any Data Fiduciary or intermediary to furnish such information as it may call for.

The Reporter’s collective has demonized this section through several pages of argument as an important ground to declare the Act as violative of the constituional right of the “Freedom of speech and expression of the journalist’s Private sources, whistle blowers and informants to the potential for compromise of their personal identity and personal data.”

Let us deeply analyse this contention that “Government being empowered to seek information from Data Fiduciaries” is curbing the sources of information of an investigative journalist and therefore violative of the “Freedom of Press”.

The contention must  be appreciated for its ingenuity and linking the unlinkable. This is the creative mind of the PIL advocate at its best.

The arguments draw a parellel between “Extracting information by planting a Pegasus software without the knowledge of a potential informant of a journalist” in the Manohar Lal Sharma vs Unionof India case, to the Government seeking information from a regulated entity. Again the Section 36 can be used only “For the purposes of the Act”. The purpose of the act as described in the Preamble and through the sections donot include digging of information of an investigative journalist.

Let us recall the preamble once again….DPDPA 2023 is an act to provide for the processing of digital personal data in a manner that recognises both

a) the right of individuals to protect their personal data and

b) the need to process such personal data for lawful purposes and

c) for matters connected therewith or incidental thereto.

Hence Section 36 does not give any powers to the Government as claimed in the petition ..

i) which can reveal significant information about any person.

ii) which can be used to identifyotherwise anonymous metadata obtained by various means,

iii) which  can also be used to identify anonymous online content obtained by various means.

iv) Can identify and reveal reveal intimate details about an individual’s life
religious affiliations, political beliefs, sexual orientations, health concerns, or personal relationships.

v) lacks any oversight or accountability mechanism that independently authorizes the request for information from the Central Government. (petitioners forget that under Rule 23, different officers of the Government are specifically empowered and are accountable for seeking such information)

vi) empowers the Central Government to call for a broad category of information pertaining to information which is likely to “prejudicially affect the sovereignty and integrity of India or security of the State”, without sufficient procedural safeguards.

These contentions of the petitioner are not substantiated by any part of the law as proposed and are only an imagination of the petitioners. Thet are plain falsehood meant  to mislead and cheat the Supreme  Court.

The petitioner’s seem to think that for every administrative decision to be taken by the DPB or the Authorized official of the Government on the Data Fiduciary, an independent Court order is required. This is a suggestion to reduce the Supreme Court to the level of the Secretary of the MeitY.

The petitioner thinks that Under section 36, Government will be seeking information about an individual without consent. This is a known false statement since Section 36 is about seeking information about Governance, Financial, Administrative and other information from the Data Fiduciary and not seeking information from an individual or about an individual. If  incidentally the Data Fiduciary needs to reveal any personal information of a data principal, then the data fiduciary is responsible for the use of legitimate basis for the disclosure or resist it in a Court of law.

The petitioner is childish and contends that the individual whose information may be revealed for national security reasons should be informed before hand that their information is being collected by the Government. It is utter foolishness to expect  this and it appears that the petioners are already preparing to represent the criminals whose information may be potentially revealed during a criminal investigation.

The petioners of the Reporter’s Collective petition have proven beyond doubt that they have intentions of preventing whatever benefits this law may give to the society and exhibit a mindset to assist criminals through their “Own concept of Privacy as a tool to hide crimes”. In this perspective, they may consider DPDPA as a  hindrance.

But we the real public of India donot agree with their views and donot consider them as representing the public of India.

Supreme Court should not only recognize these ulterior designs and reject the petition but penalize the petitioners with a substantial fine.

Naavi

(This is a continuation of the discussion on the seeking of scrapping of DPDPA and DPDPA rules by three petitioners in the Supreme Court)

When multiple celebrity lawyers argue before the Supreme Court that DPDPA is unconstituional and should be scrapped and quote multiple Supreme Court judgements of the past and the Indian Constitution, it cannot be taken lightly.

In the past cases such as Shreya Singhal case, or the Bitcoin case, decisions have been carried through on wrong premises since the petitioners were aggressive in their argument and the Government was not able to defend  its own laws. (Refer here on Shreya Singhal fiasco).

Now the “Scrap DPDPA Brigade” is claiming that DPDPA 2023 is unconsituional due to a variety of reasons including dilution of RTI Act, Unfettered surveillance powers to Government, High penalty etc.

In the first hearing, the case Supreme Court refused to grant Stay but fixed a new date for hearing.

Is there any guarantee that the Supreme Court will not grant a stay next time? Or

Is there any guarantee that the Supreme Court will not scrap DPDPA?

There is no such guarantee. It all depends on the force of the arguments.

But all professionals who want the benefits of the Act such as position as DPOs, Business as Data Auditors are silently wantching the fun. Even when prompted with a request to sign a petition, most ignore it since they consider themselves to be too elite to participate in such activities.

It is a tragedy with which India has to live with. But Naavi will continue this crusade even if only handful of people are behind…

Look at the following  riduculous claim made in the petition.

“.. even though the DPDP Act has created a provision under Section 17(5) for exempting certain “data fiduciaries or class of data fiduciaries” from the provisions of the DPDP Act within five years from the date of commencement of the statute, the Central Government does not have the power to exempt obligations of data fiduciaries in respect of a specific purpose, such as for public purposes, including for journalistic purposes.“

It is difficult to understand how this can be considered as a valid ground as presented in the petition to demand  scrapping of the Act.

But if learned counsels can put such grounds in the written affidavits, it means that they are confident of convincing the Court on such grounds.

In another place the petition says that

Section 36 of the DPDP Act states that the Central Government may require the Data Protection Board, any data fiduciary, or intermediary to provide information that it may call for…

The purposes for which such information may be called for (Rule 23) are

a) Use, by the State or any of its instrumentalities, of personal data of a Data Principal in the interest of sovereignty and integrity of India or security of the State

b) Use, by the State or any of its instrumentalities, of personal data of a Data Principal for the following purposes, namely: —(i) performance of any function under any law for the time being in force in India; or
(ii) disclosure of any information for fulfilling any obligation under any law for the time being in force in India

c) Carrying out assessment for notifying any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary.

The petition says that this facilitates unreasonable digital searches of personal data available with every data fiduciary or intermediary, contrary to Article 21 of the Constitution of India. It continues to state The purposes for which the Central Government may call for information are overbroad and vague, giving rise to the potential for abuse.

Under what figment of imagination do they think that the Government should not even ask a Data Fiduciary any information about the entity or its activities?

The petition says that BECAUSE Section 36 of the DPDP Act read with Rule 23 of the DPDP Rules empowers the Central Government to call for information in the “interest of
sovereignty and integrity of India or security of the State”,a phrase that is both overbroad and vague, and is for that reason alone unconstitutional.

This phrase is from the Article 19(2) of the constitution and is found in many laws including ITA 2000 and BNS.

But the petitioners consider these as sufficient grounds for scrapping the law passed by the Parliament.

It is surprising that the advocates who are the “Officers of the Court” are trying to mislead the Court with speculative possibilities which they only can imagine.

Looking at some of these grounds presented, it appears that the petitioners are either naive themselves or consider that the Judges can be made to toe their line whether it is logical or otherwise.

Even admission of this petition should be rejected and the petitioners should be asked to come back with a better petition.

Hope Supreme Court under the current CJI is different from the earlier Courts which could be swayed by the celebrity advocates.

Let us wait and watch.

Naavi

(This is a continuation of the discussion on the seeking of scrapping of DPDPA and DPDPA rules by three petitioners in the Supreme Court)

We have tried to point out inconsistencies in the petitions of the “Scrap-DPDPA Brigade” through many of our previous articles.

The net point we are making is

Objection Section 44(3) is not relevant since

a) Every PIO is should not forced to take a judical view under DPDPA whether Privacy interests are involved or not in releasing an information

b) PIO is encouraged to take the safety first option of rejecting release if prima facie personal information is involved so that the disgruntled applicant can invoke either the Grievance redressal mechansim under ITA 2000/DPDPA or RTI Act.

We have addressed some part of the objections related to exemptions under Section 17 which we shall explore further now.

DPDPA has to be considered as a law which is different from GDPR. Its approach to Personal Data Protection is different from that of GDPR. Similarly, DPDPA 2023 cannot be directly linked to the Puttaswamy Judgement on “Privacy is a Fundamental Right”. DPDPA 2023 is about personal data protection by organizations at the instance of the data principal. Protection of Privacy or being compliant to Privacy Principles under GDPR are incidental.

The petitioners have failed to look at DPDPA 2023 as an independent legislation and are trying to interpret it under different lense of either a Privacy Activist or a GDPR follower. These are giving raise to some disagreements. The Supreme Court has to understand this difference before giving any value to the arguments of the petitoners.

We shall try to address some of these issues here.

First of all, we need to take note of the following charecter of DPDPA 2023

1. DPDPA 2023 has not seggregated Personal Data into Sensitive Personal Data and Non Sensitive personal Data
2. DPDPA 2023 has designated Data Controllers under GDPR as Data Fiduciaries providing them additional fiduciary responsibilities to take decisions in the interest of the Data Principals beyond the Consent.
3. DPDPA 2023 has chosen “Consent” as the only legal basis for processing  of personal data since “Right of Choice” of the data principal is paramount to protect his “Personal Data Protection Rights”.
4. It is the Data Principal who decides why he wants his personal data to be processed in a particular manner. It could be to protect his privacy or it could be to protect his Security or it could be to protect any other Right of his choice.
5. The cross border restrictions are based on “Types of Data” and “Types of Data Fiduciaries” and not “Adequecy or SCC”
6. The exemptions are also defined on the basis of “The purpose of processing more than the class of Data Fiduciaries”.

These are fundamental differences in the approach of DPDPA to Personal Data protection and should be borne in mind when discussing whether DPDPA 2023 is constitutional or not.

We cannot judge DPDPA 2023 as unconstitutional by what it fails to do. We have to rather look at what it proposes to do and determine whether it violates any constitutional principles. 

Arguing that DPDPA is not constituional because it does not protect “Privacy” the way the petitioners think it should is fallacious.

Petitioners have  raised objections specifically on Sections 17(1)(c), 17(2).

When we look at Section 17,we can observe that it is divided into five sub sections namely 17(1), 17(2), 17(3), 17(4) and 17(5).

Section 17(5)

Setion 17(5) is a section empowering the Government to provide any exemption within the next 5 years. By the end of 5 years, Section 17 will crystallize. Till then Section 17 is malleable and can be tuned as required. Hence even if some of the provisions of the current Section 17 is not acceptable, there is a self correcting ability within the Act and there is no need to scrap DPDPA.

Section 17(3)

Section 17(3) is a section that empowers the Government to declare any data fiduciary (including start ups and perhaps even digital publications) to be  exempted from the provisions of Section 5 (Notice before collection), Section 8(3) (Completeness, Accuracy and consistency), Section 8(7) (Erasure on withdrawal of consent, Competion of purpose), Sections 10(Obligations of a Significant Data Fiducairy) and Section 11 (Right to Access).

Exemption under Section 17(3) is by specific notification  and should be justified with th critria of Volume and Nature of personal data processed.  This would be documented  and be available for judical scrutiny.

Section 17(4)

Exemption under Section 17(4) applies to State or instrumentalities of the State. It is applicable to Section 8(7) (Erasure on withdrawal of consent, Competion of purpose), 12(3) (Erasure of personal data as a Right). It is subject to a further condition that the processing does not involve making of a decision that affects the data principal and is not related to updation or correction of data.

Thus 17(3) and 17(4) and 17(5) does not result in any major harm to the data principal and is subject to judicial scrutiny when invoked.

This leaves Section 17(1) and 17(2) to discuss.

Section 17(1)

Section 17(1) is restricted to exemption of Chapter II (Obligations of a Data Fiduciary) other than 8(1) (Responsibility for a Data Processor) and 8(5) (Protection of Personal data). It is not restricted to Government bodies only but extends to Private sector also based on specific purposes such as

a) For enforcement of legal rights

b) Processing by Courts or other judicial entities

c) Prevention, detection, investigation or prosecution of any offence or contravention of any law

d) Data of foreigners processed in India

e)For processing during mergers and acquisitions after approval of Court

f) For processing by Financial Institutions after default

In these 6 subsections, the objections are being raised only on 17(1)(c) which is related to law enforcement duties. If the petitioners think Police should take prior consent  for processing the personal data of a criminal or a suspected criminal, they are living in a world of fantacy. Their speculation that it can be used for wide spread surveillance  of citizens is not based  on any facts. It is a pure speculation and imaginary. If such a situation arises checks and Balances need to be set up by the Law enforcement agency itself.

While DPDPA does not exempt “Security” of data, other laws including Section 72 of ITA 2000, and Section 316 of Bharatiya Nyaya Samhita, include responsibilities that the law enforcement person should secure the data collected for prevention or detection of crime.

Hence there is a reasonable check and balance associated with  the power and there is no reason to endanger the community by preventing the law enforcement from dicharging their duty to secure the nation. The Right to Security of a Citizen is also a fundamental right and a sacred duty of the Government.

If the objections raised on  Section 17(1)(c) is upheld it becomes a Right of a Criminal to hide under privacy excuses.

The same petitioners what Privacy not be a constraint for release of information under RTI but have objections for collection of such information by the law enforcement for prevention of crimes. This is the typical Urban Naxalite mentality that tries to protect dishonest criminals at the expense of honest citizens.

Acceptance of the objection of the Rights of Law enforcement will weaken the security framework of the country and preserving it is well within the Article 19(2) of the Constitution.

Section 17(2)

Lastly we shall explore Section 17(2). This contains two subsections 17(2)(a) and 17(2)(b) both  need to be discussed in depth.

Section 17(2)(a)

Section 17(2)(a) applies only to “Notified” instrumentalities of the  State  and can only be used

“In the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these,“

This sub section reflect the reasonable exceptions under Article 19(2)  for Article 21 (from which right to privacy is derived).

It is interesting however to see that Article 19(2) states

Nothing … shall …prevent the State from making any law, in so far as such law imposes reasonable restrictions on the exercise of the right conferred ….. in the interests of the sovereignty and integrity of India, the security of the State, friendly relations with Foreign States, public order, decency or morality or in relation to contempt of court, defamation or incitement to an offence

Let us compare the two underlined portions.

It is observed that DPDPA has curtailed the exemptions that were feasible under Article 19(2) substantially. For example, DPDPA has removed exception such as “Decency”, “Morality” and  “Contempt of Court”. Even in respect of “Cognizable offences”, DPDPA restricts the exemptions only to such cognizable offences that relate to “interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order” and not to all cognizable offences.

Hence we cannot find any fault with the Government of having  misused the provisions of Artile 19(2) and has shown extreme restraint in structruing Section 17(2)(a).

I donot see how the petitioners find this as giing “Sweeping powers of surveillance” etc except in their imagination.

Section 17(2)(b)

This sub section addresses the necessity for “Resarch”, “Archiving” and “Statistical Purposes” and has to be seen with the conditions attached to the exemption and the standards of security prescribed under the Rules 16(with Second schedule).

This also has relevance to the arguments of the Reporter’s Collective Trust that exemption has not been provided to the “Journalists” as a category of data fiduciaries.

Firstly we shall see the “Purpose” for which this exemption can be used. This subsection can be used for three aspects namely “Research”, “Archival” and “Statistical Analysis”. But it can be used only where there is no “Decision maling” about the data principal involved. When a research is conducted, the output in the form of a report is generated. It can be used for general understanding of the market and not specifically to take a decision about the individual whose data is being processed.

As an example, when a hospital takes the diagnostic data about a patient, and uses it for diagnosis and delivery of its health services, the  research done for the purpose is for taking a decision about the data  principal. It is not exempt from DPDPA provisions.

The same data may be used to generate a research report about a decease and used for industry analysis not specifically for being used for the data principal. That research can even be done on de-identified or pseudonymised or anonymised data of patients.

Statistical analysis can also be done on anoymised information.

Such processing is exempted from the provisions of the Act.

The Rule 16 reiterates the purpose of archiving and also the  need for security etc.

There does  not seem to be any objection for such Health related research or Financial research where there is no decision making and data is used subject to the  security standards prescribed.

Role of a Journalist and his Research

The  petition of the Reporter’s Collective Trust strongly objects to the category of “Journalists”  not being specifically mentioned in the Act. It ignores the  fact that  even Research for Medical or Financial evaluation is also not specifically mentioned. Use for research by any type of organization whether it is public  or private is covered under Section 17(2)(b). It even covers research by Reporter’s Collective  Trust itself. I hope they have no objection for it.

The case of RTI activist  also  comes under comparable objectives. An RTI activist may conduct a research involving personal data provided it is not required to be used for any decision making against the individual, including filing an objection for a benefit granted by the Government under a scheme or for alleging corruption against the official. If the RTI activist needs to do a research on how a Government scheme is functioning, he can request and work with pseudonymised information or even anonyised information. In such an instance the objections raised under Section 44(3) also become meaning less since the PIO can release data without the personal identity. I am sure that the Government can make arrangements to remove the identity in a set of data to be released subject to cost and time involved.

If a Journalist wants to use any information for a journalistic research, the Act does not bar him from claiming the exemption as long as he can justify that the requirement is for a “Research”. The special case of an “Investigative report” which later becomes a “Disputed defamation” exercise is to be handled as a “Risk for the Investigative journalist”. If he collects data on his own through research without specific consent or legal basis and uses it for developing a report which does not contain any identity of a person, then the report would be considered as not infringing privacy of any person and as long as the personally identified information collected for the research is held confidencial and secure by the journalist, there should be no issue of non compliance of DPDPA and the fines.

It is true that GDPR may make a specific mention of “Journalist” for exemption purpose. At the same time GDPR also speaks of Churches for exemption. India has chosen not to specifically exempt either Journalists not doctors nor advocates nor chartered accountants nor temples, nor chruches  normosques, nor educational institutions nor  madrasses, as an exempted category as of now. The law has specified if the purpose is research, archival, statistical analysis, provison of benefits to the population etc then some exemptions may be available either  under Section 17 or under legitimate use under Section 7.

Indian law is fair and does not discriminate different  kinds of data fiduciaries for this purpose. It only tries to classify some data fiduciaries as “Significant Data Fiduciaries” and imposes additional obligations.

Just as journalists tomorrow objections can be raised by SMEs or Micro enterprises or One man Business entities why they are not provided exemptions etc. The demand by Reporter’s Collective is to introduce a “Discrimination” in the name of “Journalism” which is not warranted.

Further in the modern world of digital journalism, every individual who writes a blog or posts a Youtube video or a Tiktok reel, is a journalist. Why should a journalist registered with the Reporters’s Collective alone be provided a special status? The Intermediary guidelines under ITA 2000 does not spare an  individual blogger from punishment if he violates a law. Hence the concept of “Who is a Journalist” in the digial media era has changed and there is no need to provide a special status to the journalists.

The days when Journalists were considered as the “Fourth Pillar of Democracy” is long lost. Today every journalist is either an employee of a journal or a contractual employee of some publication or George Sorros or a Political party. Hence there is absolutely no reason why “Journalists” should be considered as a special category of Data Fiduciaries and given some exemptions.

For example Naavi is himself a prolific writer and a jounalist and Naavi.org itself is a publication. We have een submitted request for registration under the MeitY scheme of self regulation of digital media. However naavi.org may not have a registration with the Presss Council or the Reporter’s  collective and may not get invitations for Government events or IPL matches.

I therefore consider that the petition of Reporter’s collective claiming extra privileges under DPDPA is not  relevant and must be  dismissed.

Let  us see if what we have expressed here reaches the ears of the Supreme Court or atleast the Meity or the Attorney General. Let us not allow the petitioners to use their selective presentations to mislead the Court.

In summary, I request the Supreme Court to judge DPDPA by what it does and not what it does not do but what petitioners wish  it would do. Let DPDPA stand by its own Karma and not what any RTI activist or a journalist claiming to represent the  public wishes.

Naavi

P.S: I would be  happy to receive any comments… or even counter arguements.

(Joining link: Time 7.30 pm IST)

EU GDPR is now in the 10th year of its existence and an  online conference / workshop entitled “GDPR and its Reflection After 10 Years” has been organized on 3rd March 2026. The  event is co-organized by the Czech Association for Protection of Personal Data (https://www.ochranaudaju.cz/en/who-we-are/), and by the European Federation of Data Protection Officers (https://www.efdpo.eu). A panel discusssion will be  conducted at 7.30 pm IST.

During the discussion the following aspects are likely to be discussed.

• What impact has GDPR had on privacy legislation and application practice in your jurisdiction, if any? Were any changes to your legislation adopted in reaction to the GDPR, what were they and was it a significant change to your laws and practice?
• How were these changes perceived by the public and by businesses?
• What real practical impact did such changes / GDPR have in your country? In your opinion, did they really lead to increased protection of privacy of individuals and their control of data?
• Does GDPR / local legislation compliance represent a competition advantage for businesses – overall and when doing business with EU partners?
• Specific aspects: Georgia an accession country, Switzerland traditionally strong privacy protection, India strong focus on tech and state digitalization
• After ten years, which elements of privacy legislation have from  your point of view proven most effective — and which create disproportionate complexity/administrative burden?
• How has GDPR influenced U.S. privacy developments, particularly state legislation, and federal discussions?
• Do U.S. companies see GDPR as a burden or as a competitive advantage?
• What is their apporach to GDPR compliance – is it real or more on paper?
• Is a comprehensive federal privacy law realistic in the medium term?
• The EU is considering simplification through so called the Digital Omnibus initiative. Are there any simplifications proposals regarding  privacy legislation in progress in your country?
• Application of GDPR/privacy legislation in connection with AI (including training of AI models – what is the prevailing view in your jurisdiction)? What is your personal opinion?
• What should privacy regulation look like by 2035?

Looking forward to an interesting discussion.

Naavi

(This is a continuation of the discussion on the seeking of scrapping of DPDPA and DPDPA rules by three petitioners in the Supreme Court)

Above picture is representative and has been created using Nanobanana AI tool

The petitions from the Scrap DPDPA Brigade in Supreme Court refers to DPDPA 2023 and the Rules as not being in conformity with  the famous K S Puttaswamy Judgement of the Supreme Court of 24th August 2017.  (KSP judgement)

The essence of the decision in the case of KSP was that

“Privacy is a fundamental Right under the constitution and is part of  Article 21 of the Constitution subject to the reasonable restrictions under Article 19(2). “

The bench however did not define Privacy nor gave any restrictive boundaries to the Right to privacy whether it is restricted to Information Privacy. It however extensively noted the risks related in information privacy. In its directions, it stopped at stating that the Right is part of the fundamental Rights and parts of M P Sharma judgment and Kharaksingh judgement  are over ruled.

The KSP judgement  did not further gave any order to the Government to pass any statutory law to protect the Privacy Rights of Indian population. Hence the statement of the petitioners in the Reorter’s Collective Trust that “DPDPA Act and Rules are in complete conravention of the law laid down in the KSP judgement” is incorrect.

Before this judgement was out, the Government had already formed the Justice Srikrishna Committee which went on to give its report in 2018 which after several iterations became DPDPA 2023.

DPDPA 2023 was under no obligation to define “What is Privacy” and “How the Government Protects Privacy”. Hence the Government chose to restrict the law as “Law for protecting the personal data” and went on to define personal data.

Privacy in India is therefore protected by the Constitution directly and DPDPA 2023 facilitates the Data Principal to protect his privacy by protecting his personal data with the deterrance mentioned in DPDPA 2023.

The Government also adopted a strategy different from GDPR and laws of other countries by designating the entity determining the purpose and means of processing of personal data as a “Data Fiduciary” placing on them the onus of understanding what the data principal wants and carry out  his permissions. Hence Consent was the backbone of the law.

Since Article 19(2) prescribed the reaasonable exceptions, Government also recognized “Legitimate Uses” under Section 7 and Exemptions under Section 17. Both Sections 7 and 17 are applicable to both the Government and the Private Sector. Some of the exemptions are partial exemptions. Legitimate use is conditional.

The only blanket exemption is related to some of the aspects of the Article 19(2).  Even here, all exemptions available under Article 19(2) have been invoked. Government has been very conservative.  Also 17(2) is applicable to only such instrumentalities of State which are notified. Unless an entity is notified, the exemptions are not applicable even for the approved purposes such as the interests of soereignity and integrity of India etc

To call this provision as “Attempt for Mass Surveillance”,, “Excessive”, “Disproportionate” etc… is false.

The Call for scrapping of DPDPA is atrocious. DPDPA tries to make Data Fiduciaries responsible and not indulge in indiscriminate harvesting of personal data, use it for spamming, profiling etc. The industry is interested in monetizing the  personal data of individuals without a fair compensation to the data principals.

DPDPA is expected to put an end to the obnoxious practice of Corproates stealing personal data without proper consent and enriching by their use. While DPDPA may not fully prevent the woes of the public from being targetted with Spams, Use of darak patterns to manipulate purchase decisions, use of techniques to change the freedom of mental decision making through mind bending communciation strategies, it has given a hope to public that things may move in that direction.

The penalties at levels of Rs 250 crores are one of the higehst in India but are no where near the international norms at 4% of global turnover to 10% of national trurnover etc. The penalty structure under DPDPA does not mandate either Rs 50 crores or Rs 250 crores. It leaves the discretion to DPB to determine the  penalty taking into account the capacity of the data fiduciary to pay. There is also a voluntary undertaking provision where penalty can be waived.

Without properly reading the law the petitioners make unsubstantiated statements including that  journalists cannot pay the fine of Rs 250 crores and  hence the law is unconstitutional.

This is an attempt to misrepresent the law.

The petitioners seem to place “Journalists” as if they are above law. Journalism has a public purpose and today most of the journalists are not the committed journalists of the yesteryear. They are underinfluence of money bags and politicians. Hence giving an unfettered freedom to them is a danger to the society.

Remember, Even Hindenberg can claim to be a “Research organization” as much as any other journalist.

Journalists who are also lawyers are persons who normally use RTI information for purposes other than public good. Even the NGOs they represent are often funded by international orgnaisations and protect the interests of their foreign  bosses more than Indian public.

We therefore seriously question the credibility of the petitioners who ought to declare their sources of revenue.

Bar Association also has to ensure that members of the Bar donot claim to be “Registered Journalists” and  claim the benefits of the so called “Freedom of Speech” etc. This is a disguised attack on the society.

The NGOs headed by lawyers who say they are representing public interest should not be allowed by the Supreme Court to file PIL without proper scrutiny.

I wish the Supreme Court prevents the gross abuse of the PIL privilege used as a weapon against progress.

Lawyers are considered as officers of the Court but we wonder  if they are more officers of vested interests  often guided by commercial or politial considerations using the Court as a play ground for meeting their objectives outside the Court.

Otherwise it does not make sense for any of the petitioners to ask for scrapping of DPDPA just to  ask for some exemptions for the profession of their clients.

The petitions  filed should therefore not  be considered as PILs. They are petitions filed on behalf of the clients like an association of journalists or an association of RTI activists.

The real public advocacy champions are not capable of matching the expenditure required to fight their passions in the Supreme Court and have to  often remain in the background. The Court should recognize this and bring such organizations forward and listen to their advice.

The concers related to Section 44(3) or 17(2)(b) are easily addressable in the rules and have already been addressed. The petitioners donot want to see through the provisions with an open mind and are ascribing motives to every word in the Act and the Rules without justification.

It is our desire that the honourable Supreme Court does not allow such pseudo public interest champions misleading the Court through their oratory and professional standing.

Naavi