Last Date For submission of Public Comments on DISHA 2018

Posted on April 21, 2018 by Vijayashankar Na

DISHA 2018 is the proposed law for India applicable to the Privacy and Data Protection related to the Health Care sector in India.

The IT industry is in the midst of discussion on GDPR and how it will impact Indian Companies. At the same time, the Srikrishna Panel is also due to submit its recommendations on the General  Data Protection law in India.

Behind all these developments, there is already ITA 2000/8 which defines Personal Data, Sensitive Personal Data, the responsibilities of protecting the Confidentiality, Integrity and Availability of “Data”, “Personal Data” and “Sensitive Personal Data”, defines penalties, the dispute resolution mechanism etc.

Unfortunately each Ministry of the Government wants to have a separate law for itself addressing Data Protection in its own domain.  This multiplicity of laws is unlikely to benefit the people and will increase the cost of Administration enormously.

Today is the last day for submission of comments by the Public on DISHA 2018 or the “Digital Information Security in Health care Act 2018”. Public comments are expected to be provided before April 21, 2018 to be sent to egov-mohfw@nic.in .

In order to enable stake holders to form their views and forward to the ministry, Naavi  has provided his own immediate views on the proposed 45 section draft legislation in the form of the following articles.

  1. DISHA 2018- Proposed Health Information Security Act in India
  2. Consequences of Health Data Breach under DISHA 2018
  3. Data is a Property owned by the Data subject under DISHA 2018
  4. New Regulatory Agencies under DISHA 2018

There are also some articles posted on www.privacy.ind.in on GDPR and Srikrishna Panel 

Readers may peruse these articles and send their own comments to the Health Ministry on DISHA 2018.

It is our firm belief that “Data Protection” requires a comprehensive regulation for multiple sectors and there has to be an “Umbrella Law” that is supported by “Sectoral Security Standards”. ITA 2000/8 already has the concept of “Reasonable Security Practice” with flexibility for sectoral regulators to define their own standards.

It is therefore redundant to have multiple Data Protection Legislations leading to multiple Data Protection Authorities, Officers, Committees, Chairpersons etc. Such sectoral laws will be unproductive and create conflicts.

If Mr Modi Government believes in Minimal Governance and Best use of technology, there is a need to complete re-think on the approach to such sectoral laws, sectoral CERTs etc. These suggestions are created by Bureaucrats who think all legislations are for the benefit of creating new organizations and bloating up the Government expenditure and the law is only an excuse.

Public donot relish such approach. These laws only increase the cost of administration and also create corruption centers in the country. They donot bring proportionate benefit to the public.

I look forward to the right thinking persons in the Modi Government to give a thought to the above comment and proceed with such duplicate legislations.

At a time Mr Modi is considering the National Health Mission which is a huge political and financial investment, having an efficient organization to back it up in terms of legislation and authorities is considered necessary. But what we need to consider is whether “Medical Data” is also “Data” which is already addressed by the ITA 2000/8 and Data Protection Act (Srikrishna panel) and whether we can merge these proposed legislations into one existing legislation which should ideally be the “Information Technology Act 2000 as amended in 2008 and to be further amended in 2018”.

We can then have  one State level Adjudication Authority, One Central Level Adjudication Authority for Data in general and one Data Protection Authority supported by sectoral standard committees and sectoral CERTs.

If this basic concept is accepted, we may have to re work on DISHA 2018 and substitute it with one chapter on Health Data Security in ITA 2000/8 (with some changes in Adjudication and Appellate Tribunal aspects of ITA 2008 which could be as suggested under DISHA 2018).

I hope a reasonable thought is given in this direction also.

Naavi

 

Posted in Cyber Law | Tagged | Leave a comment

New Regulatory Agencies under DISHA 2018

Posted on April 21, 2018 by Vijayashankar Na

DISHA 2018 is the proposed law for India applicable to the Privacy and Data Protection related to the Health Care sector in India. At a time there is discussion on GDPR all around the industry and anticipation of the Justice Srikrishna Committee’s recommendation on the General Data Protection Act for India, DISHA 2018 has been proposed by the Health Ministry in a draft form for public comments. The Act is likely to be named as “Digital Information Security in Health care Act 2018”. Public comments are expected to be provided before April 21, 2018 to be sent to egov-mohfw@nic.in .

In order to enable stake holders to form their views and forward to the ministry, Naavi is providing here his own views. I suppose this would be helpful in triggering thoughts in others to send their own comments.

…..Naavi

This is the continuation of the earlier article on this subject

 Any new legislation brings with it a proposal for creating new regulatory authorities and new executive positions for influential Delhi bureaucrats often unmindful of the costs involved and the inefficiency which the multiplicity of regulatory authorities breed. DISHA 2018 is not an exception to this. In the light of the action taken in the last budget to abolish some Tribunals such as the Cyber Appellate Tribunal, at some point of time, the authorities created by one law may get abolished for some reason or the other. Some times authorities get created but there will be no activity.We have seen this happen with the Adjudicating authorities under ITA 2000.

Despite this experience, DISHA 2018 also tries to create many authorities for regulation of the proposed act.

The first such authority is the National Electronic Health Authority of India (NeHA). A Chairman assisted by a board of representatives from different ministries and some ex-officio members would constitute NeHA.

NeHA will be assisted by a “National Executive Committee”  with more members from the Bureaucrats.

These  regulatory body will be supported by the “State Electronic Health Authority” and  “State Executive Committee” creating more jobs for bureaucrats in all the States and Union Territories.

These bodies will then appoint there own staff, invest in Building, Cars, Hefty Salaries and Pensions all at the expense of the tax payer’s money increasing the cost of living.

Whether these regulatory bodies are aware of IT, aware of IT Security, aware of Data Protection etc., will be the last consideration.

Adjudicators

Similarly, for Dispute resolution, State and Central Adjudicating authorities have been proposed.

For breach of digital health data by a clinical establishment or any entity an aggrieved person or owner may complain to the State Adjudicatory Authority

For breach of digital health data by a health information exchange or State Electronic Health Authority or the National Electronic Health Authority of India, an aggrieved person or owner may complain to the Central Adjudicatory Authority

The Adjudicating authorities will be a multi member body and consist of a Chairperson and two other members which is welcome since our experience with the Adjudicating Authorities under ITA 2000 had thrown up the need for such multi member body. Central Adjudicating authority will also be the appeal authority against the orders of the State Adjudicating authorities.

Appeal from the Central Adjudicating authority will go to the High Court.

Otherwise the Adjudicating authorities will be like in the case of ITA 2000, authorities which will not be required to be bound by Civil Procedure Code.

No specific compensatory limit is also indicated in the proposed Act.

However, no civil court shall have jurisdiction to entertain any suit or proceeding in respect of any matter which the Central Adjudicatory Authority or the State Adjudicatory Authority is empowered by or under this Act to determine and no injunction shall be granted by any court or other authority in respect of any action taken or to be taken in pursuance of any power conferred by or under this Act.

We need to await the detailed procedural notification at a later stage for more details on the functioning of the Adjudicating authorities and the appointment of people for the different positions in the Adjudicating authorities.

If two successive Governments at the Center were unable to find a Chair Person to the Cyber Appellate Tribunal since 2011 and the Ministry of Mr Arun Jaitely decided to merge the tribunal as a solution with another Tribunal unmindful of the consequences on the society, we need to observe how the proposed Adjudicating authorities under this Act would be set up.

If there was lack of work for Cyber Appellate Tribunal under ITA 2000, will there be sufficient work with these tribunals? or can these tribunals can also handle the ITA 2000 complaints, will be questions to which answers may be expected from the Government.

Naavi

Posted in Cyber Law | Leave a comment

Data is a Property owned by the Data subject under DISHA 2018

Posted on April 21, 2018 by Vijayashankar Na

DISHA 2018 is the proposed law for India applicable to the Privacy and Data Protection related to the Health Care sector in India. At a time there is discussion on GDPR all around the industry and anticipation of the Justice Srikrishna Committee’s recommendation on the General Data Protection Act for India, DISHA 2018 has been proposed by the Health Ministry in a draft form for public comments. The Act is likely to be named as “Digital Information Security in Health care Act 2018”. Public comments are expected to be provided before April 21, 2018 to be sent to egov-mohfw@nic.in .

In order to enable stake holders to form their views and forward to the ministry, Naavi is providing here his own views. I suppose this would be helpful in triggering thoughts in others to send their own comments.

…..Naavi

This is the continuation of the earlier article on this subject

DISHA 2018 brings in an important concept to the Data Protection legislation for the first time by declaring that “Data is the Property of the Data Subject”.

Under the proposed Clause 31 of the Act, it is stated:

(1) The digital health data generated, collected, stored or transmitted shall be owned by the individual whose health data has been digitised;
(2) A clinical establishment or Health Information Exchange shall hold such digital health care data referred to in sub-section (1) above in trust for the owner;
(3) Any other entity who is in custody of any digital health data shall remain the custodian of such data, and shall be duty bound to protect the privacy,confidentiality and security of such data;
(4) Notwithstanding anything stated in the above sub-sections (1) to (3), the medium of storage and transmission of digital health data shall be owned by the clinical establishment or health information exchange, as the case may be.

Under Section 3(e) Digital Health Data is defined as follows:

(e) ‘Digital Health Data’ means an electronic record of health related information about an individual and shall include the following:

(i) Information concerning the physical or mental health of the individual;
(ii) Information concerning any health service provided to the individual;
(iii) Information concerning the donation by the individual of any body part or any bodily substance;
(iv) Information derived from the testing or examination of a body part or bodily substance of the individual;
(v) Information that is collected in the course of providing health services to the individual; or
(vi) Information relating to details of the clinical establishment accessed by the individual.

It is interesting to note that the “Ownership” is limited to the Digital Health Data and may not extend to the “Personal Data”.

The implication of this provision is that a patient can demand that any health data collected about himself is his property and must be handed over to him. Being a “Property”, the legal heirs will also have a right if the patient is not alive.

This definition should have effect on cases such as J Jayalalitha’s health records which now become the property of the legal heirs of jayalalitha. The Hospitals cannot hide the data under non existent “privacy” considerations of a deceased individual.

The rights of the owner of digital health data is defined under Section 28 as under:

(1) An owner shall have the right to privacy, confidentiality, and security of their digital health data, which may be collected, stored and transmitted in such form and manner as may be prescribed under this Act.

(2) An owner shall have the right to give or refuse consent for the generation and collection of digital health data by clinical establishments and entities, subject to the exceptions provided in Section 29 of this Act.

(3) An owner shall have the right to give, refuse or withdraw consent for the storage and transmission of digital health data.

(4) An owner shall have the right to refuse consent to the access or disclosure of his or her digital health data, and if refused it shall not be disclosed, subject to the exceptions provided in Section 33 of the Act.

(5) An owner of the digital health data shall have the right that the digital health data collected must be specific, relevant and not excessive in relation to the purpose or purposes for which it is sought;

(6) An owner of the digital health data shall have the right to know the clinical establishments or entities which may have or has access to the digital health data, and the recipients to whom the data is transmitted or disclosed;

(7) The owner of the digital health data shall have a right to access their digital health data with details of consent given and data accessed by any Clinical Establishment/Entity;

(8) The owner of the digital health data shall have, subject to sub-section (1) to (3) above:

(a) The right to rectify without delay, from the respective clinical establishment or health information exchange or entity, any inaccurate or incomplete digital health data, in the prescribed form as may be notified by the National Electronic Health Authority;

(b) The right to require their explicit prior permission for each instance of transmission or use of their digital health data in an identifiable form, through such means as may be prescribed by the Central Government;

(c) The right to be notified every time their digital health data is accessed by any clinical establishment within the meaning of Section 34 of the Act;

(d) The right to ensure that in case of health emergency, the digital health data of the owner may be shared with their family members;

(e) The right to prevent any transmission or disclosure of any sensitive health related data that is likely to cause damage or distress to the owner;

(f) The right not to be refused health service, if they refuse to consent to generation, collection, storage, transmission and disclosure of their health data;

(g) The right to seek compensation for damages caused by a breach of digital health data.

There is a streak of GDPR in the above provisions. What attracts notice is Section 28(f) which states that a person has the right not to be refused health service if they refuse to consent to generation, collection, storage or transmission or disclosure of their health data.

How is it possible for a health establishment to provide health service without say conducting a blood examination is a matter that will be intriguing for the hospitals if the consent is refused.

In order to protect the rights of the Digital Health Data Subject, the principles of purposeful collection (Section 29), Lawful collection (Section 30), Secured storage (Section 32), Secured Transmission (Section 33), Access provision (Section 34), Recitification option (Section 36) etc.

Section 35 imposes all the liabilities under Information Security Management because it states

35. Duty to maintain privacy and confidentiality of digital health data

(1) A clinical establishment, health information exchange, State Electronic Health Authority and the National Electronic Health Authority, shall be duty bound to protect the privacy, confidentiality, and security of the digital health data of the owner;

(2) Any other entity, which has generated and collected digital health data, shall be duty bound to protect the privacy, confidentiality, and security of the digital health data of the owner.

(3) The privacy, confidentiality and security of digital health data shall be ensured by taking all necessary physical, administrative and technical measures, that may be prescribed or specified, to ensure that the digital health data, collected, stored and transmitted by them, is secured and protected against access, use or disclosure not permitted under this Act or regulations made thereunder, and against accidental or intentional destruction, loss or damage.
(4) Without prejudice to the above provisions, a clinical establishment or health information exchange shall ensure through regular training and oversight that their personnel comply with the security protocols and procedures as may be prescribed or specified under this act.
(5) A clinical establishment, or a health information exchange, shall provide notice immediately, and in all circumstances not later than three working days to the owner, in such manner as may be prescribed under this Act, in case of any breach or serious breach of such digital health data.

It is clear from the above that the Clinical establishments will have a tough time for complying with DISHA 2018 almost on the lines of GDPR.

Since DISHA is applicable to “Clinical Establishments” which definition [Section 3(i)] includes

-a hospital, maternity home, nursing home,

-dispensary, clinic, sanatorium or an institution by whatever name called offers services, facilities requiring diagnosis, treatment or care for illness, injury, deformity, abnormality or pregnancy in any recognised system of medicines  or

-a place established  in connection with the diagnosis where pathological, bacteriological, genetic, radiological, chemical, biological investigations or other diagnostic or investigative services with the aid of laboratory or other medical equipment are usually carried on

the impact of what it proposes as security is far reaching.

(Discussions will continue)

Naavi

Posted in Cyber Law | Tagged | 2 Comments

Consequences of Health Data Breach under DISHA 2018

Posted on April 21, 2018 by Vijayashankar Na

DISHA 2018 is the proposed law for India applicable to the Privacy and Data Protection related to the Health Care sector in India. At a time there is discussion on GDPR all around the industry and anticipation of the Justice Srikrishna Committee’s recommendation on the General Data Protection Act for India, DISHA 2018 has been proposed by the Health Ministry in a draft form for public comments. The Act is likely to be named as “Digital Information Security in Health care Act 2018”. Public comments are expected to be provided before April 21, 2018 to be sent to egov-mohfw@nic.in .

In order to enable stake holders to form their views and forward to the ministry, Naavi is providing here his own views. I suppose this would be helpful in triggering thoughts in others to send their own comments.

…..Naavi

This is the continuation of the earlier article on this subject

The importance of any legislation is often measured in terms of the penal consequences that would follow if the law is not complied with.  The same logic applies to DISHA 2018 also and hence we need to take a quick look at Chapter V of the proposed legislation that deals with Offences and Penalties.

For the purpose of defining the consequences of non compliance of DISHA 2018, the proposed law defines “Breach of Digital Health Data” along with a term “Serious Breach of Digital health Data”.

As per section 37, Digital Health Data is said to be breached when

a) Any person generates, collects, stores, transmits or discloses digital health information in contravention of the provisions of the Act or

b) Any person who does anything in contravention of the exclusive right conferred upon the owner of the digital health data or

c) Digital health data collected, stored or transmitted by any person is not secured as per the standards prescribed by the Act or any rules thereunder or

d) Any person damages, destroys, deletes, affects injuriously by any means or tampers with any digital health data.

A person who is responsible for such breach shall be liable to pay damages by way of compensation. This is treated as a civil wrong.

A “Serious Beach of Digital health Data” on the other hand is defined  as follows:

(1) A serious digital health data breach shall be said to have taken place, if:

(a) A person commits a breach of digital health data intentionally, dishonestly, fraudulently or negligently; or
(b) Any breach of digital health data occurs, which relates to information which is not anonymised or de-identified; or
(c) A breach of digital heath data occurs where a person failed to secure the data as per the standards prescribed by the Act or any rules thereunder; or
(d) Any person uses the digital health data for commercial purposes or commercial gain; or
(e) An entity, clinical establishment or health information exchange commits breach of digital health data repeatedly;

Explanation: The terms “dishonestly” and “fraudulently” shall have the same meaning as assigned to them under the Indian Penal Code, 1860

(2) Any person who commits a serious breach of health care data shall be punished with imprisonment, which shall extend from three years and up to five years; or fine, which shall not be less than five lakh of rupees.

Provided that, any fine imposed as part of sub-section (2) may be provided to the individual whose data is breached, by the Court, as it deems fit as compensation.

This section is meant to be a section to define offences which may be punished with Imprisonment and Fine and hence should be recognized as a “Criminal Offence”.

The imprisonment under this section is declared as it shall be for a minimum of 3 years and extend upto 5 years and fine is stated as “Shall not be less than Five lakh of rupees”.

The above section  perhaps requires to be better constructed to avoid ambiguities.

Firstly it tries to combine the Criminal penalty with Civil compensation by  providing that the Court may provide compensation by collecting it as a fine. This makes Section 37 redundant since the definition of “Serious Breach of Digital Data” under Section 38 differs from Section 37 only with the addition of “Intention” and “Dishonesty” etc.

Also since the separator “Or” has been used to separate sub sections 1(a) to 1 (e), it appears that “Any Breach of identifiable digital health data” would come under Section 38 with or without dishonesty or malicious intention.

Further 37 (1) (a) has included the term “Negligently” along with “Intentionally”, “Dishonestly” and “Fraudulently”.  This has mixed up criminal intention with “negligence” and “Negligence without Criminal Intention” can be a grey area under this section.

Under (1) (c), breach of data for failure to secure it has also been defined as a serious breach inviting imprisonment and fine. Considering that the punishment can be for a minimum imprisonment of 3 years and fine of Rs 5 lakhs, and “Security” being as ambiguous as it can be, it is difficult to accept the section as it is now drafted as a fair drafting.

The other two actions that can invoke punishment under this section is “Use of digital health data for marketing” and “Repeated breach by a clinical establishment”.

These offences also need to be qualified properly.

Overall, Section 38 is not properly drafted and has to segregate the “Motive”, “Action”, “Consequence” of an action that is defined as an offence before indicating the punitive measures.

Section 39 is again an extension of Section 38 offences to the domain of civil compensation and overlaps both with Sections 37 and 38.

Section 40 of the proposed Act prescribes fines for administrative delay for furnishing of information or document or boos, returns or reports that may be specified. The fine may extend to Rs 1 crore.

Section 41 states that

“Whoever, fraudulently or dishonestly, obtains the digital health information of another person, which he is not entitled to obtain under the Act from a person or entity storing such information shall be punished with imprisonment for a term which shall extend up to one year or fine, which shall be not less than one lakh rupees; or both.”

This addresses the cases of “Digital Impersonation” for which ITA 2000/8 already prescribes 3 years imprisonment.

Additionally, under Section 42, “Data Theft” has been defined as an offence that can result in imprisonment for 3 to 5 years. The section states as under.

“Whoever intentionally and without authorization acquires or accesses any digital health data shall be punished with imprisonment for a term, which shall extend from three years up to five years or fine, which shall be not less than five lakh rupees; or both.”

Section 43 speaks of “Cognizability” and again is ambiguously drafted.

It says that ” No Court shall take cognizance of any offence punishable under this Act or any rules or regulations made thereunder, save on complaint made by the Central Government, State Government, the National Electronic Health Authority of India, State Electronic Health Authority,” but adds “Or a person affected”.

This means that on the basis of a complaint made by the person affected, cognizance can be taken irrespective of the term of imprisonment etc.

This may not be acceptable to the Criminal judicial system.

Section 44 extends the offences which can be attributed to the Company to its executives as under Section 85 of ITA 2000/8.

Overall, it appears that the offensive sections are loosely drafted and need to be tightened substantially before becoming the law.

Perhaps when the draft goes to the Law Ministry, it has to be revised thoroughly.

(To Be continued)

Naavi

Posted in Cyber Law | Tagged | Leave a comment

DISHA 2018- Proposed Health Information Security Act in India

Posted on April 21, 2018 by Vijayashankar Na

DISHA 2018 is the proposed law for India applicable to the Privacy and Data Protection related to the Health Care sector in India. At a time there is discussion on GDPR all around the industry and anticipation of the Justice Srikrishna Committee’s recommendation on the General Data Protection Act for India, DISHA 2018 has been proposed by the Health Ministry in a draft form for public comments. The Act is likely to be named as “Digital Information Security in Health care Act 2018”. Public comments are expected to be provided before April 21, 2018 to be sent to egov-mohfw@nic.in .

In order to enable stake holders to form their views and forward to the ministry, Naavi is providing here his own views. I suppose this would be helpful in triggering thoughts in others to send their own comments.

…..Naavi

DISHA 2018 has been structured into the following 7 Chapters:

I: Preliminary

II: National Electronic Health Authority

III: Powers and Functions of the National and State Authorities

IV: Data Ownership, Security and Standardization

V: Digital Health Data Breach and Consequences

VI: Adjudicating Authority

VII: Miscellaneous Provisions

Schedule I: Personally Identifiable Information

Geographical Applicability 

Let’s start with the Preliminary Chapter that states that this law extends to the whole of India except the State of Jammu and Kashmir.

Since ITA 2000/8 is a law that also applies to J&K and it has provisions that state that Health Information is sensitive personal information and it has to be protected in a certain manner, that provision will continue to apply to J&K. In other areas there could be some overlap of regulations between ITA 2000/8 and this law when it becomes effective.

Personal Information

The definition section is Section 3 and it requires a detailed discussion. Before we get into the definitions under Section 3, we can first have a look at the Schedule I which lists certain parameters as “Personally Identifiable Information”. (PII)

The listed parameters that would be considered as PII are

  1. Name
  2. Address
  3. Date of Birth
  4. Telephone Number
  5. Email Address
  6. Password
  7. Financial Information such as Bank account or credit card or debit card or other payment instrument details
  8. Physical, Physiological and Mental Health Condition
  9. Sexual Oritentation
  10. Medical Records and Histrory
  11. Biometric Information
  12. Vehicle Number
  13. Any Government number including Aadhaar, Voter’s Identity, Permanent Account Number (PAN), passport, Ration Card, Below Poverty Line (BPL) card

Compared to the HIPAA identifiers, there appears to be an omission of E Mail Address,  IP Address, IMEI Number, SIM number (unless telephone number can be interpreted also as mobile number). Also Age is not included and Address as a whole is included and there is no exemption for address at higher level as in HIPAA.

There is an additional definition under Section 3(o) which defines “Sensitive Health Related Information” namely,

(o) ‘Sensitive health-related information’ means information,

that if lost, compromised, or disclosed, could result in substantial harm, embarrassment, inconvenience, violence, discrimination or unfairness to an individual,

including but not limited to, one’s physical or mental health condition, sexual orientation, use of narcotic or psychotropic substances, consumption of alcohol, sexual practices, Human Immunodeficiency Virus status, Sexually Transmitted Infections treatment, and abortion.

This appears to be a departure from the other legislations where “Personal Information” is defined in general terms and some types of Personal Information are defined as Sensitive Personal Information (SPI). This approach has been used in ITA 2000/8 as well as in GDPR.

It is interesting to note that DISHA 2008 has defined “Sensitive” nature of PI in the context in which the breach could cause “Substantial” harm.

The interpretation of the word “Substantial” would be subject to debate as it happened when the Supreme Court discussed Section 66A of ITA 2008 and interpreted that the term “Grossly Offensive” was vague. But this judgement was prompted by other considerations and should be considered as an aberration.

On the other hand, “Personally Identifiable Information”   as per Section 3(k) means any information that can be used to uniquely identify, contact or locate an individual, or can be used with other sources to uniquely identify a person, and includes the information stated in Schedule I.

Hence the suggestion that “Data” is Data under all circumstances and it becomes “Sensitive” in certain circumstances is welcome.

Entity 

The Act defines a “Clinical Establishment” as well as the term “Entity”. Both the definitions include all types of or organizations including individuals, Trusts, private and public establishments, Hospitals, diagnostic centers, pathological laboratories, radiology laboratories etc. Only the establishments owned by armed forces are exempted from this definition.

As a result of this approach, the scope of this proposed Act will have a very wide impact in the Health Care industry.

……To Be Continued

Naavi

Posted in Cyber Law | Tagged , | Leave a comment

The tragedy of Shafhi Mohammad judgement

Posted on April 19, 2018 by Vijayashankar Na

“This erroneous interpretation of the bench will directly result in honest persons being harassed by dishonest persons” …. Naavi

The honourable Supreme Court in its order dated 3rd April 2018 pronounced its final order on the Special Leave Petition (SLP 2302 of 2017) regarding the use of videography including body cameras in crime scene evidence capture. There was an earlier interim order of 30th January 2018  on the same SLP which had elaborated more on the issue of Section 65B of Indian Evidence Act.

The order indicates that the Supreme Court wanted to allow such videography and tried to manufacture an acceptable argument to reach a preconceived conclusion. This tendency was earlier seen in the Shreya Singhal case where Section 66A of ITA 2008 was scrapped and also in the Puttaswamy case on Privacy. In all these cases, the Judiciary has come out in poor light as trying to fit its logic to a pre conceived decision. In the process, the judgement creates some untenable and undesirable consequences.

In the Section 66A scrapping, the SC was adamant that it cannot “Read down” the section and nothing short of scrapping it would be acceptable to it. In the Privacy judgement, it was an attempt to rush through a judgement to influence another judgement. Now this Shafhi Mohammad judgement falls into the same category.

In a bid to allow such videography, the two member bench has tried to bend the law in a manner that is highly detrimental to the society and could lead to corruption in judiciary and harassment of innocent citizens by powerful and more intelligent evidence manipulators.

It is not our argument that body cameras and police TV footage should not be used as evidence. In fact these and much more of technology is to be used and is aleady being used.

However, we have a serious objection to the attempt of the two member bench to re-interpret the law as it exists and in derogation of a three member speaking order in the case of P V Anvar Vs Basheer.

The Indian Evidence Act 1872 (IEA) was amended when ITA 2000 was notified and one of the major changes that was brought about  was the introduction of Section 65B for “Admissibility of Electronic Evidence”. This has to be read with Section 65A, Section 22A, Section 17 and Section 3 of the same Act.

Section 65B of IEA is one of the most innovative aspects of ITA 2000/IEA and the Court has failed to recognize the purpose and scope of the section before jumping into passing an order which is bad in law and bad for the community.

The problem which the Police had in using the Videography as evidence was that the videography was captured in some camera and the first copy would be recorded in the device memory which could be the hardware or the removable media. It is then transferred to the Police in the back room and subsequently viewed, edited and presented as evidence in a Court.

In this scenario, if Section 65B was followed, then some body in the Police should have taken the responsibility to give a Section 65B certificate which would pin him down against any manipulation of the evidence.

The Court conveniently ignored  that Section 65B was about presenting a “Computer Output” of an electronic document which may be present either in a camera device or on a server or on a removable media such as a pen drive or memory card. The only requirement was that the Certifier had to take the responsibility to state how he was able to view the document in his computer and how he was able to produce the computer output (say a print out).

Section 65B does not require the lawful owner of the first device which created an electronic impression (sequence of zeros and ones) of an event to either himself give the evidence in the Court. It would suffice if he hands over a memory card to the Police repository in charge with a standard form which identifies the memory card along with a hash value of the entire set of bits and sequences contained there in such as “Videograph of day …. in camera ….) and a signed covering letter. This form of handing over the recorded removable device can be standardised and is not complicated.

Subsequently it is the responsibility of the repository in charge to create clones and copies as may be required along with his own Section 65B certificate. The forensic expert may actually extract much more information than what is visible by using his own tools and he  can provide his findings with his own Section 65B certificate. Similarly if there is a need to edit the video, there is no bar on it under Section 65B except that it has to be recorded as a process in the Certificate. For example if the video is of one hour duration between say 20.30 and 21.30 on 17th April 2018, the edited version may be video between 20.55  to 21.10 and it can be stated as such in the certificate.

What the Court has done now is to say that “No Certificate is required under Section 65B when the electronic document is presented from a device not owned by the person presenting the evidence”. Police can conveniently say that they engaged the services of a free lance video grapher and the camera belonged to him and hence no certificate is required for whatever the Police present.

Even if the evidence is manipulated, there is no responsibility fixed on any body in the absence of the Certificate.

In the same manner, when an electronic document lies on a server not owned by the person it can be manipulated and presented as evidence and the Court has to admit the evidence and ask the defendant to prove that the evidence is wrong.

If therefore some body hacks into a web server, downloads a document, makes changes and captures it, then goes onto to delete the document on the server, he will be in possession of a doctored document which can be produced as evidence which will be automatically admitted. Then it will be the burden on the defendant to prove that the version presented to the Court is fake. This can also happen in WhatsApp messages and Social media where fake documents can be created, captured as uncertified evidence, destroyed in original form and uncertified copy presented to the Court which the Court has no option but to admit.

I would like the two honourable Judges to confirm if they have considered the above scenario before boldly declaring that they would clarify that Section 65B is only a procedural requirement which they consider as redundant in some cases. If they have not, it is necessary for them to review their own decision rather than creating a bad law which exposes the ignorance of the Judiciary.

I accept that the Government has the power to change the law and can even scrap the entire Sections 65A and 65B if they want. But as long as they exist, they exist as independent sections and as the three member bench in the Basheer case rightly observed, it is a special provision applicable for electronic documents and over rides the provisions of Sections 62,63 and 65.

It is therefore incorrect to interpret

” The applicability of procedural requirement under Section 65B(4) of the Evidence Act of furnishing certificate is to be applied only when such electronic evidence is produced by  person who is in a position to produce such certificate being in control of the said device and not of the opposite party.”

It is also incorrect to interpret

“In a case where electronic evidence is produced by a party who is not in possession of a device, applicability of Sections 63 and 65 of the Evidence Act cannot be held to be excluded. In such case, procedure under the said Sections can certainly be invoked. If this is not so permitted, it will be denial of justice to the person who is in possession of authentic evidence/witness but on account of manner of proving,”

In fact

“This erroneous interpretation of the bench will directly result in honest persons being harassed by dishonest persons”

In fact

“This erroneous interpretation will pave the way for a high level of Judicial corruption because it provides the discretion to the Judiciary to accept evidence without any body taking responsibility for its existence”

In fact

“This erroneous interpretation will place all web place all web based documents admissible without any person taking the responsibility for stating how it was seen and recorded.”

In fact

“This erroneous interpretation will create more rogue judgements where the lower courts will order against the higher courts by way of clarification”

It is therefore essential that the bench immediately reviews its own order and state nothing beyond, that

“The Supreme Court reserves the right to accept electronic evidence without Section 65B evidence in such cases as it deems fit after a necessary examination”

The MHA should get back to the bench for the review as otherwise the MHA under Mr Modi’s Government will be accused of having manipulated the Judiciary to pave the way for Police to file uncertified fake videos as evidence.

Naavi

(This article is a continuation of this previous article)

Posted in Cyber Law | Tagged , | 2 Comments