Naavi.org

There is one section of the media commenting on Cambridge Analytica which is strongly critical of the developments in the Cambridge Analytica incident that Digital marketing agencies are manipulating public opinion through campaigns designed by profiling the voters. In the context of the forthcoming election in Karnataka, it is being stated that some Digital marketing companies are engaged in an unethical activity of trying to change the mindset of the voters.

In these discussions, the media has been completely hypocritical and their bluff needs to be called. Every marketing activity in the world is changing the decision of the target audience to take a favourable decision about a product. Marketing per-se is therefore a legitimate activity. In Marketing or Advertising  however we make a distinction between “Ethical” and “Unethical” communication.

If the Advertiser is making false propositions through his advertisement, it is unethical and fraudulent and needs to be condemned. But if the advertiser is using a creative communication to make the target audience believe that the product being marketed is beneficial to him because it has some features , X,Y, Z, then it is perfectly legitimate.

Similarly, in the election advertising, what we the citizens as well as the Election commission has to see is whether the message used in the advertisement is true, false or utterly false and misleading.

As regards profiling, it is for the marketing agencies to use their own analysis of the data available to them to decide what communication is good for a given audience. If this is called “Profiling”, it is nothing but “Market Segmentation”.

Hence the objections to the profiling activities of Digital marketing Companies is misplaced since the same objections can be placed on every other advertisement including the advertisement for a chocolate or for IPL.

Another major objection I have for media talking about “Trying to manipulate the voter’s mind” through advertising by digital media marketers is to ask a question to these media gurus whether journalism is nothing but creating “opinions” and “Changing opinions”?.

Every media article is written with the objective of conveying an opinion. The days of “Factual Reporting” which was happening in Government controlled AIR and DD in the past is no longer there.

Most TV news today is about “Debates” in which different political parties speak to support their own political agenda and the Anchors provide opportunities for spokespersons to speak lies after lies in the interest of “Balancing” the debate. Depending on the Anchor’s own prejudice, they add to the lies. The entire debate is therefore only directed towards forming a public opinion and there is no ethics in TV journalism today.

In the Karnataka election, Rahul Gandhi speaks of “Being against Corruption” and “Being Religious”. Is there a greater joke than such statements?. The journalists of all hue and cry talk as if these statements deserve to be publicised in TV and not censored straight away by the anchor at the debate table.

If journalists want to complain about Digital Marketing and “Tampering with the voter’s mind” then they should first stop the false campaigns they make on TV debates with the hope that some of the audience will get converted.

But what these journalists donot understand is that public are intelligent and they can see through the statements of the politicians immediately. Most debates therefore are a waste of time and audience are either not listening or listen selectively.

I therefore urge that media should think of changing their debate style and eliminate all political spokespersons from the debate and stick to discussion of issues by professionals who can comment on the issue irrespective of whether it is advantageous to one political party or the other.

The election commission should see how they can regulate these debates in which false statements are made  deliberately and maliciously. These are worse than advertisements and should be stopped on ground of “Ethics” as well as “Fraud” on the voters.

Will the election commission be fair  Will the Journalists be honest in this respect?

Naavi

The “Privacy laws” as they are emerging in the world are more intended to protect the community of those who want to hide their identity and commit crimes against the society than protect the honest citizens from Governmental surveillance or spamming by commercial advertisers.

The risk in Government surveillance is not so much from the fact that the Government of the day knows too much about its citizens in a Privacy Un-protected world but some political elements would misuse the information for personal gain and for harassing the honest citizens.

If in US we are against Donald Trump, we would not like the US Government to know what is my political affiliation and what underground work I am doing to ensure that Mr Trump does not win the next election. In India, if I am Black Money holder, I would like to do everything to ensure that Aadhaar is not linked to my Bank accounts and argue that such an attempt is privacy invasion. If Congress was in power, I would have been comfortable since I could hold any amount of black money as long as I take care of the politicians.

Most privacy activists may take a public stand as if they are the guardians of democracy but beneath their desire for absolute Privacy Protection, there is an ulterior motive to being able to continue their activities which the society may not like.

We need to give up this hypocrisy and admit that what we need is a protection against misuse of information by politicians for which checks and balances should be built rather than preventing Big Data Processing for profiling of certain activities.

Now with the advent of “Right To Erasure”, GDPR holds out a great threat to the society by erasing vital information that is actually intelligence about potential terrorist activities.

I donot foresee any possibility of a terrorist to give consent in any form to let his activities be monitored either by Google or Face Book or the law enforcement. Whether a terrorist has made a recce trip to survey his target or is trying to campaign for radicalization of innocent friends on the Face Book etc become unavailable for intelligence gathering. Terror sleeper cells will therefore consider 25th May 2018 as a day of “Freedom from Oppression from Counter terrorist activities”.

It is to be expected that terror organizations operating from the EU zone will have an umbrella of protection from surveillance. Some of their activities may be directed towards the non EU countries and hence EU may become a haven for terrorists from which global terror activities would be planned and executed.

However, in due course, as terrorists take shelter in EU, it would be the EU countries themselves which would be affected most and in the coming two decades we can see EU countries being radicalized one by one.

I am not sure that EU regulators have taken adequate precautions in the direction of making GDPR immune from being misused by terrorists. Though National Security is a ground under which security agencies can cut free from GDPR regulations, in practice the restrictions would severely affect the capability of the security agencies to identify potential threats.

This sentiment has also been expressed by US homeland security officials I hope Indian authorities also flag this issue and ensure that Indian interests are fully protected in the context of EU countries becoming too rigid in the implementation of GDPR.

Indian Context

In case any citizen of EU is acting in a manner which could be detrimental to the interests of India, we need to assert that ITA 2008 provides the legal power to ensure that “Data Retention” norms and power of “Interception”, “Right to demand Traffic Data” etc may be exercised by the Indian authorities.

I therefore urge the Indian Government to issue an advisory that all Companies having an establishment in India or engaged in the monitoring of any activities in India are required to be compliant with ITA 2000/8 whether they are compliant with other regulations or not.

In order to ensure that business interests of outsourced operations is not affected, a system of “Special Data Processing Zones” on the lines of STPI are set up so that data entering into such zones are insulated and adequate protection measures are available to ensure that there is no mix up of “International Data Flow” with the “Local Data Flow”.

Government may consider a “Special EU Data Processing Zone” which is GDPR compliant but ensure that data flow in and out happens through a special gateway which can be secured as per the provisions of GDPR but also protecting the Indian interests.

Probably this concept needs further exploration but there is need for Privacy and Security Professionals in India to sit together and find a proper means of working that does not allow Privacy laws of EU or US or Singapore or Australia does not hurt Indian interests.

Naavi

Also Refer

Europe’s data protection law may have severe implications for India’s IT industry

DISHA 2018 is the proposed law for India applicable to the Privacy and Data Protection related to the Health Care sector in India. At a time there is discussion on GDPR all around the industry and anticipation of the Justice Srikrishna Committee’s recommendation on the General Data Protection Act for India, DISHA 2018 has been proposed by the Health Ministry in a draft form for public comments. The Act is likely to be named as “Digital Information Security in Health care Act 2018”. Public comments are expected to be provided before April 21, 2018 to be sent to egov-mohfw@nic.in .

In order to enable stake holders to form their views and forward to the ministry, Naavi is providing here his own views. I suppose this would be helpful in triggering thoughts in others to send their own comments.

…..Naavi

This is the continuation of the earlier article on this subject

 Any new legislation brings with it a proposal for creating new regulatory authorities and new executive positions for influential Delhi bureaucrats often unmindful of the costs involved and the inefficiency which the multiplicity of regulatory authorities breed. DISHA 2018 is not an exception to this. In the light of the action taken in the last budget to abolish some Tribunals such as the Cyber Appellate Tribunal, at some point of time, the authorities created by one law may get abolished for some reason or the other. Some times authorities get created but there will be no activity.We have seen this happen with the Adjudicating authorities under ITA 2000.

Despite this experience, DISHA 2018 also tries to create many authorities for regulation of the proposed act.

The first such authority is the National Electronic Health Authority of India (NeHA). A Chairman assisted by a board of representatives from different ministries and some ex-officio members would constitute NeHA.

NeHA will be assisted by a “National Executive Committee”  with more members from the Bureaucrats.

These  regulatory body will be supported by the “State Electronic Health Authority” and  “State Executive Committee” creating more jobs for bureaucrats in all the States and Union Territories.

These bodies will then appoint there own staff, invest in Building, Cars, Hefty Salaries and Pensions all at the expense of the tax payer’s money increasing the cost of living.

Whether these regulatory bodies are aware of IT, aware of IT Security, aware of Data Protection etc., will be the last consideration.

Adjudicators

Similarly, for Dispute resolution, State and Central Adjudicating authorities have been proposed.

For breach of digital health data by a clinical establishment or any entity an aggrieved person or owner may complain to the State Adjudicatory Authority

For breach of digital health data by a health information exchange or State Electronic Health Authority or the National Electronic Health Authority of India, an aggrieved person or owner may complain to the Central Adjudicatory Authority

The Adjudicating authorities will be a multi member body and consist of a Chairperson and two other members which is welcome since our experience with the Adjudicating Authorities under ITA 2000 had thrown up the need for such multi member body. Central Adjudicating authority will also be the appeal authority against the orders of the State Adjudicating authorities.

Appeal from the Central Adjudicating authority will go to the High Court.

Otherwise the Adjudicating authorities will be like in the case of ITA 2000, authorities which will not be required to be bound by Civil Procedure Code.

No specific compensatory limit is also indicated in the proposed Act.

However, no civil court shall have jurisdiction to entertain any suit or proceeding in respect of any matter which the Central Adjudicatory Authority or the State Adjudicatory Authority is empowered by or under this Act to determine and no injunction shall be granted by any court or other authority in respect of any action taken or to be taken in pursuance of any power conferred by or under this Act.

We need to await the detailed procedural notification at a later stage for more details on the functioning of the Adjudicating authorities and the appointment of people for the different positions in the Adjudicating authorities.

If two successive Governments at the Center were unable to find a Chair Person to the Cyber Appellate Tribunal since 2011 and the Ministry of Mr Arun Jaitely decided to merge the tribunal as a solution with another Tribunal unmindful of the consequences on the society, we need to observe how the proposed Adjudicating authorities under this Act would be set up.

If there was lack of work for Cyber Appellate Tribunal under ITA 2000, will there be sufficient work with these tribunals? or can these tribunals can also handle the ITA 2000 complaints, will be questions to which answers may be expected from the Government.

Naavi