{"id":10964,"date":"2020-08-18T11:17:00","date_gmt":"2020-08-18T05:47:00","guid":{"rendered":"https:\/\/www.naavi.org\/wp\/?p=10964"},"modified":"2020-08-18T11:17:00","modified_gmt":"2020-08-18T05:47:00","slug":"live-mint-interview-on-data-protection-regulations","status":"publish","type":"post","link":"https:\/\/www.naavi.org\/wp\/live-mint-interview-on-data-protection-regulations\/","title":{"rendered":"Live Mint Interview on Data Protection Regulations"},"content":{"rendered":"

Following is the interview of Naavi that appeared in Live Mint recently:<\/a><\/p>\n

Excerpts as published:<\/strong><\/p>\n

What\u2019s your take on the provisions in the bill?<\/strong><\/p>\n

Privacy legislation is always a complicated legislation. You have to balance the interest of privacy activists who want their rights protected, business people who want total freedom so they can exploit, and the government that wants as much control as possible. The preamble of the bill recognizes these three stakeholders. Whatever you do, someone will be happy and someone won\u2019t be. That\u2019s what is playing out here. But overall, I think they\u2019ve done reasonably well.<\/p>\n

How does this bill compare with its counterparts in the West, like the General Data Protection Regulation (GDPR) in the European Union?<\/strong><\/p>\n

GDPR has principles of processing. So do we. GDPR has rights [for citizens]. So do we. Except that, in the \u2018right to forget\u2019, we are a little more circumspect than the EU. In EU, it\u2019s more or less automatic. In India, we say it is subject to adjudicator\u2019s decision, which is a quasi judicial authority that can take decision on this. This reduces the burden on the judiciary. If the adjudicator\u2019s decision is not acceptable, one can approach an appellate tribunal. If that\u2019s not acceptable, one can approach the courts.<\/p>\n

There are concerns that some of the provisions in the bill allow for significant state surveillance.<\/strong><\/p>\n

The Bill will empower government for certain things. Section 35 and 36 allows certain security agencies to process data for surveillance. They are, however, not allowed to misuse this data.<\/p>\n

Article 19 of the Constitution also provides reasonable restrictions, where the government allows itself similar exemptions in cases of \u2018decency\u2019, \u2018morality\u2019, \u2018defamation\u2019. Based on the constitution, the government can use \u2018incitement to offence\u2019 and \u2018public order\u2019 for surveillance. These terms are generic and can be misused.<\/p>\n

As per this Bill, the offence has to be related to matters of \u2018national security, sovereignty, integrity of the state\u2019, not things like \u2018decency\u2019. So in my view, this reduces the surveillance powers of the government.<\/p>\n

One of the reasons for concern is the possible broad interpretation of \u2018integrity of state\u2019.<\/strong><\/p>\n

I understand. But some parts in the Indian Penal Code also give draconian power to the police. Even they misuse it many times. This is more reflective of persons in charge of the legislation. We can only have deterrence. Likewise, you can\u2019t omit this law on speculative grounds, saying the government might misuse it. The law can provide a framework. If someone wants to misuse it, punish them separately.<\/p>\n

How desirable do you think data localisation is, as mentioned in the Bill?<\/strong><\/p>\n

Right now, there is no data localization in the legislation. \u2018Non-sensitive personal information\u2019 can be transferred, so can the \u2018sensitive information\u2019, subject to explicit consent. Only \u2018critical information\u2019 cannot be transferred but we don\u2019t know what constitutes that. There is no restriction on transfer of data.<\/p>\n

When we\u2019re talking of having one data centre in India, it will act as a back-up data centre. There is an economic cost for businesses. But I don\u2019t believe the industry will suffer.<\/p>\n

Will having a data copy in India affect the way a law enforcement agency can access a person\u2019s data?<\/strong><\/p>\n

For a law-enforcement agency to access someone\u2019s data, it needs to be for law-enforcement reasons. They have to send a notice, identify investigating officer, identify the reasons for which it is done, and tomorrow if police officer is going beyond their normal duty and collect the information, there\u2019s always a possibility that the written request will be questioned in court of law. But if someone wants to ignore the procedures, that is what the private sector \u2013 the data centre owner \u2013 has to resist. Agencies can\u2019t come and directly take away data.<\/p>\n

Is there a possibility of misuse by state agencies, with data being more accessible than earlier?<\/strong><\/p>\n

I have been working in field of cyber crime for 20 years. When we want information for investigation, Google and others don\u2019t give data. If you get an abusive or obnoxious email, you\u2019d need the IP address to find out who sent it. But they will often not reveal the address. In a way, they\u2019re protecting the abuser. I don\u2019t buy this idea that if data is in India, there will be a problem. I don\u2019t trust Facebook or Google.The possibility of misuse exists but both arguments have to be considered on a case-by-case basis.<\/p>\n

Naavi<\/p>\n","protected":false},"excerpt":{"rendered":"

Following is the interview of Naavi that appeared in Live Mint recently: Excerpts as published: What\u2019s your take on the provisions in the bill? Privacy legislation is always a complicated legislation. You have to balance the interest of privacy activists … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_editorskit_title_hidden":false,"_editorskit_reading_time":0,"_editorskit_is_block_options_detached":false,"_editorskit_block_options_position":"{}","_uag_custom_page_level_css":"","footnotes":""},"categories":[7],"tags":[],"class_list":["post-10964","post","type-post","status-publish","format-standard","hentry","category-cyber-law"],"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"1536x1536":false,"2048x2048":false,"post-thumbnail":false},"uagb_author_info":{"display_name":"Vijayashankar Na","author_link":"https:\/\/www.naavi.org\/wp\/author\/naavi\/"},"uagb_comment_info":2,"uagb_excerpt":"Following is the interview of Naavi that appeared in Live Mint recently: Excerpts as published: What\u2019s your take on the provisions in the bill? Privacy legislation is always a complicated legislation. You have to balance the interest of privacy activists … Continue reading →","_links":{"self":[{"href":"https:\/\/www.naavi.org\/wp\/wp-json\/wp\/v2\/posts\/10964","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.naavi.org\/wp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.naavi.org\/wp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.naavi.org\/wp\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.naavi.org\/wp\/wp-json\/wp\/v2\/comments?post=10964"}],"version-history":[{"count":1,"href":"https:\/\/www.naavi.org\/wp\/wp-json\/wp\/v2\/posts\/10964\/revisions"}],"predecessor-version":[{"id":10965,"href":"https:\/\/www.naavi.org\/wp\/wp-json\/wp\/v2\/posts\/10964\/revisions\/10965"}],"wp:attachment":[{"href":"https:\/\/www.naavi.org\/wp\/wp-json\/wp\/v2\/media?parent=10964"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.naavi.org\/wp\/wp-json\/wp\/v2\/categories?post=10964"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.naavi.org\/wp\/wp-json\/wp\/v2\/tags?post=10964"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}