Neither the right to privacy nor the right to information

Context: The article is discussing the Digital Personal Data Protection (DPDP) Bill 2023 and its implications. The main argument presented in the article is that the true purpose of the bill might be to facilitate and legalize data mining rather than ensuring the protection of individuals’ right to privacy. The bill’s introduction is seen as a response to the evolving challenges to the right to privacy in the digital age, as highlighted by a landmark ruling of the Supreme Court in 2017. The article points out that the DPDP Bill 2023, despite its stated intention of protecting personal data, may actually undermine other fundamental rights, such as the right to information. The concern raised is that the DPDP Bill might make the government less transparent to the public while making individuals’ data transparent to both the government and private entities. Precisely, the article suggests that the DPDP Bill 2023 might have unintended consequences that go beyond data protection, potentially impacting democratic practices and citizens’ ability to access information about their government. It emphasizes the need for a balanced approach that addresses both privacy concerns and the broader principles of transparency and accountability.

Decoding the Editorial

The article points out that the bill, despite its stated intention of protecting personal data, may actually undermine other fundamental rights, such as the right to information.

The Right to Information Act (RTI) 2005, which provides access to government documents, has been crucial in promoting transparency and holding the government accountable.

Right to information and Right to privacy:

Complementary Nature of Rights: The article highlights that the right to information and the right to privacy are complementary to each other. The right to information aims to make the government transparent to the public, while the right to privacy aims to protect individuals from government and private intrusions into their personal lives.
Tensions Between Rights: While the two rights complement each other, there are tensions and potential conflicts between them.
- Example is the Mahatma Gandhi National Rural Employment Guarantee Act (MGNREGA), where mandatory disclosure provisions provide transparency but can also lead to misuse of personal data for fraudulent activities.
Shortcomings of DPDP Bill 2023: The DPDP Bill 2023, as introduced, is criticized for not adequately addressing these tensions. Instead, it is suggested that the bill makes the government less transparent to the public while allowing both government and private entities to access and use individuals’ personal data.
Broad Definition of “Lawful Purposes”: The bill’s definition of “lawful purposes” (as any purpose not expressly forbidden by the law) is seen as too broad. This could potentially allow for data mining and other uses of personal data that might not align with individuals’ interests or privacy rights.
Data Access and Sharing: Sections 4(2) and 36 of the bill are mentioned as examples of provisions that allow the government and private entities to access and request information, making personal data susceptible to being used by both parties.
Impact on Privacy: The overall implication of the article is that the DPDP Bill 2023, in its current form, might not effectively balance the right to privacy and the right to information. It suggests that the bill could potentially lead to increased government and private access to personal data without sufficient safeguards.

Undermining the Right to Information:

Anticipation of Tensions: The Right to Information Act (RTI) 2005 was designed with an awareness of the potential tensions between the right to information and the right to privacy. Section 8 of the RTI Act acknowledged the need to balance these rights by granting exemptions from disclosure in certain cases.
Exemption for Personal Information: Section 8(1)(j) of the RTI Act provided an exemption from disclosure for personal information if it had no relationship to any public activity or interest, or if its disclosure would result in an unwarranted invasion of an individual’s privacy. However, disclosure could still be justified if there was a larger public interest that warranted it. The benchmark for this exemption was set high, emphasizing that information that cannot be denied to the Parliament or State Legislature should not be denied to any person.
Proposed Change by DPDP Bill 2023: The DPDP Bill 2023 suggests replacing Section 8(1)(j) of the RTI Act with a more general statement of “information which relates to personal information.” This proposed change raises concerns that the current safeguards and criteria for disclosure exemptions might be diluted or undermined.
Impact on Larger Public Interest: The article points out that the proposed change could have significant consequences.
- For instance, information about public servants’ immovable assets, which currently serves a larger public interest by identifying individuals with disproportionate assets, might become off-limits for disclosure under the new framework.
Undermining RTI 2005: The inference drawn is that the suggested change in the DPDP Bill 2023 could potentially weaken the effectiveness of the RTI 2005 by reducing the criteria for granting exemptions and limiting the scope of information that can be accessed by the public in the interest of transparency and accountability.

Other Shortcomings:

Concerns About Oversight Body: The DPDP Bill 2023 is criticized for its oversight body, the Data Protection Board, which is seen as lacking independence due to its composition and appointment process. The fact that the chairperson and members are appointed by the central government raises concerns about potential government influence over the board’s functioning and decision-making (Section 19).
Comparison with GDPR: The General Data Protection Regulation (GDPR) in Europe is mentioned as a high standard for data protection. It has a strong and effective watchdog that enforces data protection regulations, as seen in the example of Google being fined €50 million for consent-related violations in France.
Data Collection vs. Data Protection: The article highlights a perspective shared by Edward Snowden that the real issue is not just data protection but also data collection. While GDPR focuses on protecting collected data, the problem of excessive data collection is not being adequately addressed in India.
Challenges in India: The DPDP Bill’s weaknesses, such as a potentially weak oversight board, lack of universal literacy, poor digital and financial literacy, and an overburdened legal system, are mentioned as factors that could hinder citizens’ ability to seek legal recourse when their privacy is violated.
Limited Citizen Redressal: The inference drawn is that due to the combination of these factors, the chances of Indian citizens being able to effectively address privacy violations and seek legal remedies for privacy harms are slim.
Overall Implication: The article suggests that the DPDP Bill 2023 might not provide an adequate framework for protecting citizens’ privacy rights and ensuring effective enforcement, particularly in comparison to the GDPR in Europe. It raises concerns about the potential ineffectiveness of the oversight body and challenges related to citizens’ ability to seek justice for privacy violations.