Hackers can still access your personal data and go scot-free

Since the deadline for Justice B N Srikrishna Committee's feedback is December 31, the government is unlikely to table a data protection Bill in the winter session of Parliament.

The Justice B N Srikrishna Committee, formed to draft a data protection and privacy Bill, in a white paper on Monday suggested setting up a data protection authority, data audit, registration of data collectors, enacting provisions for protecting children’s personal data, defining penalties and compensation in the case of a data breach.

The committee, which studied the privacy and data protection laws of many countries, including the US, Singapore, Australia and the EU, has released an over 200-page document inviting comments from the public on various issues such as the definition of personal data and proposed penalties for misuse of data.

The deadline for sending feedback is December 31, implying the government is unlikely to table a data protection Bill in the winter session of Parliament.

The Srikrishna Committee was set up on July 31 following a government decision to make Aadhaar compulsory for all its services.

The government gave the panel three months to suggest a draft Bill.

“Despite an obligation to adopt adequate security safeguards, no database is 100 per cent secure.

"In light of this, the interplay between any proposed data protection framework and the existing Aadhaar framework will have to be analysed,” the paper read.

The Unique Identification Authority of India (UIDAI) has issued a 12-digit unique identification number called Aadhaar to over 1 billion people after collecting their personal and biometric data.

The Aadhaar number is now used by both the government and private entities for the purpose of authentication and financial transactions.

Though the UIDAI has various in-built data protection mechanisms, it is not bound to inform an individual in cases of misuse or theft of his or her data.

“The law may require that individuals be notified of data breaches where there is a likelihood that they will suffer privacy harms as a result of data breaches… fixing too short a time period for individual notifications may be too onerous on smaller organisations and entities.

"This may prove to be counter-productive as well as an organisation may not have the necessary information about the breach and its likely consequences,” the paper added.

The Committee, which has met thrice since its formation, is of the opinion that both the government and the private entities be brought under the ambit of the proposed law.

At present only private or corporate entities are governed by the Reasonable Security Practices and Sensitive Personal Data or Information Rules under the Information Technology Act.

The Committee appears to be taking a middle path between the EU privacy law, where protection of personal data is equated with protecting the fundamental right to privacy, and the US law, which focuses on protecting the individual from excessive state regulation.

The Committee has divided the white paper into three substantive parts, including scope and exemptions; grounds for processing, obligation on entities and individual rights; and regulation and enforcement.

The Committee is of the view that certain exemptions should be granted by law for collecting information for investigating a crime, apprehension or prosecution of offenders, and maintaining national security and public order.

But the paper stated, “an effective review mechanism must be devised.”

The panel suggested strict penalties be imposed on data controllers in cases of violation.

“A civil penalty of a specific amount may be imposed on the data controller for each day such violation continues, which may or may not be subject to an upper limit.

"An upper limit may be a fixed amount or may be linked to a variable parameter, such as a percentage of the annual turnover of the defaulting data controller,” the paper read.

Photograph: Kacper Pempel/Reuters