An opportunity we’ve waited for and which cannot be missed: Engaging to protect the data of 1.3 billion people!

India has been leading at developing some of the most complex and intense data-intensive systems in the world as exemplified with their mass biometric identification system, known as Aadhaar, as well as in the development and design of new technologies. To find out more about the main privacy issues in India, check out the State of Privacy in India.

And yet, India does not have a comprehensive privacy legislation and only limited data protection standards can be found under section 43A and associated Rules in the Information Technology Act 2000.

There are currently 126 countries in the world with data protection laws, the Council of Europe has undertaken a process to modernise Convention 108  for the Protection of Individuals with regard to Automatic Processing of Personal Data, and after almost five years of negotiations the European Commission adopted a new data protection regulation in 2016 which will provide almost 512 million people with safeguards.

For nearly 30 years, Privacy International has been advocating for the right to privacy, and a central component of our work has been to engage in legislative processes to ensure that governments adopt and enforce laws that respect, promote and uphold the highest safeguards to protect the privacy and data of their citizens.

For the last decade, Privacy International is proud to have been working with the Centre for Internet and Society (CIS) which has been at the forefront of the data protection debate in India, working to inform policy-makers of the need for such a law in India. So when the opportunity finally came around for us to be able to ensure that the data of 1.3 billion people was effectively and efficiently protected, we seized it.

India has recently taken certain measures indicating that it was prepared to legislate on data protection. In July 2017, the government set up an expert committee to suggest a draft Data Protection Bill. The committee is chaired by Justice B N Srikrishna, a former Supreme Court Judge. In November of that year, the Expert Committee released a white paper for public consultation on the contours of a privacy legislation for India.

With these important developments, Privacy International believes that the initiation of this process offers a significant opportunity for India to draft and adopt a data protection law which would provide the most advanced safeguards for regulating the processing of personal data as well as adopting innovative measures to enforce it.

Privacy International welcomes the aim of the White Paper published by the Committee of Experts to solicit public comments on what shape a data protection law must take. This initiative is an important next step following the recognition of the fundamental right to privacy as read in Article 21 (Right to life and liberty), and Part III (Chapter on Fundamental Rights) of the Constitution in the matter of K S Puttaswamy and others v. Union of India.

We trust that this initial consultation will provide the foundational feedback India is seeking to support its process to develop a data protection framework. With the aim of providing clear responses, Privacy International is submitting general comments on certain chapters of the White Paper which includes direct responses to some of the questions and reflections on the Provisions Views. We used this opportunity to welcome some of the thinking of the Committee as well as to highlight areas of concerns, emphasise issues we identified as needing further deliberation and raise issues which we assessed were missing and should be considered.

Privacy International is looking forward to the next steps and hopes the India government will make it possible for all stakeholders, and in particular civil society, to share their expertise further at various stages of the legislative process which will see India draft and hopefully adopt a comprehensive, robust and progressive data protection law.

This is an opportunity for civil society in India and elsewhere working on the right to privacy, data protection and human rights issues to engage in this process. Privacy touches on many aspects of our lives including our dignity and autotomy and protecting personal data is an important tool for citizens to exercise control. It will be crucial for a wide range of actors across disciplines to be part of the next steps of the legislative process. Keep an eye out for any up-coming announcement of the Indian Ministry of Electronics and Information Technology. You can also sign-up to ‘join’ our actions to find out more about our work on data protection and our programme aimed at building a global movement.

Finally, Privacy International would like to reiterate its availability to engage further in this process and provide additional feedback which may be sought by the government of India and other stakeholders.