An absent framework

The withdrawal of the Personal Data Protection Bill, though misfortunate and a result of ill-conceived planning, may be a step in the right direction — only if the intent is to right the wrongs. India which boasts itself to be an emerging digital economy is, sadly, among the remaining few prominent nations that don't have a well-structured data protection framework to boost their commercial interests and uphold the basic rights of their citizens. The Personal Data Protection Bill, which was not just criticised by civil rights groups and global tech giants but was also recommended to incorporate a large number of amendments by the Joint Parliamentary Committee, was bound to fail. However, its withdrawal means that India's already weak data protection framework will remain bereft of proper legislation for some more time to come. Data is rightly called the new gold. Its prolonged non-regulation comes at a heavy cost. Notably, countries like China, the USA, the UK and blocks like the European Union had already advanced to incorporate stringent data protection laws during the last decade. In India, however, 10 years after the AP Shah Committee presented its report in 2012, we find ourselves back to square one. The period after 2012 was interspersed with a Supreme Court Judgement upholding the right to privacy as a fundamental right in 2017 and the formation of BN Srikrishna committee on the issue of data protection. Throughout this period, loopholes in the existing data-related laws have been allowing the breach of citizens' personal data in the interest of agencies and commercial organisations. Furthermore, the Pegasus issue that surfaced last year made it clear that foreign players, too, are having a hawk's eye on people's day to day activities. Social media companies are tracking users' data from each and every activity they conduct online to manipulate them to consume a particular kind of content in the name of 'customisation'; they are forced to buy a particular brand of product, and rally for a particular political entity. Thanks to excessive customisation exercises, resulting from overreaching access to personal data, political and ideological moderates can be converted into extremes, an occasional gamer can be pushed to the point of addiction, and country's youth can be tempted to spend hours in watching reels that are carefully 'curated' for them. The urgency for introducing strict legal regulation on data transaction and storage had never been so profound. Withdrawal of Personal Data Protection Bill presents an opportunity to remove the loopholes in the withdrawn legislation and come out with a more comprehensive and encompassing Bill. One of the provisions of the withdrawn Bill that didn't sit well with global commercial interests was that around data localisation — which seeks to preserve citizens' data within India and trusted circles. Blanket localisation of data is a contested practice, globally. Perhaps it is time when India should take cues from experiences of other countries before proceeding with such measures. The second prominent controversial issue around the Bill was that it allowed the central government and its agencies certain exemptions from adhering to the provisions of the Bill. Government's overreaching control over citizen's data is certainly not a desired prospect in a democratic nation. In the new Bill, which is expected to come soon, the government must strive to strike a right balance. Apart from dealing with these contentious issues, the greater challenge will be to make the data protection framework more robust and encompassing. However, it is not certain how much one should expect from the new Bill which may possibly be introduced in the winter session of the Parliament. The drafting of the withdrawn Bill was initiated by Justice BN Srikrishna in 2017. However, as the Joint Parliamentary Committee, to which the Bill was referred to in 2019, tabled its report in 2021, Justice Srikrishna himself said that incorporation of the report's recommendations will lead up to an Orwellian state. Since the upcoming legislation is expected to draw heavily from the JPC recommendations, even if controversial portions are toned down or removed, it is hard to say whether there will be any major overhaul in the spirit of the withdrawn bill.