Lawmakers are debating a bill that seeks to protect Indians’ online privacy, but also offers sweeping exemptions to the government to access data in the world’s fastest-growing Internet market.
Information Technology Minister Ravi Shankar Prasad yesterday introduced the bill and said it will be referred it to a select panel of parliamentarians.
A report is likely in January, followed by more deliberations and then a vote.
India’s first attempt to regulate data generated by more than 600mn Internet users has raised concerns about mass surveillance.
The proposed law comes weeks after a controversy about whether Prime Minister Narendra Modi’s government used the services of spy software to snoop on WhatsApp calls and messages.
Under the proposed rules, companies will need individual consent to collect or store data, and must delete that data after it is used for the purpose agreed.
However, it also allows the government to access the data without consent, for reasons including national security, friendly relations with foreign states, public order, and for research, archiving, or statistical purposes.
“This bill is totally a disappointment for advocates of right to privacy,” Sandeep Shukla, a professor of computer science at the Indian Institute of Technology in Kanpur, said by phone. “If the government takes all exemptions, then who are we protecting data from? Criminals will breach privacy irrespective of the law.”
Concerns surrounding the bill are heightened given that India already has a national digital ID, known as Aadhaar, which uses biometrics and a unique 12-digit number to track individuals’ pensions, investments and subsidies.
The cheapest data in the world is also giving companies the ability to track consumers in the world’s second most-populous nation.
Under the proposed law, companies will need to inform the regulator about any breach of data privacy and could face penalties of as much as 4% of their previous year’s global turnover.
Individuals can also seek compensation.
Supratim Chakraborty, a partner at law firm Khaitan & Co, said the Personal Data Protection Bill will supersede a patchwork of rules and is a “quantum leap for India.” However, “this law could considerably increase the cost of compliance for tech companies,” he added.
Employees work at an office in Mumbai. India’s first attempt to regulate data generated by more than 600mn Internet users has raised concerns about mass surveillance.
