Data Protection based Amendmentsto RTI
YashovardhanAzadMSridharAcharyuluInformation Commissioners12.10.2018
Analysis of 8(1)(j)
1. Therecan be seven occasions even if information sought was personal it could be given under this exception:2. Theinformation relates to public activity,3. Theinformation relates to public interest,4. Theinformation disclosure will not cause unwarranted invasion of privacy of that individual,5. Thoughinformation is personal, not related to public activity or interest, if larger public interest justifies such disclosure,6. Thoughinformation is personal and its disclosure could cause unwarranted invasion of privacy it could still be disclosed if larger public interest justifies,
Section 8(2)
7. Thoughinformation is personal, not related to public activity or interest, disclosure causes unwarranted invasion of privacy of the individual, no larger public interest involved, yet it could be given to citizen if it can be furnished to the Parliament or State Legislature.8. Thoughinformation is personal, not related to public activity or interest, disclosure causes unwarranted invasion of privacy of the individual, it could still be given if public interest in disclosure outweighs the public interest in its non-disclosure.9. Provisoto Section 8(1) of RTI Act,2005 at the end10. Sec8(2) of RTI Act,2005 competitive public interest
Expanding scope of restriction
GirishRamachandraDeshpande2013CanaraBank transfer case. 2017Office Memorandum ofDoPTEven Privacy Judgment mentionedGirishConfirmed inCanaraBank case, only based onGirish.A dismissal of SLP is wrongly being considered as Precedent.
Srikrishna’sReplacement proposal
Expands right to privacy of public servants without defining itTheJusticeSrikrishnaCommittee recommendingadditional grounds.Loose expressions, wide open criterionThis can undothe positive gains of RTI Act.
‘Likely’ and ‘harm’
1. protect public servant fromanylikely harmbydisclosure.Both‘likely’ and ‘harm’ are openended.“(j) information whichrelates topersonal data which islikelyto causeharm to a data principal, where suchharm outweighsthe public interest in accessing such information havingdue regard to the common good of promoting transparency and accountability in the functioning of the public authority;
Harmful ‘harm’
Section 3 (21) says:“Harm”includes— (i) bodily or mental injury; (ii) loss, distortion or theft of identity; (iii) financial loss or loss of property, (iv) loss of reputation, or humiliation; (v) loss of employment; (vi) any discriminatory treatment; (vii) any subjection to blackmail or extortion; (viii) any denial or withdrawal of a service, benefit or good resulting from an evaluative decision about the data principal; (ix) any restriction placed or suffered directly or indirectly on speech, movement or any other action arising out of a fear of being observed orsurveilled; or (x) any observation or surveillance that is not reasonably expected by the data principal.
New escape gates
1. Not only personal data but data relating to personal data also can be denied.2. Likely to cause harm3. Might cause bodily injury or likely to4. Might cause mental injury or likely to5. Loss of property or employment or likely6. Loss of reputation or humiliation or likely7. Subjection to blackmail or extortion or likely8. Possible loss of benefit, withdrawal of service9. Becomes restriction on speech or movement10. Subjects him to observation
Should we protect black sheep from blackmail?
All corrupt public servants can celebrate this Bill. It will safeguard black sheep among public servants from possible black mail!tenexit gates tocorrupt persons
SC onRight to Privacy
Privacyintegralpart of fundamental Rights under Part III of Constitution ofIndia. SC 9 JJ benchanexhaustive list or catalogue cannot be made. This verdict prevents any kind of snooping', like individual freedom, 'individual house, marriages, sexual orientation, right to space, right to move freely, right to eat what an individual likes, right to be left alone are protected both within the home and at public places to the extent necessary'.
Reasonable Restrictions on Privacy
Weneed to examine whether a limitation like ‘reasonable restrictions’ or procedure established by law’ will apply to fundamental right to privacy.Thegovernment to examine and put in place a 'robust regime' for data protection in the modern era, saying
No definition
Puttaswamyjudgement did not codify the definition of privacy,nordid it offer a detailed test against which restrictions may be judged.tobe dealt with on a case-to-case basis. The judgment did go into the question of reasonable restrictions, andwhetherthe “reasonable expectation of privacy” test is appropriate for India.
Three requirements
“The first requirement that there must be a law in existence to justify an encroachment on privacy is an express requirement of Article 21.For, no person can be deprived of his life or personal liberty except in accordance with the procedure established by law.”..
Secondand third needs
“Second,natureand content of the law which imposes the restriction falls within the zone of reasonableness mandated by Article 14, which is a guarantee against arbitrary state action.The third - the means which are adopted by the legislature are proportional to the object and needs sought to be fulfilled by the law..”
Broad exceptions
The state has to identify its legitimate aims.For instance protecting national security,preventingand investigating crime,encouraginginnovation andthespread of knowledge, andpreventingthe dissipation of social welfare benefits”.
Isthis robust regime?
Whether ‘The Personal Data Protection Bill, 2018on 27thJuly 2018, proposed robust regime to protect privacy, and alsothe fair and reasonable restrictions on that fundamental right?Privacy as a fundamental right is fine, how about privacy as a restriction on other fundamental rights like RTI and Freedom of Expression?
Consent
Consent of data principal obtained by data fiduciary – it should be informed consent, not just informed, it should be given only after properly understanding.A mere signature onproformaconsent cannot be consent.There is no protection to data principal from routine andproformabased consent. Law provided for obtaining consent. There should be prescribed freedom not to give consent.
Deficiencies
There is no privacy law till todayThe Bill did not define privacyPersonal data and sensitive personal data are defined. A couple of aspects of privacy only.Does not protect the privacy of citizens from the surveillance, and tapping and trappings of state power.Provided a frail and weak regime for commercial data processers to obtain data and misuse.
S 42…Security of State
Section 42 Security of State:(1) Processing of personal data in the interests of the security of the State shall not be permitted unless it is authorised pursuant to a law, and is in accordance with the procedure established by such law, made by Parliament and is necessary for, and proportionate to, such interests being achieved.
Exemptions from
Data protection obligations, Chapter III- Grounds of Processing of Personal Data, IV- Grounds of Processing Sensitive Personal Data, V- Personal and Special Personal Data of Children, VI- Data Principal Rights, VII- Transparency of Accountability measures and VIII deals with Transfer of Personal Data outside India; these will not apply to Law to be made by Parliament according to S 42.
Prevention of Crime
43. Prevention, detection, investigation and prosecution of contraventions of law.—(1) Processing of personal data in the interests ofprevention, detection, investigation and prosecution of any offence or any other contravention of lawshall not be permitted unless it isauthorisedby a law made by Parliament and State Legislature and is necessary for, and proportionate to, such interests being achieved.
S 44. Legal rights and claims
Section 44Processing for the purpose of legal proceedings.— (1) Where disclosure of personal data is necessary forenforcing any legal right or claim, seeking any relief, defending any charge, opposing any claim, or obtaining any legal advice from an advocate in any impending legal proceeding such processing shall be exempted from the following provisions: (a) Chapter II, except section 4; (b) Chapter III; (c) Chapter IV; (d) Chapter V; (e) Chapter VI; and (f) Chapter VII, except section 31.
Journalistic purposes
Exception 4 research purposesException 5 Domestic purposeException 6 Journalistic purposes
Demonstration
47: Journalistic purposes.—(1) Where the processing of personal data is necessary for or relevant to a journalistic purpose, the following provisions of the Act shall not apply—(a) Chapter II, except section 4; (b) Chapter III; (c) Chapter IV; (d) Chapter V; (e) Chapter VI; (f) Chapter VII except section 31; and (g) Chapter VIII.(2) Sub-section (1) shall apply only where it can be demonstrated that the processing is in compliance with any code of ethics issued by—(a) the Press Council of India, or (b) any media self-regulatory organization.”
Pre censorship
To say unless it is processing of data is in compliance with any code of ethics of PCI or any media self regulatory organization, they cannot process or write about personal data is in breach of fundamental right.This restriction on freedom of speech and expression on media writings on the ground of ‘personal data’ processing on the criterion of a code of PCI or any other self-regulatory organization will amount to unreasonable restriction on freedom, pre-censorship and will fail the judicial scrutiny because it violates Article 19(1)(a) and (2).
S 27. Right to be forgotten
Section 27 of the draft Bill proposed a right to be forgotten. The Bill proposed an adjudicatory forum to decide on disclosure on the basis of right to be forgotten that can override Right to Information of citizen. S 27 says:(1) The data principal shall have the right to restrict or prevent continuing disclosure of personal data by a data fiduciary to the data principal where such disclosure-a) has served the purpose for which it was made or is no longer necessary;
Adjudicating officer
(b) was made onthebasis of consent under section 12 and such consent has since been withdrawn; or(c) was made contrary to the provisions of this Act or any other law made by Parliament or any State Legislature.(2) Sub-section (1) shall only apply where the Adjudicating Officer under section 68 determines the applicability of clause (a), (b) or (c) of sub-section (1) and that the rights and interests of the data principal in preventing or restricting the continued disclosure of personal data override the right to freedom of speech and expression and the right to information of any citizen.
Powers of adjudicating officer
(3) In determining whether the condition in sub-section (2) is satisfied, the Adjudicating Officer shall have regard to—(a) the sensitivity of the personal data;(b) the scale of disclosure and the degree of accessibility sought to be restricted or prevented;(c) the role of the data principal in public life;(d) the relevance of the personal data to the public; and(e) the nature of the disclosure and of the activities of the data fiduciary, particularly whether the datafiduciarysystematicallyfacilitates access to personal data and whether the activities would be significantly impeded if disclosures of the relevant nature were to be restricted or prevented.
Who are persons of ability?
(4) The right under sub-section (1) shall be exercised by filing an application in such form and manner as may be prescribed.(5) Where any person finds that personal data, the disclosure of which has been restricted or prevented by an order of the Adjudicating Officer under sub-section (2) does not satisfy the conditions referred to in that sub-section any longer, they may apply for the review of that order to the Adjudicating Officer in such manner as may be prescribed, and such Adjudicating Officer shall review her order on the basis of the considerations referred to in sub-section (3).The Bill prescribed under Section 68 a separate adjudicatory wing, with adjudicating officers who are persons of ability integrity and standing, with not less than seven years of experience in the fields specified.
What is right to be forgotten?
If an individual desires to "determine the development of his life in an autonomous way, without being perpetually or periodically stigmatized as a consequence of a specific action performed in the past”,This vague concept of European Union and France is being introduced as part of right to data protection by JusticeSrikrishnaCommittee. The US preference of transparency and right of free speech to so-called right to be forgotten, should have beentaken.
Conclusion
If dataprincipal happens to be public servant (egformer minister), and data fiduciary is a newspaper or web journal, the freedom to criticise the public personalities, their public policies based on their statements and activities will be in jeopardise, andjournalisthas to wait for the decision of adjudicating officer to clear writing about it.Acitizen seeking access to such information will be confused whether to approach CIC or DPA.Though named as adjudicating officers they are judges but subordinate officers to the members of Data Protection Authority.
Criminal leaders will enjoy this right
Underthis Bill the former Minister can apply to AO to prevent the media from publishing because the information served its ‘purpose’ and AO considers that his right to be forgotten overrides freedom of press of media.
Contrary to RTI Act
Thisconflicts withthe RTI Act, independent adjudicating power of CIC and the Fundamental Rights chapter of Constitution of India.Thisundermines the very existence of the Information Commissions in Centre and States. Under this right a public servant or political leader can restrict disclosure of ‘data’ of his earlier conviction or truthful accounts of his public life, of which he has a right to be forgotten.
Seriously interferes with press freedom
TheSrikrishnaCommittee Report, thus seriously interferes with the freedom of speech and expression under Article 19(1) and imposes unreasonable restrictions on the ground of privacy.
Don’t replace 8(1)(j)
Expands the ground of denial with confusion.Mental injury, loss of reputation and subjection to black mail are some kinds of the ‘harm’, to avoid which information can be denied on the excuse of ‘privacy’.This amendment is wholly unnecessary.Existing Section 8(1)(j) has better balance privacy and RTI.
Delete right to be forgotten
Right to be forgotten hasto be deleted, because it creates new grounds against disclosure of information under RTI Act beyond SS 8-9 andIntroduces the pre-censorship and prior restraints on Media from processing the data and publishing, which violates Article 19(1(a) and 19(2) of the Constitution of India.Creates an authority parallel Information Commissioner to deal with disclosure or permission to process the data, if the data principal happens to be public servant, data fiduciary the media.
Exception 42 useless
Security of state is a ground to allow data processing under DPA Bill and order disclosure under RTI Act [s8(1)(a)], but this Bill does not explain this ground of exception, and leaves it for future legislation.This does not serve any purpose.This will lead to contradiction with RTI Act, with another proposed law on the subject. Multiple laws will lead to confusion and contradiction.
Exempt criminal investigations
S 43: Exemptionfor criminal investigation is permitted under this section, but does not lay down any law.RTIAct section 8(h) covers this area.No otherlaw is needed.If new lawis made as suggestedthe lawswill multiply and confusion increases.
‘Journalistic purposes’ is harmful
It permits data processing/publication for journalistic purpose, but journalist has to demonstrate that publication is accordance with code of conduct etc.Adjudicating officer will decide. Conflict and confusion under Section 27 (point 1) above will prevail.Itsviolativeof Article 19(1)(a) and Article 19(2)as this imposes another prior restraint on media freedom.Adjudicating officer with a rank below the CIC will be deciding issues of disclosure under this Bill. After review before Adjudicating Officer, appeal lies before Data Protection Authority. Two parallel institutions on privacy based non-disclosure and disclosure of personal information in public interest will create confusion and uncertainty.This has to be avoided.
Thank you very much foryour kind attention
0
Embed
Upload