DIGIPUB is concerned about the Digital Personal Data Protection Bill, 2023 introduced in the Lok Sabha on August 3, 2023, as its provisions could potentially impinge on citizens’ and journalists’ rights to privacy, information, and freedom of expression. The passing of this Bill in its current form will greatly undermine press freedom, and Digipub echoes the concerns raised by the Editors Guild of India, along with highlighting some additional concerns.
Clause 12(3) enables a person who consented to share personal data with a news publication/journalist to exercise right to erasure, and have personal information and/or the news article removed even if public interest is greater. More often than not, those who want to be forgotten are the ones who need to be remembered. The Bill needs to ensure that this clause doesn’t become a mechanism for censorship.
Additionally, Clause 37(1)(b) also allows the Union government to censor information without any clearly specified grounds. This gives the government censorship powers beyond the existing provisions under Section 69A of the Information Technology Act, which itself operates without any transparency and public accountability, thereby restricting freedom of expression and is an attack on the freedom of the press. This censorship clause has no place in a Personal Data Protection Bill.
The Bill, via Clause 3(c)(ii) exempts publicly available personal data from its provisions of the bill. This means that artificial intelligence and surveillance/profiling companies can use automated tools to scrape and profile data of every Indian citizen from their social media profiles, as well as from news publications, without their consent. This is particularly worrying when you consider the rapid deployment of CCTVs in the country, along with the increasing sophistication of facial recognition systems.
This exemption not only enables the usage of automated tools to profile citizens, including journalists, it also potentially enables the scraping of content of media publications and reports about individuals, which amounts to a violation of copyright. At the same time, scraping tools are commonly used in Data Journalism, in public interest. Given that we are in an environment of rapid acceleration of AI development, we would urge that any such clauses need careful consideration of their impact on privacy, fair use and copyright.
At a time when there is a compelling need for surveillance reform in India, the Bill can lead to significantly hampering journalistic activities in the country by enabling surveillance of journalists and their sources. At present, surveillance systems like the Centralised Monitoring System enable the Indian government's surveillance of phone calls and messages. The Bill allows the government to exempt any “instrumentality of the State” from the ambit of the Bill, as per Clause 17(2)(a), allowing them to share and process personal data without transparency or accountability. Section 17(4) makes exemptions for the Union government and its ‘instrumentalities’ to retain personal data for longer periods of time, even when the individual has withdrawn their consent or demanded to erase their data. Section 36 also empowers the Union government to call for information from any data processing private entity, thereby converting every private company into an instrument of surveillance, thus compromising not just the privacy of journalists and their sources, but the privacy of all citizens of India. This is a violation of safeguards provided to citizens under the Puttaswamy vs Union of India judgment by the Supreme Court of India, and the Bill needs to be amended to include clauses for surveillance reform.
At times, journalism about individuals is at odds with their need for personal data protection, and information sought to be kept private needs to be made public, in public interest. An earlier version of the Bill drafted by the Justice Srikrishna Committee took this into account while recommending exemptions for journalists, saying that said that journalists would find it very difficult to access information if they had to adhere to the legislation, and that making consent always mandatory for the processing of personal information would mean that information unfavourable to certain individuals “would simply not get published." The current version of the Bill, however, makes no exceptions for public interest journalism, and as such, opens up media organisations to legal risks when they report on activities of certain individuals. This will hamper journalistic activity and greatly weaken the fourth estate. We urge the government to consider creating exemptions for journalists in public interest.
The Right to Information Act has been a critical tool for journalists to hold the government to account in public interest. Clause 44(3) widens the scope of exemptions given to Public Information Officers in the government to reject requests for information, by substituting Clause 8(1)(j) of the Right to Information Act. This provision weakens the RTI Act since it allows Public Information Officers to reject RTI applications if the information pertains to personal information. We’re already seeing RTI requests from journalists being rejected on frivolous grounds, and being overturned only on appeals. This change will significantly hinder the ability of journalists to seek information of importance to reporting in public interest and should be deleted from the Bill.
Children today are digital natives, and their access to information is essentially online. We’re concerned that the requirement of parental consent for access to online news publications, especially for Children from the ages 13 to 17, when they’re beginning to form their worldview, will greatly restrict their access to legitimate news sources. Additionally, the requirement preventing Data Fiduciaries from processing the data of children will mean that merely in order to access news, they will have to register/login. The approach towards the protection of Children online needs to be reconsidered, in order to not hamper their access to knowledge.
The proposed Data Protection Board of India’s independence is in question, as the Union government holds the power to appoint the Board’s members. The Board can inquire into complaints of breaches and impose huge financial penalties. A parliamentary panel had earlier recommended that a selection committee should nominate the members of an independent Data Protection Authority, which would ensure the body is credible and free from any influence. In addition, in order to safeguard the privacy of individuals, it is important that the Board have the ability to make rules and regulations in response to privacy concerns in an evolving digital domain, and also hold the government to account. A Bill is as effective as its enforcement, and the Personal Data Protection Bill, 2023 will be ineffective in the absence of an empowered Data Protection Authority. The construct, role and powers of the Data Protection Board need to be reconsidered.
DIGIPUB urges the Ministry of Electronics and Information Technology to review the concerns highlighted by us and other organisations and activists, and have a Parliamentary Standing Committee reconsider the Bill and formulate a legislation that does not encroach on peoples’ rights. Furthermore, we request the Parliamentary Standing Committee to take the issues raised by DIGIPUB into account.