[Editorial Analysis] When it isnt right to forget

Mains Paper: 2 | Polity

Prelims level: Personal Data Protection Bill 2018

Mains level:  Discuss the importance of the Personal Data Protection Bill 2018.

———————————————

Context

• Justice BN Srikrishna Committee’s draft Personal Data Protection Bill 2018.

• It is introducing a new right the right to be forgotten, to remove very old, irrelevant and unnecessary information links from social media networks.

• This concept is prevalent in the European Union (EU) and France, though it was not preferred in the US to the more valuable press freedom.

• Mario Costeja Gonzalez wanted Google and a Spanish newspaper, La Vanguardia, to remove a 1998 news item about selling off property to pay off debts.

• The EU court in 2009 upheld his right not to be reminded of that unpleasant part of his life.

• The US court did not agree with William James Sidis, a former child prodigy, who did not want The New Yorker to publish about his past.

Important highlights of the Srikrishna Committee’s Bill

• As per the Srikrishna Committee’s Bill, an adjudicating officer, who is not a judge but a bureaucrat, will decide.

• According to Section 27 of the Bill a data principal (for instance, a former minister convicted earlier) has a right to prevent the data processor or data fiduciary (could be a TV, web portal or newspaper) from using such data or information if data disclosure is no longer necessary.

• The consent to use data has been withdrawn or if data is being used contrary to the provisions of the law.

• Section 27(2) says the adjudicating officer can decide on the question of disclosure, and the circumstances in which he thinks such disclosure can override the freedom of speech and the citizen’s right to information.

• In determining this, the adjudicating officer has to consider five factors listed in subsection (3). They are:
(a) the sensitivity of the personal data;
(b) the scale of disclosure and the degree of accessibility sought to be restricted or prevented;
(c) the role of the data principal in public life;
(d) the relevance of the personal data to the public; and
(e) the nature of the disclosure and of the activities of the data fiduciary,

• It would be significantly impeded if disclosures of the relevant nature were to be restricted or prevented.

• Aggrieved by the order of the adjudicating officer, one can file for a review.

• If he reaffirms the decision, an appeal can be made to the appellate tribunal.

• This is fine as far as data protection is concerned.

Criticism

• But when the data principal is a public servant (for instance, a former minister), and the data fiduciary is a newspaper or web journal, the freedom to criticise the public personalities for their public policies based on their past statements and activities will be in jeopardy, and a journalist has to wait for the decision of the adjudicating officer to clear her writing about it.

• A citizen seeking access to such information will be confused whether to approach the CIC or DPA — these adjudicating officers are subordinate to members of the Data Protection Authority.

• The right to be forgotten in the Bill might spell a danger to press freedom.

• The PDP Bill says the rights of the data principal, including the right to be forgotten, are exempted if the purpose of data processing is in the interest of the security of state (Section 42).

• But, the Bill says, Parliament should pass a law explaining the procedures to determine the interests and to create another authority to decide the disclosure.

• These rights will not apply to the processing of data in the interests of prevention, detection, investigation and prosecution of any offence or any other contravention of law (Section 43). For that, too, however, Parliament has to make a law to consider and achieve such interests.

• The Srikrishna Committee did not suggest any draft for these two additional provisions contemplated under Sections 42 and 43.

• Even for this, Section 4 (right to privacy needs to be respected) and, Section 31 (fair and reasonable processing duties) will apply.

Is this constitutional?

• Article 19(2) of the Indian Constitution did not provide “privacy” as a ground for imposing restrictions.

• This Bill fails on constitutional verification by the judiciary, unless “privacy” is added in Article 19(2) by a major amendment to the Constitution.

• The Data Protection Bill is going to be a serious threat to press freedom and RTI.

Conclusion

• Section 74 gives the power to impose a penalty to the adjudicating officer after an inquiry, besides facilitating compensation (Section 75).

• Failure to adhere to security standards (Section 31) might lead to a penalty of up to Rs 5 crore (Section 69).

• A penalty of up to Rs 1 crore can be imposed where any person fails to comply with any provision of this Act, for which no separate penalty has been provided in the Act (Section 73).

• This can easily be used against journalists.