The members are also split over the critical issue of whether data should be localised in India.
The 30-member JPC was constituted last year to examine the Personal Data Protection Bill, 2019. Ruling Bhartiya Janata Party MP Meenakshi Lekhi chairs the committee and has held more than 30 meetings with industry, government bodies and think-tanks. The committee has concluded depositions from stakeholders and its members have now begun clause-by-clause discussions on the bill.
A senior member of the JPC from an opposition party suggested that Section 35 of the bill, which allows the Centre to exempt its agencies from some or all provisions of the bill for national security and public order, should be granted only if it is necessary, proportionate and when public interest outweighs breaching the right to privacy.
Similar concerns were voiced by other members who said such processing of personal data should not be permitted unless it is authorised pursuant to a law, as recommended in the original draft of 2018.
Some members want the section to be deleted, arguing that it can be subject to government abuse and it runs contrary to the Puttaswamy judgment that deals with the Right to Privacy. Justice BN Srikrishna, who led the committee that drafted the bill, has already warned that government exemption is dangerous and can turn India into an Orwellian state.
Most of the MPs who spoke to ET did not wish to be identified.
Asked about the concerns raised on Section 35, Lekhi told ET, “Entire enactment and the scheme of the act need to be read together. The principles are all there and the gaps, if any, will be addressed. The interest of everyone is common, which is we need to protect the interests of India, Indians and their privacy.”
Several opposition leaders pushed for more judicial representation in selecting the Data Protection Authority chairperson. Currently, as proposed, the selection panel consists of only government representatives. Members want to include the Chief Justice of India, a judge of the Supreme Court, a retired high court judge, opposition leaders and independent industry experts on the panel.
Some members suggested that non-personal data should be removed from the ambit of the current law on personal data, arguing it is inconsistent with the purpose of the privacy bill. One member said mandatory sharing of non-personal data can have unintended consequences such as violation of proprietary rights of businesses, privacy risks and discouraging business innovation and growth. The proposed law allows the Central government to seek any anonymised or non-personal data from companies for policy making.
Bhartruhari Mahtab, MP from the Biju Janata Dal (BJD), told ET that “the general perception within the committee is that data is data and why should we restrict the act only to personal data and keep non-personal data out.”
The inclusion of non personal data and hard localisation are expected to raise the hackles of the global technology companies for whom India is the largest Internet market outside the United States.
Data localisation also remains a debatable provision of the bill with members expressing different points of view. One member from the ruling side proposed that India must not mandate strict data storage within the country, but allow it to be stored in any jurisdiction approved by the government that permits lawful access to the government of India under defined exceptional circumstances. While some say that the requirement of storage of sensitive personal data in India can be waived off for small entities, others are for the government allowing mirroring of certain data categories.
Lekhi said that while she has to still take a final decision on data localisation, it has been observed that most of the Indian companies are already localising the data and most foreign companies are not localising it, with a few exceptions. “Bangalore, Hyderabad, Pune, Gurugram can become the hub of innovation and capitals of data processing if we have the Data Protection regime in place. Indian engineers along with the enormous data are fantastic resources for a big technology revolution.”
Mahtab of BJD said that the “major thrust is for localisation” and whatever is created here, needs to be mined here in the country. “There is a difference of opinion on this, the stakeholders that we have heard have said that unless we allow data to flow out, a lot of industrial activity will be curtailed but the committee has to take a position on it.” He added that the reason why the categorisation of data has been done into sensitive and critical data is to decide which data can be allowed to go outside.
Another prominent member from the opposition has proposed that social media platforms will have to verify the identity of its users and all unverified accounts should be deleted. Companies that fail to do so should be fined.
Lekhi said that the mandate for social media is very much before the JPC and there are several concerns of the people i.e privacy of data principals, non-transparent & intrusive AI’s, management of the platform, marketing and sales structures, Indian operations,financial and tax issues which need to be addressed. “The committee is of the opinion that while India may be a poor country in terms of per capita income, it is richest in data creation and net consumption. Our only competitor is China, and they have not allowed entry of big tech companies into their markets. We have not leveraged our advantages.”
BJD’s MP Amar Patnaik, a member of the JPC, refused to comment on his proposed amendments to the Committee but has said in previous articles that the current form of DPA lacks the independence of a fourth branch institution and does not have strong safeguards against executive and political interference. He has also argued that the power to notify categories of ‘sensitive personal data’ should rest solely with the DPA.
Members of the JPC are also split on the definition of ‘child’ under the PDP bill, which currently puts an age bar of 18. Some members believe that the age should be reduced to either 14 or 16 so that many adolescent children can benefit from new technologies and online education without requiring parental consent.