The Joint Parliamentary Committee (JPC) examining the Personal Data Protection Bill, 2019 tabled its report recently amidst much anticipation. The JPC has taken close to two years to solicit public inputs and deliberate over India’s proposed seminal data protection legislation. Expectedly, the report is voluminous, covering a detailed clause by clause review of the draft provisions, with numerous annexures and dissent notes. The report marks a significant milestone in India’s trajectory towards recognising and legislatively effectuating the fundamental right to privacy, which was read into Article 21 of the Constitution, by the Supreme Court in K.S. Puttaswamy v. Union of India (2017).
The idea of informational autonomy was seen as the edifice for the right to privacy, affording an individual the ability to control if her data is to be collected, and how it is to be collected, processed, stored and shared. However, in the ever-expanding digital age, meaningful exercise of this autonomy is implausible in the absence of a robust governance framework. Information asymmetry, referring to the gap of clearly understanding how data is collected, processed and shared, between data principals and data fiduciaries is a significant impediment to an individual’s informational autonomy. It strikes at the very notion of notice and informed consent, inextricable pillars on which the right to privacy rests.
In fairness, it is not an exaggeration to state that the idea of informed consent, in the age of Big Tech, has unfortunately been relegated to a flimsy, checkbox formality. This is particularly worrisome given how many online platforms and digital service providers collect, process, store and share copious amounts of sensitive information. The same has become deeply embedded into this ecosystem, serving a multitude of purposes like development of intelligent algorithms, more targeted product and content management, predictive analyses of market patterns, to name a few. Neither all uses are benign, or socially beneficial, nor all actors collect or process data with a bona fide intent.
Across the spectrum of digital service providers, ranging from social media platforms to online banking services, tactics like information overload and dark patterns are being tapped into to whittle down any shred of informational autonomy. Consequently, this has given rise to what legal and privacy researchers term as the privacy paradox. It manifests a behavioural contradiction within an individual who despite displaying alacrity to safeguard her privacy, takes very little action, or counterproductive measures. For instance, (arguably) one of the most common manifestations of the privacy paradox is how infrequently privacy policies and terms of service are actually perused by digital users. As per a survey conducted among Indian social media users, it was found that almost 40 per cent were unaware and incapable of comprehending tediously worded, bulky privacy policies put out by respective platforms.
It is in this context that one must consider how the proposed PDP Bill, as well as the report of the JPC, has worked towards addressing these challenges. Foremost is the provision under Section 11 of the PDP Bill, which elaborates on consent-based data collection and processing. Specifically, in the context of sensitive personal data, as defined under 3 (36), it disallows inference of consent based on conduct. Furthermore, no individual can be denied any goods or service if consent is not given for data processing (unless the same is necessary for the good or service to be rendered). This latter clause is quite crucial—it will allow a digital transport platform (like an Uber) to collect a person’s real time location since it needs the same to direct the cab driver. However, it is going to prevent unilateral notices like the one issued by WhatsApp in January this year expanding its data sharing practices, and threatening discontinuation of accounts where such consent was not forthcoming.
Another key provision to bridge the prevailing informational asymmetry is the proposed right to confirmation and access (Section 17). Once effectuated, it will allow persons to seek information on what data of hers is being processed and shared with third parties. Importantly, such information must be concise and understandable. The aforementioned survey also revealed how even trained lawyers experienced in legalese have difficulty navigating tediously worded privacy policies and terms and conditions. In fact, an online platform created a ranking system scoring these terms of service documents across different platforms, from best to worst. Most of the commonly accessed platforms fared poorly.
ALSO READ | Blue Tick for All? JPC Report on Data Protection Bill Can Impact Online Anonymity, Privacy
The final provision which will likely aid the exercise of informational autonomy is the transparency requirements under Section 23 of the PDP Bill. Among other things, this provision requires public disclosures of categories of personal data processed, and the purpose(s) for the same. The JPC has further added a clause requiring transparency in the use of algorithms which are now ubiquitous in data scraping and processing.
On the regulatory and institutional side, the proposed Data Protection Authority will be tasked with ensuring compliance with each of these provisions. Further, trained data auditors will be monitoring practices adopted by data fiduciaries to prevent transgressions. In house data protection officers are likely to become more informal avenues for enforcing compliance. All in all, the PDP Bill in its current state certainly appears to be a progressive legislation in terms of balancing informational asymmetry through legislative mandates, and regulations and oversight.
Ameen Jauhar is the lead for Applied Law & Tech Research (ALTR) team, at the Vidhi Centre for Legal Policy. The views expressed in this article are those of the author and do not represent the stand of this publication.
Read all the Latest Opinions here
Comments
0 comment