On January 3, 2025, the ministry of electronics and knowledge know-how launched the Draft Digital Private Knowledge Safety Guidelines, 2025, for public session. These guidelines are proposed to be enacted underneath the authority of the Digital Private Knowledge Safety Act, 2023, and so as to implement the provisions of that Act.
The publication of the draft guidelines marks a major milestone, as they’re vital earlier than the Knowledge Safety Act can truly be carried out in a method that successfully protects the rights of Indian residents. With that mentioned, nonetheless, of their current type, the foundations endure from numerous potential flaws, which could hamper the flexibility of the legislation to carry out that operate.
First, there’s the process for the number of the chairperson and members of the Knowledge Safety Board (DPB) itself. The Knowledge Safety Board is essential to the functioning of the Act, because it constitutes, in essence, the infrastructure via which the legislation will likely be carried out. Probably, and in lots of circumstances, the Board will likely be dealing with complaints towards State organs for wrongful processing of knowledge. In such a context, it’s important that the Board be adequately impartial of the federal government. Nevertheless, the Guidelines take ahead the logic of the Act in establishing a process of appointment (via a search-and-selection committee) that’s completely underneath the management of the central authorities. The phrases and situations of the officers are additionally set inside the guidelines, which makes them amenable to being altered via mere government fiat. All of this raises doubts with respect to how impartial the Board can actually be.
On this context, you will need to word the very best practices of different jurisdictions. Many international locations have entrenched the independence of knowledge safety authorities or boards inside the legislation to make sure that appointments and tenures are freed from partisan political affect. Such authorities work as what are generally referred to as “fourth department establishments”; that’s, a wing of the State that’s separate from the legislature, the chief, and the judiciary, however performs important capabilities in making certain the implementation of rights, integrity and accountability in public capabilities. For the time being, underneath a mixture of the Knowledge Safety Act and the draft guidelines, the Knowledge Safety Board falls wanting being a real “fourth department establishment” — however there’s nonetheless time to rectify this.
Secondly, the foundations permit a really vast leeway to the State or its instrumentalities to course of private knowledge to supply “any subsidy, profit, service, certificates, licence or allow that’s offered or issued underneath legislation or coverage or utilizing public funds”. These are extraordinarily vast classes, which threat undoing the basic premise of the legislation, which is that the consent of residents is necessary earlier than amassing or processing their knowledge. Whereas in sure distinctive circumstances, it may be permissible to mandatorily accumulate knowledge in violation of the appropriate to privateness, the jurisprudence of the Supreme Court docket has made it clear that any such violation should happen strictly in compliance with the take a look at of proportionality. The principles don’t incorporate this take a look at, and the safeguards they require (reminiscent of knowledge minimisation) fall wanting constitutional requirements.
Thirdly, the foundations present for “cheap safety safeguards” that knowledge fiduciaries should undertake with respect to knowledge underneath its possession or management. Nevertheless, a have a look at these provisions (underneath Rule 6) reveals that they don’t seem to be worded clearly and do little greater than confer with applicable measures or requirements. Considerations of vagueness are current all through the foundations, together with with respect to exemption provisions and knowledge retention. When coping with one thing as essential as residents’ proper to privateness and informational self-determination within the digital age, it’s of utmost significance that guidelines be framed in probably the most exact phrases attainable, and go away the least scope for discretion, as this lends itself to over-collection of knowledge and potential abuse.
Lastly, the supply of the foundations with respect to youngsters is problematic. Rule 10 requires knowledge fiduciaries to make sure that “verifiable consent of the mother or father is obtained earlier than the processing of any private knowledge of a kid” and, moreover, to undertake due diligence to make sure that “the person figuring out herself because the mother or father is an grownup who’s identifiable”. Because the Web Freedom Basis has famous in its word on the foundations, a requirement for age verification opens the door to potential mass surveillance with “the potential for mass surveillance with Authorities IDs linked to each person’s on-line credentials. These provisions additionally violate ideas of knowledge minimisation or retention limitations and threat over-collection and extended storage of non-public knowledge.”
It have to be famous that in some ways, the problems with the foundations replicate points with the Knowledge Safety Act, which had been identified throughout the time when the Act was being drafted and deliberated upon. It was hoped that the foundations would plug a few of these gaps via extra exact and narrower language. It’s to be hoped that in this era of session, a few of these points will likely be dropped at the discover of the ministry, and applicable motion taken, in order that, of their ultimate type, the foundations come nearer to a rights-protecting knowledge regime.
Gautam Bhatia is a New Delhi-based advocate.The views expressed are private
