Our questions to Justice Srikrishna on the concerns and criticisms since Friday evening on #DataProtection here. Of course, there will be more but this covers what has been discussed so far. Thread 👇
1. You mentioned the premise of the report is to unlock the data economy while keeping data of citizens secure and protected. Basically ensure public good plus protect informational privacy. Was this balance all the more needed for a developing economy like India?
2. While you have defined consent, consent is only one of the grounds for processing of personal data. There is provision that allows processing for reasonable purposes,especially allowing the state to process data. Does this give the govt overarching power?
3. The bill also proposes 4 sets of rights for data principals: the right to confirmation and access, the right to correction, the right to data portability, and the right to be forgotten. Why is there no right to erasure?
4. On #consent, if data principal withdraws consent, "all legal consequences" to be borne by them- this sounds a little worrying. What consequences should the owners of data be worries about and in what circumstances?
5. The bill also provides a process for notification of breach by data fiduciaries. However, this requirement is limited to notifying the data protection authority, which then decides whether there is a need to notify data principal involved. Why not notify the person breached?
6. It talks about two set of amendments to Aadhaar act.. bolstering right to privacy and amendments required for greater autonomy. Does this make the @UIDAI more accountable than it is today & is this enough in face of mounting criticism?
7. Are you saying then that there needs to be a separation of power? That the UIDAI is now a platform but you need a regulator on top of that to oversee policing and enforcement?
8. How will offline verification work?
9. Data localisation has been pretty controversial, two of your members too submitted dissent notes. While Rama Vedashree said this is regressive and against the “fundamental tenets of the liberal economy”, IIM's @rishikesha said its against the basic philosophy of the Internet.
10. Is there scope to re-consider this? Its being seen as anti-industry and anti-business
11. The inclusion of criminal offenses is being perceived as draconian. Won't steep civil penalties and fines suffice?
12. The other interesting part is a law for intelligence agencies + judicial & parliamentary oversight of govt. surveillance. What's the thinking behind this?
13. One of the main criticisms is that this bill lacks a comprehensive surveillance reform. Is this because this was this outside the remit, not part of terms of reference?
14. How would you respond to concerns that this weakens the RTI ACT, because you have an amendment that focuses on harm to "data principal." Is this a tradeoff between privacy and transparency?
15. How will this play out practically? You have a data processing authority who will regulate data but you also have sectoral regulators? Who will set limits on where jurisdiction begins and ends?
16. How should the community engage from here on till it becomes a law? In terms of bringing forth concerns, changes before this becomes law?
17. You also faced criticism on how the Srikrishna committee functioned- by not disclosing minutes of meeting, making submissions public etc.
18. What next for Justice Srikrishna? You have been appointed by ICICI Bank recently to look into allegations of impropriety by Chanda Kochhar. When can we expect progress on this?
19. Finally, this isn't the first time we have seen efforts towards a privacy framework. There was one under Justice AP Shah as well. Are you confident that your bill will not just remain a draft but become a law?
ENDS
ENDS
