Thread by @internetfreedom

Mega thread ✨

Are you confused about the Personal Data Protection Bill, and don't know where to start? We're on a mission to #StartFromScratch and break down components of the bill for your knowledge.

Follow this thread closely. Ready? Let's go!

1/n
internetfreedom.in/startfromscrat…

In part 1 we discussed the need for a data protection bill in today's digital world. We provided historical context and hinted at some of the concerns that have been raised about it. In part 2 below, we discuss the bill's basic elements and provisions.
2/n

https://twitter.com/internetfreedom/status/1375302434315116544

Let's begin with the basics - the most important definitions. Given the example that you're a Facebook user, you are called a "data principal". Facebook is the "data fiduciary", and the entity that processes your data for, say, advertising purposes is a "data processor".
3/n

Next we understand data categories. Most provisions deal with "personal data" because the bill doesn't apply to "anonymised" data.

(Clause 91, however, empowers the Central government to ask fiduciaries (like Facebook) and processors to provide anonymised data).

4/n

Now, who will enforce this law?
A "Data Protection Authority" will be the main regulator. Its will protect your interests and ensure compliance with the Act. For example, it can ask fiduciaries to provide any relevant info and issue directions which they must comply with.
5/n

What are YOUR rights?
Your personal data can't be processed without informed consent which is valid only if it is freely given, clearly expressed, and capable of being withdrawn. But consent is bypassed in case of unlawful activities, security, and search engines operation.
6/n

You have the right to obtain your personal data and a summary of activities performed on it, correct/complete/update it, receive it and transfer it to any fiduciary, restrict it if it is no longer necessary. Please refer to the blog post for more details on your rights.
7/n

Now in your interest, data fiduciaries (again, like social media platforms) have certain obligations imposed on them. Each data fiduciary must implement a privacy-by-design policy that explains how your privacy and data security is going to be ensured throughout processing.
8/n

Fiduciaries must make some info available to you, like categories of personal data generally collected, manner of collection, purposes for which personal data is processed, categories processed in exceptional situations, and the procedure for your exercise of your rights.
9/n

Fiduciaries and processors must implement security safeguards:
- De-identification, encryption, etc
- Steps to protect integrity of personal data
- Steps to prevent misuse/unauthorised access/destruction/etc of personal data
- Periodic reviews of their security safeguards
10/n

Lasly, the Bill provides for a variety of exemptions, many to the government. These are some of its most criticised sections, and rightly so. Take a look:
11/n

We hope this was helpful in furthering your understand of the Bill! In the next edition, we're going to do a deep dive into the many challenges of the bill, and how the movement for #DigitalRights in India can address them.

RT, like, share, and ask us questions!
12/n