Thread by @internetfreedom

#DataProtectionTop10
We’re discussing consent in part 3 of our series, analysing the issues in the Data Bill. From letting your employers spy on you to denying you essential services, a thread on how the safety net of consent is torn in the Bill. (1/n)
internetfreedom.in/dataprotection…

Consent is said to be valid under the Bill, if it's given freely, informed, specific, clearly expressed & is capable of being withdrawn. There are exceptions to the State, employers, etc. which debilitate user control over personal data, detrimentally affecting our rights. (2/n)

Exceptions under clause 12 essentially legitimise the collection and processing of personal data by the State for projects like Aadhar, as it can process personal data without user consent for certain purposes, like the provision of services, benefits, or certifications. (3/n)

The issue is then of overbroad exceptions, harming our right to privacy. To avoid this, the Sri Krishna Committee Report had recommended that the processing of personal data be restricted to certain entities of the State and certain functions to avoid vagueness in the law. (4/n)

The vague wording of clause 11 on what constitutes 'valid reasons' may lead to the denial of essential services. We're well aware in the pandemic that such denial of services like healthcare is harmful, especially if this happens just because they couldn’t show their Aadhaar! 5/n

Clause 13 of the Bill turns your employer into Big Brother. The broad exceptions given to employers not only harm our fundamental right to privacy, but can adversely impact the employees' fundamental right to unionise guaranteed under Article 19(1)(c) of the Constitution. (6/n)

The exception in Clause 14 on processing publicly available personal data without consent stem from the fundamentally flawed notion that there is no reasonable expectation of privacy in public places. This is worrisome, as it could lead to the profiling of individuals. (7/n)

At a time when digitisation & social networking are commonplace, such exceptions are detrimental. The Government & big techs would no longer require the consent of individuals for aggregating their social networking activities & their sentiments on various issues. (8/n)

We recommend precise definitions since these exceptions, if not worded clearly, may end up swallowing the rule. From safeguards on essential services to employee-protection from workplace surveillance, consent, our data protection regime's bedrock, should be secured. (9/n)