Thread by @internetfreedom

India's incoming data law confers more power than ever to the State for surveillance, with little accountability.

This is a grave concern because the passing of the Data Bill is now inevitable.

Here's a breakdown of how this will happen. Thread.
1/n
internetfreedom.in/dataprotection…

India's State surveillance mechanism hinges on two facts:

1. The government and law enforcement administer a wide range of surveillance projects on citizens.

2. Several provisions under the law empower the State to engage in surveillance.

Now, let's look at data bill.
2/n

1. Under the Data Protection Bill, Clause 35 enables the Central Government to exempt, by order, ANY agency of the government from ANY provision of the Bill, in the interest of reasons such as national security. Remember - these provisions exist to protect your data.
3/n

2. As per the Right to Privacy judgement, anything that intrudes on your privacy must be justified on parameters of necessity and proportionality. Clause 35 replaces proportionality with *expediency*. This opens further doors for the State to justify intrusions of privacy.
4/n

3. When the State releases orders to exempt its agencies from provisions of the bill, they should be in writing and contain reasons. But these are not subject to review! In fact the State determines its own oversight mechanism in this matter, becoming a judge in its own case.
5/n

4. The State can exempt any of its agencies on very ambiguous grounds such as public order or prevention of incitement. For example, nothing would prevent the Centre from invoking grounds of security to exempt the entirety of the NPR from provisions of the Bill!
6/n

5. Under Clause 36, law enforcement agencies are exempt from provisions except the obligation to process your data fairly and reasonably, and to maintain security safeguards. But the Bill doesn't mandate that exemptions should be granted only when necessary and proportionate.
7/n

The Srikrishna Committee's report had warned that ‘the pillars of a data protection law should not be shaken by a vague and nebulous national security exemption’. The Bill does exactly what was feared by the Committee under Clause 35.
8/n

Our data protection law needs surveillance reforms! Exemptions to the State must be restricted, and surveillance by exempted agencies must be authorised by an Act of Parliament and judicial authority. An oversight structure must be made part of the architecture of the DPA.
9/n

Clause 35 can render your rights and protections under the Bill redundant. Mass surveillance is an egregious form of surveillance and is unsuitable in any democratic society. Thus, there needs to be an explicit ban on mass surveillance.

Share this summary on Clause 35!
10/n