Thread by @medianama

🚨Day 2 of MediaNama’s conference on Decoding India’s Data Protection Bill is going live soon #DataProtectionBill2021

Today we have the following sessions for you: #DataProtectionBill2021

We had shared a reading list with participants prior to the discussion. You may find the reading list at medianama.com/2022/01/223-sp… #DataProtectionBill2021

The discussion will be live streamed on . Please feel free to share this link on social media or with friends/colleagues who might be interested. #DataProtectionBill2021

LIVE🔴Powers of the Data Protection Authority is now being discussed at Decoding India's Data Protection Bill. We will dissect, among other things, the independence of the DPA, penal provisions and coordination with other regulators.#DataProtectionBill2021

Powers of DPA - Session Chair: S Chandrasekhar, K&S Partners; Speakers: @resanering (Associate Professor, @nipfp_org_in), Alok Prasanna Kumar (Co-founder and Lead, @VidhiKarnataka) and @nixxin (@medianama). #DataProtectionBill2021

Getting DPA right is key to getting the Data Protection Law right. - #chandrasekhar #DataProtectionBill2021

JPC doesn't seem to have put too much thought into idea of regulators, jumps directly into specifics. Highlights lack of serious thought. - #alokprassanakumar #DataProtectionBill2021

I counted 15 different functions for DPA. No one is going to be able to perform these functions on day 1. There needs to be more clarity here. - #alokprassanakumar #DataProtectionBill2021

My concerns are about regulating the regulator. Expanse of DPA is far bigger than any other regulator we have seen India. Chances are there that DPA may misbehave.- @resanering #DataProtectionBill2021

My core thought on this issue is can the DPA inspire confidence in users? Will citizens get justice? Will the DPA be responsive and have the capacity? - @nixxin #DataProtectionBill2021

The scope of people in the Selection Committee for the DPA must be widened. Although it has been expanded in the latest Bill, it is bizarre. I don't know what the director of IIM will bring to the table. - #alokprassanakumar #DataProtectionBill2021

DPA's role is confusing when it comes to how it will deal with public sector. If govt doesn't want the DPA to look at public sector it has to be clear rather than stand on both sides and be unclear. - #alokprassanakumar #DataProtectionBill2021

It should be set out very clearly in law who should be adjudicating officers. It has to be someone who has in-depth level of knowledge on this subject not just some retired judge. - #alokprassanakumar #DataProtectionBill2021

DPA should be set up with an entrepreneurial zeal not like other regulators in the country. We need somebody who provides that entrepreneurial spirit. Which means DPA must learn to move quickly, take up challenges that sets the tone - #alokprassanakumar #DataProtectionBill2021

The practices of DPA must be codified. How will it make regulations, what is the process, what is the cost/benefit analysis it will do, etc. Similar there needs to be clarity on the enforcement aspect. - @resanering #DataProtectionBill2021

- The way the Bill came together lacks transparency. TRAI functions more transparently at least with the comments it receives from the public. - @nixxin #DataProtectionBill2021

DPA needs more capacity. To that end, state-level DPAs are a good idea. These state-level offices can take up initial complaints, etc. - @nixxin #DataProtectionBill2021

DPA needs to have budgetary independence with a guaranteed annual budget which allows it to be staffed adequately and DPA's budget should be periodically reviewed for increase and not be decreased at any point - @nixxin #DataProtectionBill2021

With the current Bill, the DPA might have to take a back seat when it comes to other regulators for overlapping issues. Because the other regulators are sector-specific. - #alokprassanakumar #DataProtectionBill2021

We need to get into agreement with different regulators over jurisprudence and precedence. For example, with banking data, does RBI have say over DPA. - @resanering #DataProtectionBill2021

There are dozen of regulators in India, so do we really need to reinvent the wheel? What is the regulator that is closest in framework to build a DPA? Or do we build from scratch? - #chandrasekhar #DataProtectionBill2021

I don't think any regulator in India comes close to DPA. We could have same structure as to what division sits where but in terms of manpower and in terms of codifications of processes we do not have much precedence - @resanering #DataProtectionBill2021

List of what best practices can be borrowed from other regulators is very small. But can model TRAI for consultative processes. - #alokprassanakumar #DataProtectionBill2021

What role will DPA play in data sharing between govt ministries? Not much. That data sharing will be done in the name of national security. If it needs to be examined, we needs something entirely different from the DPA we have now. - #alokprassanakumar #DataProtectionBill2021

The way we have to frame regulations on non-personal data are completely different. And at this point it should not be under the purview under DPA. And it is also not the right time to do it. - @resanering #DataProtectionBill2021

Regulatory capture is a real issue that regulators and countries around the world are facing but I think it's actually good that people from private sector come to government cause it gives them exposure. - @resanering #DataProtectionBill2021

To access comprehensive reporting and discussions on Indian tech policy, subscribe to MediaNama: medianama.com/subscription. #DataProtectionBill2021

More important for adjudicating officer to be competent than "independent" from DPA, because you have the Appellate Tribunal and then the Supreme Court to go after that. Not particularly concerned about who appoints the officer. - #alokprassanakumar #DataProtectionBill2021

LIVE 🔴 | Our second session is on User Rights and the Data Protection Law where we’ll take a closer look at the rights the bill gives users on their data, from the right to be forgotten to the right to portability. #DataProtectionBill2021

User Rights - Session Chair: @jimanish (@CPR_India); Speakers: @VrindaBhandari (Independent Legal Practitioner, Supreme Court of India), @ambersinha07 (Executive Director, @cis_india) and @somesortofpanda (Senior Resident Fellow, @Vidhi_India) #DataProtectionBill2021

Rights of users are not just limited to the one chapter that is specified in the Bill. Bill is scattered with rights throughout. Govt has been given a positive duty to legislate to give users their constitutional right to privacy.- @somesortofpanda #DataProtectionBill2021

Govt has all the power to exempt any agency from all provisions of the Act and Bill is framed such a way that its reasoning cannot be challenged - @VrindaBhandari #DataProtectionBill2021

The flavour of the Bill is now different. When Puttuswamy happened it was privacy, when Srikrishna Bill came out it was business and economy. Now there is also protection of state. Privacy has been diluted to less than 30 percent now. - @prasanna_s #DataProtectionBill2021

The Bill appears to invert the logic of how it came into existence. It came from Puttuswamy case which came from Aadhaar in which the government was the bad boy. - @prasanna_s #DataProtectionBill2021

Structurally similar to GDPR. There are some key differences but Bill mirrors GDPR in terms of user rights for the most part. But there is less clarity on how we will go about enforcing the law. - @ambersinha07 #DataProtectionBill2021

Does Bill do enough to protect users with its data breach notification rules? Intuitively 72 hours seems a lot. Why that threshold? If you know some data has been breached why not notify immediately. - @somesortofpanda #DataProtectionBill2021

@somesortofpanda Purpose specification is a considerable concern in case of Aadhar. We have little bit of confusion over what kind of specificity is needed. We have felt that principles that GDPR are vague so we have disregarded them - @somesortofpanda #DataProtectionBill2021

Companies will now start facing a lot of requests. Companies may have a privacy policy but nobody is checking if they are complying with it. Rights enshrined statutorily will see a lot of compliance. - @VrindaBhandari #DataProtectionBill2021

We could see a lot of lawyers being involved as legal representatives. Right to erasure is not the same as right to be forgotten although they are often conflated. It will very important for credit and insurance. - @VrindaBhandari #DataProtectionBill2021

I do not think the change they have made to right to data portability is going to work in practice in terms of how they will deal with trade secrets. We will have to see what it means. - @VrindaBhandari #DataProtectionBill2021

@VrindaBhandari The bill is a litigator's dream. This concept of orientation of harm and continued burden placing on data subject to establish harm is an issue. There has to be an incentive for people to file as many harms are not forseeable. - @prasanna_s #DataProtectionBill2021

All the rights will have to be litigated and won. These rights have not been granted under any statutes. - @prasanna_s #DataProtectionBill2021

Litigation will depend on the kind of remedy you are trying to seek. There is no obligation on data fiduciaries if they have done their due diligence by informing the DPA. The action can only be taken against DPA. - @VrindaBhandari #DataProtectionBill2021

On a question of right to be forgotten, @somesortofpanda says that there is an exception in the bill related to journalism, the requirements are not strictly enforced, you have to be able to show that it was for a public purpose. #DataProtectionBill2021

There is a bit of overlap with right to be forgotten and erasure. The person has a choice on which route to take. In terms of policy-making, there has to be a clear choice. Right to be erasure should be removed as it is currently phrased - @somesortofpanda #DataProtectionBill2021

Every word (retain, use, and process are used separately) comes under the term 'processing' which is a problem. - @VrindaBhandari #DataProtectionBill2021

The provision which said purpose must be specific is gone. The JPC has missed out on the importance of purpose specification and has put a provision which is redundant. - @somesortofpanda #DataProtectionBill2021

Not all problems are going to be solved by this bill. This bill has enough of a flavour, it is the overall reading of the bill that you see, it is very easy for a judicial authority to conclude that this bill will have to give in. - @prasanna_s #DataProtectionBill2021

I am distrustful of the term 'authorised by law' or its utility. There is a political economy of interests both in terms of state and the industry. It is the duty of those who drafted this bill to protect it from political economy concerns. - @ambersinha07 #DataProtectionBill2021

Wish list: We want the principles of compensation because we understand privacy is a fundamental right. A sui generis nature to arrive at the principles of liability. - @prasanna_s #DataProtectionBill2021

Surveillance reform, like an amendment to Clause 36 like removing private parties to take that exemption, I would change the structuring of DPA, I would remove non-personal data, and have only one right to be forgotten or erasure. - @VrindaBhandari #DataProtectionBill2021

Bringing back purpose specification and purpose collection limitation provisions, I keep harping on about redrafting Clause 12 liek limited situations for non-consensual processing of data. - @ambersinha07 #DataProtectionBill2021

Rights in the data protection law depend on the independence of the data protection authority which is missing in the bill. - @somesortofpanda #DataProtectionBill2021

The authority is going to collapse under the weight of its own functioning. Some of its functions need to be moved to adjudicating officers and other bodies. - @jimanish #DataProtectionBill2021

Are you interested in supporting future discussions at the cutting edge of Indian tech policy? Please reach out to us at medianama.com/events

LIVE 🔴 | Our last session for the day is on Government Access to Data. During this session, we want to take a closer look at the government’s powers over data, whether through blanket exemptions or control of the DPA. #DataProtectionBill2021 "

Session Chair: @vaneeshaj (Associate Partner,Saikrishna & Associates);

Speakers: @iamanushkajain (Associate Counsel, @internetfreedom), @saikatd (Founding Partner, @DeepStrat_LLP) and @JhalakKakkar (Executive Director, @CCGNLUD) #DataProtectionBill2021

Watch Session 3 on Government Access to Data live: #DataProtectionBill2021

It enables surveillance and it is very disappointing because everyone was hoping against hope that the bill will reform surveillance in India. These exemptions are expedient which can mean anything. - @iamanushkajain #DataProtectionBill2021

The same leeway will not be given to private entities or corporations in the bill. The private entities will be held strongly to purpose limitations framework that the bill will put in place so that's interesting. - @vaneeshaj #DataProtectionBill2021

If they are to follow all the legal norms that are existing today, they can just do it at the stroke of a pen without any deliberation why someone's records are needed or why someone needs to be surveilled. - @saikatd #DataProtectionBill2021

There is no procedure or justification which actually works for giving access to data or there is any barely monitoring to speak of, data protection bill gives full exemption to anyone central government thinks is good enough. - @saikatd #DataProtectionBill2021

Sometimes we feel like we are a broken record because we have reiterating the same issues for few years. The bill does have the language of necessity but it also has the language of expedient. - @JhalakKakkar #DataProtectionBill2021

One of the challenges in the bill is that the language does not align with the language of the courts. It is likely to be challenged and it is likely that the court will hold it to be unconstitutional. - @JhalakKakkar #DataProtectionBill2021

This does not comply with the standards laid down in the Puttuswamy judgement. The govenrment is being a judge in their own cause. It is not clear what role the DPA is going to play. The government has walled itself out of the bill. - @JhalakKakkar #DataProtectionBill2021

There is carte blanche for censorship. The whole idea of constitution is to limit powers of the govenrment. There is a situation where agencies which will access data come under no law. - @saikatd #DataProtectionBill2021

PDP bill does not talk about surveillance at all. NATGRID will not be impacted by the bill. The bill evades surveillance reform and chooses interest and security of the state over its citizens. - @iamanushkajain #DataProtectionBill2021

NATGRID does not flow from any act or law. The data protection bill is not going to help and I do not want to be defeatist but that is how it is. - @iamanushkajain #DataProtectionBill2021

What other countries do well is they have a lot of requirements in the law itself. Most countries have a clear process that applies in how the access can be granted, the extent to which the information can be shared. - @JhalakKakkar #DataProtectionBill2021

We do not have laws that underpin frameworks like NATGRID. We have to think about how we are going to hold government accountable. One hope is the Pegasus committee that was set up by the Supreme Court. - @JhalakKakkar #DataProtectionBill2021

When it comes to surveillance, nobody in the world is doing it right. It should be mandatory that any data collected has to end up in a court of law. - @saikatd #DataProtectionBill2021

Under the bill, as it stands, you approach the data protection authority which has independence issues. What we need is a strong and a powerful DPA which will act as an actual regulatory body. - @iamanushkajain #DataProtectionBill2021

When we talk about the DPA as a regulator, we need to keep in mind competence, capability and capacity which comes from technical expertise. We need to keep in mind the financial capacity. - @JhalakKakkar #DataProtectionBill2021

When we are talking about government access to data, we need to keep in mind that the judiciary was hesitant in the Puttuswamy judgement. - @JhalakKakkar #DataProtectionBill2021

I do not think there are protections in the bill. If Delhi Police is asking you for data, on what grounds will you deny furnishing the data? if. you have shared with one agency, you have shared with all exempted agencies. - @iamanushkajain #DataProtectionBill2021

The power under Clause 35 is very broad on what the government can specify by order. It has delegated all the power to the order issued by the government. It will all depend on what that order looks like. - @vaneeshaj #DataProtectionBill2021

No rules have been framed yet under this law. It can cater to fair reasonable procedure but the substantive power of the law is very broad. - @vaneeshaj #DataProtectionBill2021

@vaneeshaj When it comes to protecting our data, they have put in place cumbersome methods in order to prevent us from protecting our data. On top of it, you have also put in place the DPA at the mercy of the central government. - @saikatd #DataProtectionBill2021

The conflation of public and state interest is massively problematic. Many times state interest is in direct tension with public interest. It comes down to implementation and independence. - @JhalakKakkar #DataProtectionBill2021

The bill draws a distinction between the idea of exemption and exceptions. What is the need of blanket exemptions where you are not even considering consent as a threshold requirement. You are saying right to privacy does not apply to us. - @vaneeshaj #DataProtectionBill2021

At the very least, the name of the bill should be changed to Data Access Protection Bill where you protect any means to access data. - @saikatd #DataProtectionBill2021

@saikatd Wish list: I feel there should be information provided to individuals whose data has been accessed so they can know who has accessed their data. We need clarity in the language of the provisions at the very least. - @vaneeshaj #DataProtectionBill2021

The smartest people in tech policy read MediaNama. Subscribe today to access our reporting, member-only discussions and much more. medianama.com/subscription. If you would like to support discussions like this one, please reach out at medianama.com/events. #DataProtectionBill2021

And that’s a wrap! Thank you for joining us for the last day of Decoding India’s Data Protection Bill. We hope to see you again for our next event. #DataProtectionBill2021

We’d like to thank our sponsors Meta, Flipkart, Google and Star India for supporting us. We are thankful to our partner, Alliance of Digital India Foundation (@adif_India) for their help in putting together this programme. #DataProtectionBill2021

In case you wish to revisit the video of this discussion, it’s available on YouTube #DataProtectionBill2021

@threadreaderapp unroll