The Data Protection Authority as provided for in the Draft Data Protection Bill, 2021 veers towards State interests, and there are notable ambiguities in its working as prescribed in the Bill. These issues must be urgently addressed, write SAMIKSHA LOHIA and PARUL ANAND..———–.ON December 16, 2021, the Joint Parliamentary Committee [JPC] published its report on the Union Ministry of Electronics and Information Technology's Personal Data Protection Bill, 2019. The report contains the Draft Data Protection Bill, 2021 [Bill]. Chapter IX of the Bill concerns itself with the functioning and powers of the Data Protection Authority of India. The Authority is an important wing of the newly proposed data protection apparatus in India, and demands close and careful examination to understand its implications for the Indian citizen..The Bill delineates a central authority tasked with personal data protection, laying down its functioning, powers and other logistics. Here, we analyse the provisions under Chapter IX of the Bill, and propose some ways to eliminate the various legal lacunae present therein..“There is a conspicuous absence of representation of citizen interests, as well as an absence of representation from corporate or industry interests from such a pivotal body..The Bill does not outright anticipate decentralization in its text but regardless provides a way to achieve so should it be deemed desirable. Understanding the size of the Indian subcontinent and therefore the volume of collective personal data that is to be processed, the process of decentralization is crucial. Although there are inevitably going to be teething problems, establishing a well spread out apparatus to increase ease of access and justice in data protection rights through decentralization should nevertheless be a key policy goal..Also read: A Sound Data Protection Authority is the Need of the Hour.Heavy hand of State in composition of Authority.Concerns arise about the composition of the Authority and its composition. Barring one member, who is to be an expert, all other members are from the government, or indirectly controlled or affected by it. The six pivotal members are the Cabinet Secretary; the Attorney General of India; the Secretary to the Government of India in the Ministry or Department dealing with Legal Affairs; the Secretary to the Government of India in the Ministry or Department dealing with Electronics and Information Technology; an independent expert to be nominated by the Union Government from the fields of data protection, information technology, data management, data science, data security, cyber and internet laws, public administration or related subjects; a Director of any Indian Institute of Technology, to be nominated by the union government; and a Director of any Indian Institute of Management, to be nominated by the union government..Uniform in all the members contemplated is the pervasiveness of a government presence. There is an absence of independent voices. Even the independent expert is to be nominated by the union government. There is a conspicuous absence of representation of citizen interests, as well as an absence of representation from corporate or industry interests from such a pivotal body. The heavy hand of the State is manifest over the Authority..No deputy chairperson.Section 46(2) of the Bill refers to the event of absence of the Chairperson in a meeting of the Authority. It decrees that should the Chairperson be unable to attend any meeting of the Authority, any other Member chosen by the Members present at the meeting shall preside. Section 42(1) specifies the composition of the Authority – one Chairperson and a maximum of six whole-time Members. However, the Bill does not make any provision for an instance where the Members do not agree upon who will preside at the meeting. It is reasonable to foresee that there may be a situation where there is a disagreement by tie among the members since they are even in number. Hence for these purposes, the union government must provide for a Deputy Chairman who may be one of the members of the Authority..“What offence involves or does not involve moral turpitude is arbitrarily up to the union government's discretion. It is not difficult to imagine how this opens the door for potentially arbitrary decision-making..Other lacunae.Much like the appointment of members, in the removal process as well, the union government has leeway. For instance, as per Section 44(c), one of the grounds for removal is conviction for an offence which in the union government's opinion involves moral turpitude. It is not difficult to imagine how this opens the door for potentially arbitrary decision-making. What offence involves or does not involve moral turpitude is arbitrarily up to the union government's discretion..Section 46(4) provides for a circumstance of a member's vested interest – direct or indirect – in a matter being taken up for consideration by the Authority. In such a situation, that member (say, 'Member A') will not be allowed to take part in any deliberation regarding the matter and must disclose the nature of their interest..Now, humans operate on self-interest motives. The theory of psychological egoism states that an individual is always motivated by his perceived self-interest. Therefore, if Member A has a vested interest in a matter, logically, they would not disclose such interest in order to maintain it. As an extension of this argument, it must also be noted that there is no provision allowing other members of the Authority to disclose the existence of Member A's vested interest should they know of its existence. If one or more members are aware that Member A has a possible direct or indirect interest, they should be allowed to declare so. However, at the same time, to protect Member A from false declarations, this provision must allow for Member A to justify or defend themself against said declaration to the satisfaction of the Chairperson..Section 47 of the Bill states that no act or proceeding of the Authority shall be invalid merely by reason of — (a) any vacancy or defect in the constitution of the Authority; (b) any defect in the appointment of a person as a chairperson or member; or (c) any irregularity in the procedure of the Authority not affecting the merits of the case. A vacancy or defect in the constitution of the Authority means that the source of the action becomes essentially illegitimate as acts are performed in the presence of the source being not in a manner as was anticipated by the lawmakers. For pragmatism, invalidating an act or proceeding merely on the basis of a vacancy or defect seems appropriate, however it challenges the true intention of the drafters; at the very least, the act should be ratified when the composition is complete or taken back if a grave misjudgement occurs. The aim of the Bill is to protect data protection rights, and thus a specific composition of the Authority is chosen to further such aims; if that is violated, the aim also is compromised. One has to tread cautiously between outright rejecting an act or proceeding on the grounds laid down in this provision, but also acknowledging the importance of such elements regardless..The Authority is meant to represent wide ranging interests from the common citizens to industry giants, from the State to social pressure groups. It is the institution that stands as a barrier between the general public and an infringement of privacy by the State. It cannot afford to have any question marks over its functioning. The role and powers of the Authority must not contain any arbitrariness or ambiguousness, due to the sensitive nature of what it handles..“The role and powers of the Authority must not contain any arbitrariness or ambiguousness, due to the sensitive nature of what it handles..The current Data Protection Authority- as put forth in the Bill- veers a bit too much for comfort towards the State. It is essential that the Authority does not act as an instrument for ensuring the propaganda of State interests. The preponderance towards State interests as against the various interests the Authority ought to represent spells deep concern for everyone involved, and needs to be remedied..We are a democracy and in a democratic nation, the voices of the people must be heard. By tilting excessively towards the State, the Authority runs afoul of the principles on which our nation was built. The union government and civil society must realise this, and lobby on this issue so as to reach a solution which is mutually beneficial, non-arbitrary and non-despotic..(Parul Anand and Samiksha Lohia are first year undergraduate law students at the National Law University, Jodhpur. The views expressed are personal.)
The Data Protection Authority as provided for in the Draft Data Protection Bill, 2021 veers towards State interests, and there are notable ambiguities in its working as prescribed in the Bill. These issues must be urgently addressed, write SAMIKSHA LOHIA and PARUL ANAND..———–.ON December 16, 2021, the Joint Parliamentary Committee [JPC] published its report on the Union Ministry of Electronics and Information Technology's Personal Data Protection Bill, 2019. The report contains the Draft Data Protection Bill, 2021 [Bill]. Chapter IX of the Bill concerns itself with the functioning and powers of the Data Protection Authority of India. The Authority is an important wing of the newly proposed data protection apparatus in India, and demands close and careful examination to understand its implications for the Indian citizen..The Bill delineates a central authority tasked with personal data protection, laying down its functioning, powers and other logistics. Here, we analyse the provisions under Chapter IX of the Bill, and propose some ways to eliminate the various legal lacunae present therein..“There is a conspicuous absence of representation of citizen interests, as well as an absence of representation from corporate or industry interests from such a pivotal body..The Bill does not outright anticipate decentralization in its text but regardless provides a way to achieve so should it be deemed desirable. Understanding the size of the Indian subcontinent and therefore the volume of collective personal data that is to be processed, the process of decentralization is crucial. Although there are inevitably going to be teething problems, establishing a well spread out apparatus to increase ease of access and justice in data protection rights through decentralization should nevertheless be a key policy goal..Also read: A Sound Data Protection Authority is the Need of the Hour.Heavy hand of State in composition of Authority.Concerns arise about the composition of the Authority and its composition. Barring one member, who is to be an expert, all other members are from the government, or indirectly controlled or affected by it. The six pivotal members are the Cabinet Secretary; the Attorney General of India; the Secretary to the Government of India in the Ministry or Department dealing with Legal Affairs; the Secretary to the Government of India in the Ministry or Department dealing with Electronics and Information Technology; an independent expert to be nominated by the Union Government from the fields of data protection, information technology, data management, data science, data security, cyber and internet laws, public administration or related subjects; a Director of any Indian Institute of Technology, to be nominated by the union government; and a Director of any Indian Institute of Management, to be nominated by the union government..Uniform in all the members contemplated is the pervasiveness of a government presence. There is an absence of independent voices. Even the independent expert is to be nominated by the union government. There is a conspicuous absence of representation of citizen interests, as well as an absence of representation from corporate or industry interests from such a pivotal body. The heavy hand of the State is manifest over the Authority..No deputy chairperson.Section 46(2) of the Bill refers to the event of absence of the Chairperson in a meeting of the Authority. It decrees that should the Chairperson be unable to attend any meeting of the Authority, any other Member chosen by the Members present at the meeting shall preside. Section 42(1) specifies the composition of the Authority – one Chairperson and a maximum of six whole-time Members. However, the Bill does not make any provision for an instance where the Members do not agree upon who will preside at the meeting. It is reasonable to foresee that there may be a situation where there is a disagreement by tie among the members since they are even in number. Hence for these purposes, the union government must provide for a Deputy Chairman who may be one of the members of the Authority..“What offence involves or does not involve moral turpitude is arbitrarily up to the union government's discretion. It is not difficult to imagine how this opens the door for potentially arbitrary decision-making..Other lacunae.Much like the appointment of members, in the removal process as well, the union government has leeway. For instance, as per Section 44(c), one of the grounds for removal is conviction for an offence which in the union government's opinion involves moral turpitude. It is not difficult to imagine how this opens the door for potentially arbitrary decision-making. What offence involves or does not involve moral turpitude is arbitrarily up to the union government's discretion..Section 46(4) provides for a circumstance of a member's vested interest – direct or indirect – in a matter being taken up for consideration by the Authority. In such a situation, that member (say, 'Member A') will not be allowed to take part in any deliberation regarding the matter and must disclose the nature of their interest..Now, humans operate on self-interest motives. The theory of psychological egoism states that an individual is always motivated by his perceived self-interest. Therefore, if Member A has a vested interest in a matter, logically, they would not disclose such interest in order to maintain it. As an extension of this argument, it must also be noted that there is no provision allowing other members of the Authority to disclose the existence of Member A's vested interest should they know of its existence. If one or more members are aware that Member A has a possible direct or indirect interest, they should be allowed to declare so. However, at the same time, to protect Member A from false declarations, this provision must allow for Member A to justify or defend themself against said declaration to the satisfaction of the Chairperson..Section 47 of the Bill states that no act or proceeding of the Authority shall be invalid merely by reason of — (a) any vacancy or defect in the constitution of the Authority; (b) any defect in the appointment of a person as a chairperson or member; or (c) any irregularity in the procedure of the Authority not affecting the merits of the case. A vacancy or defect in the constitution of the Authority means that the source of the action becomes essentially illegitimate as acts are performed in the presence of the source being not in a manner as was anticipated by the lawmakers. For pragmatism, invalidating an act or proceeding merely on the basis of a vacancy or defect seems appropriate, however it challenges the true intention of the drafters; at the very least, the act should be ratified when the composition is complete or taken back if a grave misjudgement occurs. The aim of the Bill is to protect data protection rights, and thus a specific composition of the Authority is chosen to further such aims; if that is violated, the aim also is compromised. One has to tread cautiously between outright rejecting an act or proceeding on the grounds laid down in this provision, but also acknowledging the importance of such elements regardless..The Authority is meant to represent wide ranging interests from the common citizens to industry giants, from the State to social pressure groups. It is the institution that stands as a barrier between the general public and an infringement of privacy by the State. It cannot afford to have any question marks over its functioning. The role and powers of the Authority must not contain any arbitrariness or ambiguousness, due to the sensitive nature of what it handles..“The role and powers of the Authority must not contain any arbitrariness or ambiguousness, due to the sensitive nature of what it handles..The current Data Protection Authority- as put forth in the Bill- veers a bit too much for comfort towards the State. It is essential that the Authority does not act as an instrument for ensuring the propaganda of State interests. The preponderance towards State interests as against the various interests the Authority ought to represent spells deep concern for everyone involved, and needs to be remedied..We are a democracy and in a democratic nation, the voices of the people must be heard. By tilting excessively towards the State, the Authority runs afoul of the principles on which our nation was built. The union government and civil society must realise this, and lobby on this issue so as to reach a solution which is mutually beneficial, non-arbitrary and non-despotic..(Parul Anand and Samiksha Lohia are first year undergraduate law students at the National Law University, Jodhpur. The views expressed are personal.)
