Personal Data Protection Bill Enables Government To Access Users’ Data; Likely To Worry Facebook, Google And Others

The government would have all power and right to seek access to users' data “to help formulate policies”, according to the Personal Data Protection Bill, which has been circulated among Members of Parliament.

However, the final version of the Bill has also seen the government backing down from its previously strict stance on data localization.

The relevant section of the Bill reads, “Nothing in this Act shall prevent the central government from framing of any policy for the digital economy, including measures for its growth, security, integrity, prevention of misuse, in so far as such policy do not govern personal data. The central government may, in consultation with the Authority, direct any data fiduciary or data processor to provide any personal data anonymised or other non-personal data to enable better targeting of delivery of services or formulation of evidence-based policies by the Central Government, in such manner as may be prescribed”.

“Non-personal data” means data other than personal data.

This is likely to cause trouble for Facebook, Google, Amazon, Flipkart, Uber and others who could be asked to share data for making policies by the government.

The Bill will be introduced in the Parliament in the current session, but won't be passed since the session concludes on December 13. It will be referred to a parliamentary panel for review further.

The Bill's latest version has a provision empowering the government to ask a company to provide anonymized personal data, as well as other non-personal data, to help target the delivery of government services or formulate policies.

The final Bill also seeks social media intermediaries, like Facebook and Twitter, to allow Indian users to “voluntarily verify” their accounts in a manner which could be prescribed in the future. This method of “voluntary verification” has not been laid out by the Bill. It only states that any user who voluntarily verifies his account “shall be provided with such demonstrable and visible mark of verification”.

Section 28 of the Bill notes, “(3) Every social media intermediary which is notified as a significant data fiduciary under sub-section (4) of section 26 shall enable the users who register their service from India, or use their services in India, to voluntarily verify their accounts in such manner as may be prescribed.(4) Any user who voluntarily verifies his account shall be provided with such demonstrable and visible mark of verification, which shall be visible to all users of the service, in such manner as may be prescribed”.

The Bill has defined “personal data” as information which can help identify a person and has characteristics, traits and any other features of a person's identity.

The Bill has defined any other data as non-personal, without elaborating it. The Bill has also mentioned large social media platforms should be required to offer a mechanism for users to prove their identities and display a verification sign publicly, a move that would raise a host of technical issues for companies including Facebook, WhatsApp and Chinese app TikTok

According to the Bill, “sensitive personal data”, which includes financial and biometric data, could be transferred outside India for processing, but must be stored locally.

The Bill draws its origins from the Justice B N Srikrishna Committee on data privacy, which produced a draft of legislation that was made public in 2018.