Blog Details

What is data protection and why is it needed?

Data protection generally refers to formulating robust governmental policies and legislations to regulate the collection, storage, and circulation of data. This is done to maintain the privacy of an individual. In the contemporary world, data is highly weaponizable and prone to misuse. A benign online shopping experience can turn into a nightmare when malicious persons steal bank account information and other private details. Data protection helps in the prevention of infringement of privacy or the leak of sensitive information. Moreover, data stored online can be used by enemy forces to plan and coordinate an offense. 

Hence, regulation of the flow of information and its protection is highly important for any country. Many countries have realized its importance and have implemented legislation for the same, e.g., European Union has formulated GDPR.

What is the status of such a law in India?

A data protection law is long overdue in India. India currently does not have a single, all-encompassing statute for the same. The government relies on the Information Technology Act, 2000, and the (Indian) Contract Act, 1872. 

But that soon changed when a high-level expert group headed by former Supreme Court Judge BN Sri Krishna put together the Personal Data Protection Bill, 2018. It was tabled in the Lok Sabha in 2019 and immediately sent to a joint parliamentary committee. The JPC recently put forward 81 amendments and 12 major recommendations, due to which, it was withdrawn. 

In the words of the Union Electronics and Information Technology Minister Ashwini Vaishnav, "Considering the report of the JCP, a comprehensive legal framework is being worked upon Hence, in the circumstances, it is proposed to withdraw 'The Personal Data Protection Bill, 2019' and present a new bill that fits into the comprehensive legal framework,". 

The constitutional validity of the right to privacy and the contents of the bill

The constitution does not explicitly grant the right to privacy, but recently, in the landmark case of Justice K S Puttaswamy (Retd.) & Anr. vs. Union of India and Ors., the constitution bench of the Hon'ble Supreme Court has held the Right to Privacy as a fundamental right, subject to certain reasonable restrictions.

The bill proposes far-reaching changes in users’ data collection, storage, and dissemination by social media companies. It proposes to set up a Data Protection Authority (DPA) that will oversee the use of users’ data by social media companies. The bill proposes these companies create a mechanism so that “every user who registers their service from India or uses their service from India, a voluntary verifiable account mechanism has to be made". This is added mainly to check online trolling. The bill classifies data into three categories—critical, sensitive, and general. Sensitive data include financial, health, sexual orientation, biometrics, transgender status, religious or political beliefs, and affiliation. Such data can be stored only in India. 

The bottom line

The constitution sanction of the right to privacy has put into motion a new era of legislation that will protect the online presence of the people of India. It will further restrict social media companies from manipulating users’ data for monetary motives. It will also strengthen India's national security as the most vulnerable and gullible will be protected under the act.