We need to have checks and balances in law enforcement, even though technological advancements will allow us to take shortcuts. Else we will not be able to prevent state overreach that affects the fundamental rights of citizens.
An analysis of the JPCs draft of the data protection bill has some welcome changes - the amendments to children’s data and the introduction of Section 62 that allows complaints to be filed. It also has some misguided changes such as the introduction of NGOs in the definitions. It also has changes that will have a significant impact such as the amendments to Section 35 and 36 on exemptions to law enforcement. Finally it introduces some new concepts that are problematic such as the requirement that data protection officers in companies need to be senior officials and the inclusion of non-personal data within the ambit of the law.
When there were limited uses to which data could be put, it was easy to evaluate the harms that could result from providing consent. Things are much more complex today so data protection regulations have tried to improve the quality of consent. This has resulted in the transparency paradox. If we can adopt consent templates we can give users appropriate autonomy.
Every evolution of communications technology from the printing press to the telegraph to telephones and eventually the internet has placed new and different stresses on personal privacy. As much as we welcome these technologies when launched, in time we realise the effect that they can have on personal privacy. The whole point of communicating is to violate your privacy in a controlled way. But if we do not have information about all the ways in which a given communication can affect your privacy you cannot really exercise effective control over it.
Identity is a prerequisite for the provision of services and efficient identity systems are necessary to scale digital public infrastructure. We can build back trust in identity systems through encryption and tokenisation of identity information by using privacy preserving technologies like zero knowledge proofs so that we can still establish eligibility for a service without exposing identity information.
Issues of privacy and competition often overlap and we need a coordinated approach between regulators. That works in the US and EU where both the privacy and the competition regulators are active. In India, where we are yet to establish a privacy regulator, the competition commission will step in and regulate privacy aspects of data businesses from a competition perspective. There is a risk that privacy will be decided from a competition perspective. We need a data protection authority asap.
The Competition Commission of India has argued that since privacy is a non-price factor of competition, the competition regulator can regulate it. Privacy is a specialised area that should not be entrusted to a regulator that brings a purely economic lens its regulation.
The Data Empowerment and Protection Architecture framework allows data companies to collect consent for data portability just before transfer, simplifying privacy policies and focusing them on data collection and use. This unbundling of consent improves user control over personal data and enhances privacy.
The European Court of Justice’s ruling on the US-EU Privacy Shield, impacts global data transfer practices. This decision, highlighting the importance of local laws in data protection, may lead to increased data localization, affecting countries like India and beyond, potentially restricting European data within Europe’s borders.
The article “The Right to Privacy” by Samuel Warren and Louis Brandeis, published in 1890, has been influential in shaping modern privacy law. This foundational work has indirectly contributed to securing protections for the LGBTQ+ community, including influencing decisions that decriminalized homosexuality in the U.S. and India. But recent scholarship suggests that Warren’s motivation for writing the article may not have been what we thought it was.
