By Bhumika Sharma
Privacy of Netizens in India By Bhumika Sharma Source section: Relevant Today | Magazine pages: 26–29
Introduction
Privacy can be understood as a right to a personal space in which one can exercise practical rationality without interference from others. Privacy has always remained a much demanded call, as a right significant for personal development and liberty. Technological advances, socio-cultural transformation and economic development have raised the concerns regarding privacy. The industrial age (prior in time to electronic age) gave legal acceptance to the right of privacy as per the conditions of that time. The concerns regarding privacy in the digital world have abounded in recent times, especially since last decade. The stunning developments taking place in the information technology are easy to penetrate and disrupt have inverted traditional paradigms.
The right of privacy, covering face to face communications as well as digital life is far from secure today. The enormous information acquisition, transfer and processing power of cyberspace are viewed as exposing them all to more and more frequent and pernicious invasions of their privacy. The sheer quantity of information; the ability to collect unobtrusively, aggregate, and analyze it; the ability to store it cheaply; and the ubiquity of interconnectedness are capable of eroding the protection to personal information. With change and development in the means to erode privacy with the passing time, the means to protect have also improved. In India, a citizen’s right to privacy emanates from Article 21 of the Constitution as interpreted by the Supreme Court in various judgments.
India’s commitment to recognize the right to privacy is also based upon constitutional obligation under Article 51 (c) of fundamental law of land in view of a signatory to Universal Declaration of Human Rights, 1948 and International Covenant on Civil and Political Rights. To buckle up with the requirement of providing legal safeguards for electronic transactions, in 2000, India came up with The Information Technology Act, 2000. Since the conditions under which The Information Technology Act, 2000 came into operation (i.e. in 2000) have, however, changed from the current scenario, amendments are being made to make it reactive.
The provisions which provide for protection of privacy under the amended Information Technology Act, 2000 are Sections 43 (e), (g), (i), (j) dealing with penalty and compensation for damage to computer, computer system, etc; Section 43A dealing with compensation for failure to protect data; Section 66C dealing with identity theft; Section 66E dealing with violation of privacy; Section 72 dealing with breach of confidentiality and privacy of electronic records, books, information, etc; and Section 72A dealing with disclosure of information in breach of lawful contract. The act of committing breach of privacy under the Information Technology Act, 2000 is thus subject to both criminal and civil liabilities.
Current technologies and laws thus seem to fall short of providing the legal and technical infrastructure to secure digital lives. This calls for the need to redefine privacy in the context of network run world. So under the more risk-prone situations, the issue how to protect privacy these days is dominating the thoughts of the policy-makers too. Though, privacy as an inalienable right has many dimensions, the present paper consistent with its objectives has a narrower scope—focusing on privacy in the cyberspace and only to the extent it is vulnerable in the electronic era. The concern here is not with the traditional conception of privacy and its evolution, but with the position of privacy in a society where all data and information is stored and transferred in bits and bytes.
The absence of specific legislation principally concerned with privacy in India has left room for invasions of individuals’ rights, demanding a consideration in the light of developments around. Against this backdrop, the present paper makes an attempt to throw light on the protection afforded to the right of digital privacy in India. Eventually, the emergence of strong legal safeguards adopted in India shall be discussed. With these objectives, the paper has been divided into two main parts. The part titled “Legal Stance Regarding Privacy in India” aims to engage in a study of the framework of laws relevant in the context of privacy, discussing the nature and extent of protection surrounding an information-run society. The next part, “Protection of Privacy beyond 2011,” describes in brief the prospective laws, pending in the form of Bills germane to privacy. It is hoped that this paper may enlighten not only legal researchers but policy makers and technology developers to understand and implement security principles in the Indian cyber digital privacy framework. The study is purely doctrinal having no empirical basis.
Legal Stance Regarding Privacy in India
Even before 2000, privacy concerns existed for internet users, which were unsystematically taken care of by various patchworks of laws. Turning to the original position of the laws, The Information Technology Act, 2000 (IT Act, 2000) came into existence back in 2000, followed by amendments and has now evolved with various Allied Rules made under the IT Act, 2000. These amendments from time to time are themselves a reaction against the proliferating recognition of absorption and assimilation of digital ways of life and their accompanying perils.
The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Information) Rules, 2011 (ITRSPPSPI Rules) have taken Indian legal provisions dealing with protection of digital privacy ahead in its voyage from wilderness of adequate provisions to a track of gleam of light. India, taking example from international practices and standards, enacted the ITRSPPSPI Rules by virtue of power vested under Explanation (ii) of Section 43A, read with Section 87(2)(ob) of the Information Technology Act, 2000. With these Rules, India for the first time took a substantive step to protect sensitive personal information.
Sensitive personal information covers passwords, financial information such as Bank account or credit card or debit card or other payment instrument details, physical, physiological and mental health condition, sexual orientation, medical records and history, biometric information, any detail relating to the above clauses as provided to a body corporate for providing service, and any of the information received under above clauses by a body corporate for processing, stored or processed under lawful contract or otherwise. The ITRSPPSPI Rules, 2011 have tried to fulfill the dearth of a coherent framework of protection for privacy interests to a large extent. The ITRSPPSPI Rules, 2011 though exclude the government from liability, the government is under an obligation to adhere to privacy policies under various existing laws as well as under prospective laws.
Section 8(1) in general enlists the circumstances when information may be denied to a person seeking such information under the Right to Information Act, 2005. Most of the provisions of Section 8(1) spell out denial of information as a social interest of non-disclosure taking over the individual right to be informed. At the same time, Section 8(1) and Section 9 also incorporate those situations where information has to be denied for protecting two conflicting interests of non-disclosure and being informed.
The Credit Information Companies (Regulation) Act, 2005 and Credit Information Companies Regulations, 2006, and The Payment and Settlement Systems Act, 2007 are also some of the important laws having provisions regarding privacy in India.
Protection of Privacy beyond 2011
Even with a miscellaneous array of laws in favour of the privacy right, the exigency to improve the present protection mechanism will never come to an end. Reshaping the cyber affairs regulatory framework governing privacy between 2000–2011 still continued to protect it in a piecemeal, inadequate manner. It is increasingly realized that the answer to privacy issues does not lie in the hands of the policy makers alone, rather many stakeholders have a role to play in reshaping the dreadful state of cyber affairs into a privacy-friendly environment. Comprehensive protection of privacy is possible with the concerted efforts of law-making agencies, law-enforcing agencies, software developers, and users (both individuals and private or government organizations).
Draft Bills are therefore being proposed to deal with the protection of privacy and provide for electronic delivery of services.
National Identification Authority of India Bill, 2010 The Unique Identification Authority of India was constituted and notified by the Planning Commission on 28 January 2009 as an attached office under the aegis of the Planning Commission with an initial core team of 115 officials. The role and responsibilities of the UIDAI were laid down in this notification. The UIDAI has been given the responsibility to lay down plans and policies to implement the UIDAI scheme and shall own and operate the UIDAI database and be responsible for its updation and maintenance on an ongoing basis. IT-based identification is a move toward individual-oriented programs, enabling ‘anytime, anywhere’ authentication.
A Bill has been proposed for the establishment of the National Identification Authority of India for the purpose of issuing identification numbers to individuals residing in India and to certain other classes of individuals, and the manner of authentication of such individuals to facilitate access to benefits and services to which they are entitled. The UIDAI has the obligation to ensure the security and confidentiality of the data collected. The Authority shall take measures (including security safeguards) to ensure that the information in the possession or control of the Authority (including information stored in the Central Identities Data Repository) is secured and protected against any loss or unauthorised access or use or unauthorised disclosure thereof. Disclosure of information in certain cases is allowed.
Chapter VII provides for penalties for disclosing identity information, unauthorized access to the Central Identities Data Repository, tampering with data in the Central Identities Data Repository, impersonation of an ID number holder by changing demographic information or biometric information, manipulating biometric information, etc.
Electronic Delivery of Services Bill, 2011 It proposes that the Centre, states, and public authorities will have to deliver all public services electronically within five years of the commencement of the Act, bringing in transparency in public dealings and checking corruption. It requires every Department of the appropriate Government to publish the public services which are to be delivered through electronic mode; the date by which each such service shall be made available through electronic mode; the manner of delivery of such services and their service levels; and the grievance redressal mechanism available to any person aggrieved about the outcome of any request made by him for such service through electronic mode. The Central Government may, from time to time, prescribe electronic governance standards as may be necessary for ensuring interoperability and security. The philosophy of non-disclosure (privacy) has always been applied in India, covering within its purview even the government. Both the National Identification Authority of India Bill, 2010 and the Electronic Delivery of Services Bill, 2011 create a duty upon the service provider, i.e., the government, to ensure the privacy of data collected by it.
Draft Privacy Bill, 2011 Unofficial copies have become available of a Draft Privacy Bill, 2011, dated April 19, 2011 and marked as a ‘Third Working Draft (For Discussion and Correction)’ from India’s Legislative Department. The Bill mainly seeks to create a Data Protection Authority of India (DPAI), a statutory right of privacy, a regime to control surveillance activities, etc.
The right of privacy of an individual shall include confidentiality of communication, confidentiality of private/family life, protection of honor and good name, protection from search, detention, or exposure of lawful communication between and among individuals, privacy from surveillance, confidentiality of banking and financial transactions, confidentiality of medical and legal information, protection from identity theft (criminal, financial, identity cloning, medical), protection from use of photographs, fingerprints, DNA samples, and other samples taken at police stations or other places, privacy of health information, and protection of data relating to an individual. The Privacy Bill, 2011 is competent enough to provide comprehensive protection to privacy but at the same time to empower the State to make bugging possible.
Post-2011, the right of privacy may become secondary and surpassed by the State’s right of surveillance. The scope of the right of privacy increased and will continue to increase during the present phase—a move towards a general right, subject to limitations.
Conclusion
The increasing insight regarding possible uses of information or data has advanced new concerns regarding privacy. A changeover can be noticed over the past years in the legal framework governing privacy in India. The concept of compensation for loss, existent under both the Indian Contract Act, 1872 and The Specific Relief Act, 1963, has now matured under new laws such as the Information Technology Act, 2000 and is also enrooted under the Draft Privacy Bill, 2011. The Information Technology Act, 2000 started with a modest beginning to endow basic rights and has been since 2000 trying to absorb and offer better legal safeguards to netizens. By the ITRSPPSPI Rules 2011, India made an attempt to truly transform the horizons of legal protection. If information technology continues unfettered, then use of the digital persona will inevitably result in impacts on individuals which are inequitable and oppressive, and in impacts on society which are repressive. The need to protect digital privacy has intensified by ever-increasing threats posed by the dynamic nature of cyberspace. The urgent concern calls for a new approach embracing the participation of netizens as individuals as well as various organizations.
The impending nature and unintended consequences of cyber-threats hurtling forward at break-neck speed need to be checked by anticipated legal responses. The passing of the Bills that are underway may vastly extend the range of protection and complete the framework and foundation of the privacy rights of netizens in India. Let us hope that in 2015, the Parliament will be able to enact proposed Bills and be successful in extending privacy protection to netizens.