Don’t rush personal data protection bill

Don’t rush personal data protection bill

The Personal Data Protection Bill (PDPB), right now under consideration by a Joint Parliamentary Committee (JPC), is big, in its sweep, intent and implications, particularly for future competitiveness of the economy, in terms of data being available to train algorithms that would drive artificial intelligence, even as individual citizens are protected from harm arising from misuse of their data.

The JPC would do well to hasten slowly, and take on board the suggestions of as large a swathe of stakeholders as is possible. Right now, civil society groups, several large companies and even some members of the committee complain that they have not been given a chance to present their views.

Unlike Europe’s General Data Protection Regulation, India’s PDPB subsumes collection of data under processing of data. While the goal of limiting collection and processing of personal data in proportion to the purpose at hand might, at a glance, not be compromised by a bar on disproportionality in processing, there could well be certain cases, in which it makes sense to separate collection from further processing, so as to limit the scope of unintended permission for processing of data beyond collection.

The wording of the regulation should not give scope for babus to penalise companies for no fault of theirs. Giving a detailed notice on data collection and obtaining consent might sound noble, but is likely to be observed more in the breach vis-à-vis illiterate or semi-literate or time-starved rural folk.

Financially autonomous youngsters who are not yet 18 need their parents’ permission for their data to be collected, whereas social media accounts merely require reaching the age of 13.

Holding those who collect data responsible for the accuracy and completeness of the data is unreasonable. Distinctions between sensitive data and critical data, as well as between being forgotten and data erasure, seem overkill that will wrongside companies. All this is over and above the untrammelled access of the State to personal data that the law provides for.