The justice BN Srikrishna committee had been appointed to draft a data-protection law for India on August 2017, following the Right to Privacy ruling. The 10-member panel was expected to present its draft last month, after many delays. But so far, there is still no certain date as to when it will be released.
In the meantime, TRAI has released its recommendations on privacy, security and data ownership in the telecom sector.
There have also been reports of how the Srikrishna committee may ask Google, Facebook and others to store their data locally.
Caravan claims to have got access to the draft of the proposed law, which is tentatively titled, “The Protection of Personal Data Bill, 2018”.
This draft comprising around 15 chapters covers topics such as data localisation, the creation of a data protection authority, data protection measures, separating personal and sensitive data and also proposes some amendments to the Aadhaar Act, 2016 and the Right to Information Act, 2005.
Measures pertaining to the Aadhaar Act 2016
The report goes on to state that the changes to the Aadhaar Act include offline verification process for Aadhaar, increasing or creating civil and criminal penalties for contravening the Aadhaar Act and a new adjudication process to address disputes arising out of Aadhaar. There is a proposal for the appointment of an adjudicating officer above the rank of a joint secretary in the Union government, with the power to make inquiries in case the Aadhaar Act is found to be violated in any manner.
The Telecom Disputes Settlement and Appellate Tribunal has been suggested as the appellate body for any appeal against the appointed adjudicating authority and only appeals from this tribunal will be heard by the Supreme Court.
This really does not change the status quo by much, as the common man still cannot approach the courts in case of any Aadhaar-related disputes. As the report notes, in the current setup, only the Unique Identification Authority of India (UIDAI) can approach the courts in case of any disputes. A look at the number of Aadhaar-related data breaches in the last couple of years and the attitude of UIDAI, which refuses to acknowledge its own shortcomings, should give you enough of an idea of how flawed the system is.
The suggestion by the draft on data protection law on ‘offline’ Aadhaar verification also seems incomplete. Offline verification, under the current Aadhaar Act, cannot be deemed as a method to authenticate, as any authorised body seeking Aadhaar verification does a real-time query with the Central Identities Data Repository (CIDR) which is maintained by the UIDAI. In the case of offline verification, there is no clarity on how it will be executed, even though on the surface it does intend to address issues with authentication, such as poor network connectivity, change in biometric information and so on. But ‘offline’ means there would be no real-time querying of the CIDR database. How then would the Aadhaar identity be verified? Does it mean that the agency doing the offline verification will have access to a local CIDR database? Will the data be stored on a new type of Aadhaar card? What about potential data breaches in these cases? There seem to be no clear directions on this…..Read more>>