According to a recent study by ASSOCHAM-NEC, India witnessed a spike in cybercrime by 457% under the Information Technology (IT) Act, 2000 between the year 2011-2016.
The unabated rise in mobile users and the government’s inability to create a draft policy on data privacy and protection has contributed significantly to the rise in cybercrime, the study indicates. Due to high internet penetration rate, India has been ranked a third in the list of countries with the highest number of the internet with a CAGR of 44% from 2012-2017.
Though the government has turned to technologies like artificial intelligence, big data analytics, facial recognition, IoT, it has only been done in certain pockets of the country. Highlighting the role of central government to nurture and support state-level enforcement agencies to utilise the best of these technologies, it said that there is a greater need for Government to pump in more money for its national-level adoption.
Quoting the example of developed economies, the study said that despite having a strong data privacy law already in place, most of these governments are constantly amending the existing law to adapt to the cyber threats of the 21st century.
In an attempt to breakdown India’s complicated relationship with data privacy and concerns regarding it, we list out some of the existing laws and recent developments in the area.
What Is Data Protection?
Data protection is a set of privacy laws, policies and procedures in place to bring down intrusion into an individual’s privacy caused by the collection, storage and dissemination of personal data.
What Are The Existing Laws?
The constitution of India does have an exclusive law regarding the fundamental right to privacy. Instead, it has included the right to privacy into other fundamental rights such as freedom of speech and expression under Art 19(1)(a) and right to life and personal liberty under Art 21 of the Constitution of India.
Though there is no exclusive law, India laws dealing with data protection are the Information Technology Act, 2000 and the (Indian) Contract Act, 1872.
Another important law is The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. It deals with the protection of sensitive personal data or information of a person, which includes information regarding a person’s passwords, financial information, medical records and history, biometric information etc.
Recent Developments
The Personal Data Protection Bill, 2018 is likely to be introduced in Indian Parliament in June this year. The bill gives the citizens and internet users the complete right over their data to know how and where their data is being used. It also grants them the upper hands to withdraw their consent.
First drafted in 2010, the bill has been reworked and redrafted several times, but none of the version has been formalised as yet. In July 2018, a 176-page report was drafted by a ten-member expert committee headed by retired Indian Supreme Court Justice BN Srikrishna. According to the latest report, the bill received as many as 600 sets of feedback from various stakeholders.
Challenges To The New Bill
One of the main features of the bill is that it requires companies like Facebook, Google and other foreign internet intermediaries to store a copy of Indian citizen’s data on a server or local data centre within India. Concerns regarding data localisation have prompted the US, Britain and industry associations to write to the India Minister of Electronics and IT regarding the government’s move.
Another crucial and much controversial aspect of the bill is the degree of ownership that it has vested upon the government to use its citizen’s data. As per the bill, the government can process personal data to maintain law and order, this gain brings back to the same question, How safe will our data be in the hands of government considering the weak surveillance that is in place currently.
