Rights groups deliberate legal challenge to India's data protection law amid privacy concerns

The Digital Personal Data Protection Act was passed by both houses of the Parliament in August

Rights groups are considering the possibility of a legal challenge to India's Digital Personal Data Protection Act. This potential legal action could pose a significant obstacle for the Indian government and the DPDP Act, which was passed in Parliament amid concerns that certain provisions of the law may infringe upon the Right to Privacy and could potentially enable surveillance activities.

The legislation officially became a law on August 11, after President Draupadi Murmu provided her assent.

"As is the case with any legislation that has a negative impact on the constitutional rights of Indians, we are exploring all options, including advocacy and litigation, as potential responses," Prateek Waghre, Policy Director of the Internet Freedom Foundation told Moneycontrol.

The digital rights group has previously raised concerns against the provisions that mandate that government and private bodies can process data of a citizen without their consent (certain legitimate uses). They have expressed concern over the amendment to the RTI Act which exempts the government from disclosing personal information of public officials.

Similarly, Delhi-based Software Freedom Law Centre (SFLC.in) will make a decision regarding a potential legal action after the rulemaking processes for the DPDP Act have been finalised. If the DPDP law, in its current form, offers a legislative framework, the process of rule-making will be responsible for defining its specific parameters.

"The Act has been passed in the same form that it was introduced (in Parliament), with the same concerns," Arjun Adrian D’Souza, Legal Counsel at SFLC.in told Moneycontrol. "There are certain aspects of the DPDP Act which may have adverse implications for which we may explore a legal challenge. However, at this stage, we are still waiting to see how the rules under the DPDP Act will take shape before taking any decision on the matter," D'Souza added.

Also read: What the Digital Personal Data Protection Act means for you

SFLC.in too, has been vocal against specific provisions of the DPDP Act, particularly in relation to the amendment to the RTI Act, blocking powers of the Data Protection Board and so on. They are also a petitioner in the Kerala High Court against the government's recent order to block a few messaging apps in the country.

IFF and SFLC.in are two of the many voices opposing the legislation, including Opposition Parliamentarians, media groups and so on. Moneycontrol has also reached out to Editors Guild of India, the media industry body, which had earlier said that the DPDP Act will impact press freedom. The article will be updated when a response is received.

In recent years, several legislation and rules of the government have been met with legal challenges including changes to the various provisions of the Information Technology (IT) Rules 2021, government's proposed fact check unit and so on.

However, any possible legal challenge to the DPDP Act is likely to have far reaching implications, as the country grapples to find a balance between protecting a citizen's personal data and ensuring that the government's responsibilities are met with respect to when it comes to national security, law and order.

Points of concern in the Act

Lawyers and digital experts have criticised the government for giving itself wide exemptions from the provisions of the Bill. The Editors Guild of India said that these provisions will clamp down on press freedom and could lead to surveillance.

Retired Judge BN Srikrishna, who headed the committee that drafted the PDP Bill in 2018, said that the exemptions in the Bill were far "worse" when compared to the PDP (Personal Data Protection) Bill.

Also read: All you need to know about Personal Data Protection Bill 2019, and why it was withdrawn

Legal experts have also raised questions regarding the independence of the proposed Data Protection Board whose members are to be appointed by the government. Experts had also earlier said that the powers of the DPB were “very limited and vague" when compared to those set up by the European Union's General Data Protection Regulations and the UK's Data Protection Act.

Provisions for penalties also fall short of those stated in the European Union's GDPR or similar laws in China, legal experts said. The Bill proposes amendments to the RTI Act, which would mandate that the personal information of public officials will not be disclosed under the RTI Act.