The DPDP Bill Does Little To Protect The Fundamental Right To Privacy: Justice BN Srikrishna

In July 2017, the ministry of electronics and information technology (MeitY) appointed a 10-member Srikrishna Committee, under the chairmanship of Justice BN Srikrishna, to submit a detailed report on privacy and draft the Personal Data Protection Bill.

The committee submitted its draft in 2018. However, at a time when the draft Bill was going through multiple amendments, the Government of India decided to sideline it and released a new draft – The Digital Personal Data Protection Bill, 2022.

In this interview, Inc42 speaks with Justice Bellur Narayanaswamy Srikrishna to understand his views on the latest draft Bill released by MeitY.

While commenting on the Bill, Justice BN Srikrishna said that it is good for government agencies and could prove to be beneficial for business entities as well; however, it does little to guard the fundamental right to privacy of individuals. Excerpts…

Inc42: What do you think about the latest Digital Personal Data Protection Bill (DPDP) Bill, 2022? Is it really as simple as the government claims it to be?

Justice BN Srikrishna: It is simple with regard to simple things but does not rise to the level required for complex things. For example, it gives too much margin to the government and does little to protect individuals’ fundamental right of data privacy.

Inc42: Will it be able to safeguard data principals from government agencies if the latter chooses to misuse or abuse the former’s privacy?

Justice BN Srikrishna: If the Bill gets passed as it is, it will not be able to safeguard citizens or individuals against the poaching of data and misuse thereof by government agencies.

Inc42: On page No. 6 of the Bill draft, it says the Act will only be applicable to automated data. In India, where still much of digital data is handled through WhatsApp and manual processes, does the draft cover such data processing, particularly in situations where one decides to exercise her right to withdraw?

Justice BN Srikrishna: I think this is a glaring loophole. Making the Bill applicable only to digital data leaves open offline and hard copies of data maintained out of its purview. There is no law today that mandates that all personal data must be maintained digitally, and an entity may choose to maintain personal data offline or on hard copies to avoid compliance with the law.

Inc42: In your draft, fine details were given regarding how the Data Protection Authority should be made and about the selection of its members. The Data Protection Board misses this point. What difference will it make?

Justice BN Srikrishna: The Data Board will become a captive entity of the government and completely lack the independence that is required for a regulator.

Inc42: In your opinion, how could it impact the stakeholders such as data principals and fiduciaries?

Justice BN Srikrishna: Privacy rights of data must be proportionate to the type of data. For example, the privacy of personal health data is different from the personal data maintained by a shoe manufacturer. Further, the extent of privacy rights of sensitive data and critical data are inherently different and must be recognised. The new draft of the Bill has completely failed to maintain this qualitative difference.