Today, August 9, is a historic day for India — one that will be remembered as the day the government signed away the rights of millions after the hasty passage of privacy-damaging legislation
Parliament’s upper house, the Rajya Sabha, passed the infamous Digital Personal Data Protection Bill, 2023. Contrary to its title and stated objective of protecting the right to privacy, the Bill does more harm than good to fundamental rights. Once the Bill receives the President’s assent, India will have a data protection law that grants unchecked powers to the government, including on censorship, while jeopardising the rights to information and free speech.
It is alarming that over 10 years since India began its journey towards a data protection law, six years after the Indian Supreme Court’s landmark judgment protecting privacy as a fundamental right, and seemingly-ignored rounds of consultation with civil society highlighting the Bill’s many pitfalls, we will have a law that risks our personal data more than the legal vacuum did.The fact that the government rushed the legislation through parliament in barely a week, amidst walkouts, calls for further consultation, and requests to address surveillance reform is a disservice to the people of India and our democracy.Raman Jit Singh Chima, Asia Pacific Policy Director at Access Now
The rushed Bill was passed with little engagement from parliamentarians. Despite civil society’s outcry, no substantive amendments were made.
The passage of India’s Data Protection Bill in its current form is a missed opportunity. It’s a bad law. With the potential damage reaching beyond India’s borders, all eyes will be on how the law evolves to mitigate the damage to rights and uncertainties to cross-border data flows. All doors to ensuring rights-respecting evolution and implementation of the Bill must be forced open —– people in India, and in countries sharing their data with India, are counting on it.Namrata Maheshwari, Asia Pacific Policy Counsel at Access Now
By passing the Bill, India rejected the chance to be a global leader and establish a world-class data protection law that complements the often-cited growth of its digital economy and digital public infrastructure. The country instead, is setting a bad precedent globally, severely undermining people’s rights, and risking India’s portrayed leadership in the digital space, including in the G20 processes that the country is presiding over.
The Bill is set up for failure in any legal challenge given its clear contradictions with the Indian Supreme Court’s Puttaswamy judgment in 2017, which held that necessity and proportionality standards must apply to any restriction on the right to privacy. To preserve the rights of people across India, and in countries that share their data with India, the government must ensure that all rules made under the Bill are passed after meaningful stakeholder consultation, and debated in both houses of parliament.