C&L_December 2017 (1)

Cover Story+
Towards an Indian Data
Protection Regime
Extracts from the issues raised for discussion by the expert
committee appointed to create a draft data protection bill for India
By CIO&Leader
On 24 August 2017, in a historic judgment, a ninejudge
bench of the Supreme Court ruled that
right to privacy is a fundamental right, while
hearing a case on the legality of Aadhaar.
“We are in an information age. With the growth and
development of technology, more information is now
easily available. The information explosion has manifold
advantages but also some disadvantages. The access to
information, which an individual may not want to give,
needs the protection of privacy. The right to privacy is
claimed qua the State and non-State actors. Recognition
and enforcement of claims qua non-state actors may
require legislative intervention by the State,” Justice Sanjay
Kishan Kaul, one of the judges, said in his judgment.
“There is an unprecedented need for regulation
regarding the extent to which such information can be
stored, processed and used by non-State actors. There is
also a need for protection of such information from the
State,” he noted.
“We commend to the Union Government the need
to examine and put into place a robust regime for data
protection. The creation of such a regime requires a careful
and sensitive balance between individual interests and
legitimate concerns of the state,” noted Justice DY Chandrachud’s
judgment, delivered on behalf of four judges
including then then CJI Jagdish Singh Khehar.
Towards a Data
Protection Regime
By that time, the government had already appointed a
committee to look into the issues regarding enacting such
a legislation, under the chairmanship of Justice B N Srikrishna,
former Judge of the Supreme Court. Their brief
was to identify key data protection issues and recommend
methods for addressing them and ultimately come out
with a draft data protection bill. The other members of the
committee are Ajay Bhushan, CEO, Unique Identification
Authority of India; Ajay Kumar, Additional Secretary,
MeitY; Arghya Sengupta, Research Director, Vidhi Center
for Legal Policy; Aruna Sundararajan, Secretary, Department
of Telecom; Gulshan Rai, National Cyber Security
Coordinator; Rajat Moona, Director, lIT, Raipur; Rama
Vedashree, CEO, Data Security Council of India; and
Rishikesha T Krishnan, Director, IIM, Indore.
Four months after it was formed, on 27 November, the
committee released a detailed whitepaper outlining all the
issues that they found to be relevant, seeking responses
from the public on these questions.
The document goes into various issues, discusses how
other such legislation such as EU’s GDPR have handled
it and has listed its views on those issues while raising
explicit questions. The last date for submission for the
responses is 31 December, unless it is extended.
14 CIO&LEADER | December 2017