“Here’s the new reality: if you were out there collecting information about a consumer, wittingly or unwittingly, and you are using that to mine [data] and sell, that business is going to shut down. It won’t be a free run as far as the use of consumer data is concerned,” Rajya Sabha MP Rajeev Chandrasekhar said at an IAMAI Forum on data protection and privacy yesterday.
He also said, when asked about the impact on innovation, that he strongly believes that “there is no contradiction between what you want to achieve out of privacy, and what you want to achieve with technology. These are not contradictory if you do them in a creative, flexible and open minded manner, where we achieve both these objectives.”
“The issue has been that there’s an imbalance in the way we have things today between consumers of digital products and providers of the same. This is also about evening the balance between corporates and the big guys, and the small guys,” he said during the fireside chat with Google’s Chetan Krishnaswamy. “On the punitive issue: we don’t need to start with people going to jail or [there being] high fines every time they violate the privacy of an individual. But I think we can have a three strikes type of system, with a graded approach. There can be an evolving model of punitive, and punitive it must be. Having been an entrepreneur in telecom, I know that you need laws and enforcement of laws, and for laws to bite for people to even be bothered about it. It’s not just about saying that just do your thing and self regulation will take care of it.”
Some notes from the conversation (excerpted from a much longer chat)
1. Should Consent be done away with? Chandrasekhar strongly believes that consent cannot be done away with in India. “I think as consumer awareness and insight grows, you can start that argument about explicit consent being done away with, and you can have some other way… But in India, where there’s a huge gap between corporate conduct to consumers, and consumers for many years given the short strip. There’s a need for that to be very explicit at the early stages.”
2. Data localisation? There has been a strong push from the current dispensation for data localisation: that data collected in India should be stored in India, owing to national security concerns. In response to MediaNama’s question on data localisation, Chandrasekhar, who has been active on defence and national security issues said that he’s “not even sure of what the merits of this [data localisation] are. This is driven by a national security paranoia or obsession, but whether localisation solves that, I’m not convinced. I’ve said this openly. But having said that, lets be clear that there will always be a school of people who will push for this. The entire nation of China is built around that concept. In a world where the terror and the Internet have been married, in the narrative that we get, the push for, argument for, pressure for, data localisation will be there. How we push back, and say that it really doesn’t solve anything – It’s a good conversation to have – but I’m okay with losing that. I won’t stake my parliamentary career on fighting data localisation. I’ll stake my parliamentary career on fighting the second question [on regulating for harms vs regulating for data collection, below].
3. Regulating data collection, or regulating for harms: One key part of the debate around data protection has been whether you limit data collection, or do you merely watch for harms and regulate when there’s an issue. We asked Chandrasekhar about his views on whether we should only regulate for harms. Chandrasekhar said that his personal view, which he said was open to be challenged, is “that it should be regulated at the time of collection. I don’t believe in putting the onus on the consumer to demonstrate harm. The way laws have been framed in this country is that you can only approach anybody for cause, if you can demonstrate harm. And I’m not in the business, where I’ve been guaranteed privacy as a fundamental right, to say that I’ve been harmed – you’ve breached my privacy and you have harmed me.”
4. On how the data protection law should be framed, and current committee:
“We must understand that we have brought government and the system here kicking and screaming. They didn’t walk into the Supreme Court saying that “we believe privacy is a fundamental right. Now let’s start a conversation on what are the salient points that should go into the law.”
“This is part of the DNA of any legacy government: they have an instinctive negative response to scrutiny, accountability. That’s not unusual. It’s not only to do with the fact that they will also be questioned because they have Aadhaar data, or JDY (Jan Dhan Yojana) data. It is just reflexive. If you look at the IT Act, 43A, 72A, you have all of these issues which leave the government out of the realm of oversight or accountability. This is about making the government realise that they are going to be as accountable as any other entity, vis-a-vis the consumer on issues of data privacy and protection of information.”
“We’re at the first stage of a very important mission, which should be taken very seriously. A mature decent opposition and dialogue about this were all stakeholders are very deeply involved is an absolute must.”
“Whatever we do by way of a conversation should be in the public domain. The process by which we evolve that framework is as important as the framework itself. If we again do the same mistakes that brought us the IT act and section 66A, if we do all of the mistakes that have been the problem of – and I use this word with great respect – bureaucratic architecting of very sophisticated issues. You’ll have a group of people who don’t have the necessary domain depth architecting solutions that are for a very dynamic world, you’ll get very unimaginative and short term solutions. I’m arguing that we have to define the process. The process should be truly multi-stakeholder and open.”
On the Justice Srikrishna committee (on the comment that there are no civil society representatives, and industry is non-existent): “I would expect a classic bureaucratic reaction to a committee: pack them with insiders…Justice Srikrishna is a very respected person, but really, try and push away civil society involvement, industry involvement, activist involvement: that is the instinct and that is not something that is going to work. This is not a way to evolve what is the most modern and contemporary legislative framework that the country wants to enact. The only way to do it is for the committee to have wider, larger more open consultations.”