What A New Data Law Must Have

Here are the five key points GoI should remember while re-drafting the bill

- Sreenidhi Srinivasan & Nehaa Chaudhari

The law must minimise the amount of data collected by security agencies, limit how long it can be stored, and require agencies to adopt security measures to safeguard the information

GoI has withdrawn the Personal Data Protection Bill 2019 from Parliament, and the IT ministry is reportedly finalising a new draft. We go back to the basics: What should an ideal data protection law look like?

Focus on personal data, leave out the non-personal

Our new law should focus on personal data and exclude non-personal data. Personal data is data about an individual or which relates to one, for example, our name, phone number, chat history, credit history, profile details etc. In contrast, non-personal data is not about any individual – data about traffic and diversions, soil trends, weather patterns, or aggregate data such as the number of cab users in a locality are a few examples.

Five years ago, the Justice BN Srikrishna committee was asked to come up with a law to protect personal data, given the fundamental right to privacy. While the committee’s draft focussed on personal data, GoI’s 2019 version included non-personal data. Later, a parliamentary committee examining the law suggested a common regulator and law for personal and non-personal data.

Therefore, the objective to protect personal data has been diluted. While personal data protection is about allowing an individual to control how information about her is used, nonpersonal data regulation is about economic aims. Conflating these disparate objectives in a single law dilutes both.