Civil Society Releases Draft Model Law On Privacy And Data Protection; Launches Community Project, #SaveOurPrivacy

A group of lawyers and privacy policy analysts on Friday unveiled a community project called "Save our Privacy" and released a draft model law on privacy and data protection. The project is backed by the Internet Freedom Foundation, a non-profit organization aimed at protecting digital rights.

The Draft Model Bill

Titled the "Indian Privacy Code, 2018", the Bill advocates for establishment of  Privacy Commission comprising at least three commissioners appointed by the President. It envisages a penalty of up to Rs. 1 crore and a prison sentence of three years for people who "collect, receive, process or hold personal data" in contravention of the provisions of the proposed law. The punishment goes up to Rs. 10 crore and five years in prison for "sensitive data". It talks about penalizing companies found violating the law as well.

"This is a policy fix for the recurring concerns and controversies including issues such as Aadhaar, Cambridge Analytica, the Social Media Communication Hub and the Snowden revelations on mass surveillance," the project said in a statement, adding, "We believe that a data protection law that protects people should consider preventing any dilution to the right to information, reform state surveillance and interception of our communications, most importantly prevent the denial of legal entitlements and subsidies caused due to weak user rights."

The campaign now invites endorsements and comments on the draft model bill, through an online tool that permits line by line, word by word annotations. It hopes that by doing this, it will "facilitate greater public and expert participation".

A copy of the Bill has been sent to the Justice B.N. Srikrishna Committee for a data protection framework for India as well, writing, "We are trying to adopt the highest standard of transparency to ensure that autonomy, dignity and privacy are protected in a data protection law. We believe that the formulation of a privacy statute for our republic must be a public process with the widest possible citizen and stakeholder engagement, aimed at putting in place and enforcing the highest standards of privacy oversight and rights regarding data for all Indians."

Seven principles of the Indian Privacy Code

The draft bill commits itself to certain core values, based on best global practices adapted to India. The drafters have referred to the Privacy (Protection) Bill, 2013, analyzing it on the framework of the report of the Justice A.P. Shah Committee of Experts and submissions by multiple lawyers to the Justice Srikrishna Committee of Experts.

Besides, it also takes into consideration the landmark Supreme Court judgment in the case of Justice K.S. Puttaswamy v. Union of India, along with best practices from international texts such as the European Union’s General Data Protection Regulation. Nevertheless, comments can be sent on these principles as well, through an email to contact@saveourprivacy.in. The seven principles are:

1. Individual rights are at the center of privacy and data protection


2. A data protection law must be based on privacy principles


3. A strong privacy commission must be created to enforce the privacy principles


4. The government should respect user privacy


5.  A complete privacy code comes with surveillance reform


6.   The right to information needs to be strengthened and protected


7. International protections and harmonization to protect the open internet must be incorporated

A word from the drafters

The Code has been drafted by lawyers Apar Gupta, Gautam Bhatia, Kritika Bhardwaj, Maansi Verma, Naman M. Aggarwal, Praavita Kashyap, Prasanna S, Raman Jit Singh Chima, Ujwala Uppaluri and Vrinda Bhandari. All of them have been involved in the Aadhaar case currently pending before the Supreme Court, and most of them had been a part of the group of 24 legal academicians and advocates who had written to the Justice Srikrishna Committee, demanding inter alia release of information on its proceedings, meeting notes and draft bill, as well as the comments received by it.

Speaking to LiveLaw, Advocate Gautam Bhatia emphasized on their draft being inclusive of not just the principles laid down by the Supreme Court, but also of the peoples' suggestions, saying, "The mandate of the Srikrishna Committee is limited to data protection. But we believe that a piecemeal approach to issues that are fundamentally interconnected - data protection, privacy, surveillance reform, the right to information, and many more -  may not be ideal.

We have attempted to draft a comprehensive Citizens' Privacy Code that places the individual at its heart, and carries forward the Supreme Court's remarkable privacy judgment. We also want to make it thoroughly inclusive - the draft code is online, and any person who wishes can comment on it, and on every clause."

Advocate Apar Gupta, on the other hand, highlighted the need to balance the law with concerns on dilution of the citizens' right to information. He told LiveLaw, "We believe the Indian Privacy Code, 2018 even though a model draft that will change and become better in time, puts through a comprehensive statute, a user right focused data protection law. This is a common legislative measure for the recurring concerns and controversies including issues such as Aadhaar, Cambridge Analytica, the Social Media Communication Hub and the Snowden revelations on mass surveillance.

We believe that a data protection law that protects people should consider preventing any dilution to the right to information, reform state surveillance and interception of our communications, most importantly prevent the denial of legal entitlements and subsidies caused due to weak user rights."