Srikrishna Committee Report And Draft Data Protection Bill - Initial Statement

The Expert Committee chaired by Retd. Justice B.N. Srikrishna submitted its 176 page report to the Minister of Electronics and Information Technology at 1600 Hrs on 27 July 2018 (today). The Committee also submitted a draft of the legislation on data protection titled, ‘The Personal Data Protection Bill, 2018’. After weeks of secrecy, denial of information in RTIs about the proceedings of the Committee, the report as well as the draft legislation have now been placed in public domain. It is a welcome step to see a comprehensive data protection and privacy framework finally publicly proposed for India - home to over 1/5th of the world’s population and the second largest internet user base.

In the August last year, a month after the constitution of this ten-membered committee, the Supreme Court had delivered its landmark Puttaswamy judgment interpreting the right to privacy as a fundamental right. The judgment was expected to work as the guiding principle of the experts’ committee. It is our hope that the bill provides a substantive manifestation of the fundamental right to privacy and plugs the hole in Indian legal framework where no effective data protections rights, regulation, and remedy exist.

Now that the report and the Bill have been submitted to the Ministry, it will consider the bill, perhaps make amendments and then may choose to bring the bill to Parliament - for enactment. It remains to be seen whether the Ministry places the Bill in the on-going Monsoon session of Parliament or not. The onus now lies on the Union executive and eventually the Parliament of India to provide our nation a comprehensive data protection and privacy framework. Having said that, it is important that a thorough and transparent public consultation is now undertaken on the Draft Bill before it is passed by Parliament. The Government is mandated to do so under its own Pre-Legislative Consultation Policy of 2014.

While the development of a data protection framework in India is encouraging, many gaps reveal themselves in the current documents submitted by this government committee:

1. Many exceptions for processing of data by the government can be seen. This seems to dilute the rights of the citizens with respect to their data vis a vis the State.


2. There is a dire need for surveillance law reform in India. It was our hope that this effort would provide a comprehensive framework overhauling surveillance and interception in India - in consonance with the international standards on necessary and proportionate principles, along with providing proper judicial scrutiny. However, the report and bill does not seem to provide substantive changes in the surveillance regime in India.


3. As noted in an official dissent by certain members of the committee, Rishikesha T. Krishnan and Rama Vedashree, the provisions for keeping a copy of all data in India is concerning. This move towards data localisation takes away from the open character of our global internet and is disproportionate to the benefits (if any) it would achieve.

We would like to point out that there have been previous attempts at proposing laws for the protection of data and privacy, including expert recommendations like the Report of Group of experts on Privacy under Justice AP Shah and the draft bill prepared internally within the Union Government across 2011-2015. There have also been attempts in the past to reform our intelligence agencies with respect to their surveillance and interception functions, as well as place them under some form of legal oversight. But it isn’t clear how much of these past attempts have informed the proceedings of the current Committee and its recommendations. We are in the process of going through the bill and the report in a much more comprehensive manner. We shall be providing a detailed take on the bill as well as an evaluation of the bill when compared to the seven privacy principles proposed in the Indian Privacy Code, 2018.

This is an important day for the nation - in its move towards securing the rights of its citizens. The report is not the end of the process, but instead marks the beginning of the development of a comprehensive data protection and privacy regulation in India. We hope to continue engaging with the government and our elected lawmakers, and continue the struggle to #SaveOurPrivacy. A strong privacy and data protection law must come into force before our next general election - this is a critical step to protect our increasingly digital democracy.