The digital personal data is exponentially expanding. Hence its safety is of paramount importance to the individuals as well as the government and its agencies who have access to it. 

The issue picked up momentum after the Supreme Court verdict in Puttaswamy case that made right to privacy a fundamental right. The court had stressed on the need for a data protection law and asked the Centre to take steps towards this. 

The apex court’s apprehension was that in the absence of a law there would be no checks and balances on the method, and the extent to which, various personal data are collected and used by the government and private agencies. The passing of the Digital Personal Data Protection Bill, 2023 by Parliament and making it a law is to be seen as a fall-out of the Court’s directive in this regard.

The objective of the Act looks quite innocuous. The introductory paragraph says that it is meant for processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process such data for lawful purposes. But as is the case always, the devil is in the details. 

The definition of personal ‘data’ itself could lead to ‘future shock’ as it includes information, facts, concepts, opinions or instructions in a manner suitable for communication, and interpretation by human beings or automated means. 

To illustrate with an example, an individual’s opinion on the functioning of the government could be construed as against the interests of the state and it could be used by any investigating agency against him or her. 

The biggest drawback of the Act is the leeway it has provided to state agencies, in the form of exemptions, to process personal data. The entity entitled to process personal data could collect and share it which could be used for even surveillance. There is a big concern among people on the increasing personal data breaches and the new Act does not have stringent provisions to take care of those concerns.

The provision that personal data can be processed in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law does not look so innocent; the very fact that the definition of ‘data’ is so wide-ranging, as pointed out above, that it could be misused by the governments.

Whatever be the implications of the new law in the future, it does not seem to deal with situations in which government agencies intrude into personal computers of people and plant stories to implicate innocent people. The tragic story of Stan Swamy who was a victim of forged implants on his computer is still fresh in our minds. If laws can’t deal with such atrocious frame-ups, they are of little consequence to the ordinary mortals.

In the same way, continuous interruptions in internet connectivity in some places, in the name of blocking news from going outside the place of occurrence, too would become counter-productive. At a time when repressive regimes are restricting access to information and keeping surveillance over personal data of people, any new law should have taken these issues into consideration. It is not without reason that the Editors’ Guild of India expressed its concern stating that the Act could allow the Union Government to “censor content on vague and unspecified grounds in the interest of the general public.”