Data Protection based Amendments to RTI

celsa-spraggs

Published 2025-11-07 · 40 slides · 0 views

↓ Download

Data Protection based Amendments to RTI - slide 1 of 40

Data Protection based Amendments to RTI - slide 2 of 40

Data Protection based Amendments to RTI - slide 3 of 40

Data Protection based Amendments to RTI - slide 4 of 40

Data Protection based Amendments to RTI - slide 5 of 40

Data Protection based Amendments to RTI - slide 6 of 40

Data Protection based Amendments to RTI - slide 7 of 40

Data Protection based Amendments to RTI - slide 8 of 40

Data Protection based Amendments to RTI - slide 9 of 40

Data Protection based Amendments to RTI - slide 10 of 40

Data Protection based Amendments to RTI - slide 11 of 40

Data Protection based Amendments to RTI - slide 12 of 40

Data Protection based Amendments to RTI - slide 13 of 40

Data Protection based Amendments to RTI - slide 14 of 40

Data Protection based Amendments to RTI - slide 15 of 40

Data Protection based Amendments to RTI - slide 16 of 40

Data Protection based Amendments to RTI - slide 17 of 40

Data Protection based Amendments to RTI - slide 18 of 40

Data Protection based Amendments to RTI - slide 19 of 40

Data Protection based Amendments to RTI - slide 20 of 40

Data Protection based Amendments to RTI - slide 21 of 40

Data Protection based Amendments to RTI - slide 22 of 40

Data Protection based Amendments to RTI - slide 23 of 40

Data Protection based Amendments to RTI - slide 24 of 40

Data Protection based Amendments to RTI - slide 25 of 40

Data Protection based Amendments to RTI - slide 26 of 40

Data Protection based Amendments to RTI - slide 27 of 40

Data Protection based Amendments to RTI - slide 28 of 40

Data Protection based Amendments to RTI - slide 29 of 40

Data Protection based Amendments to RTI - slide 30 of 40

Data Protection based Amendments to RTI - slide 31 of 40

Data Protection based Amendments to RTI - slide 32 of 40

Data Protection based Amendments to RTI - slide 33 of 40

Data Protection based Amendments to RTI - slide 34 of 40

Data Protection based Amendments to RTI - slide 35 of 40

Data Protection based Amendments to RTI - slide 36 of 40

Data Protection based Amendments to RTI - slide 37 of 40

Data Protection based Amendments to RTI - slide 38 of 40

Data Protection based Amendments to RTI - slide 39 of 40

Data Protection based Amendments to RTI - slide 40 of 40

Description

Data Protection based Amendments to RTI Yashovardhan Azad M Sridhar Acharyulu Information Commissioners 12.10.2018 Analysis of 8(1)(j) 1. There can be seven occasions even if information sought was personal it could be given under this

Download this presentation From Below

"Data Protection based Amendments to RTI" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.

Presentation Transcript

Data Protection based Amendments to RTI Yashovardhan Azad
M Sridhar Acharyulu
Information Commissioners
12.10.2018

Analysis of 8(1)(j) 1. There can be seven occasions even if information sought was personal it could be given under this exception:
2. The information relates to public activity,
3. The information relates to public interest,
4. The information disclosure will not cause unwarranted invasion of privacy of that individual,
5. Though information is personal, not related to public activity or interest, if larger public interest justifies such disclosure,
6. Though information is personal and its disclosure could cause unwarranted invasion of privacy it could still be disclosed if larger public interest justifies,

Section 8(2) 7. Though information is personal, not related to public activity or interest, disclosure causes unwarranted invasion of privacy of the individual, no larger public interest involved, yet it could be given to citizen if it can be furnished to the Parliament or State Legislature.
8. Though information is personal, not related to public activity or interest, disclosure causes unwarranted invasion of privacy of the individual, it could still be given if public interest in disclosure outweighs the public interest in its non-disclosure.
9. Proviso to Section 8(1) of RTI Act, 2005 at the end
10. Sec 8(2) of RTI Act, 2005 competitive public interest

Expanding scope of restriction Girish Ramachandra Deshpande 2013
Canara Bank transfer case. 2017
Office Memorandum of DoPT
Even Privacy Judgment mentioned Girish
Confirmed in Canara Bank case, only based on Girish.
A dismissal of SLP is wrongly being considered as Precedent.

Srikrishna’s Replacement proposal Expands right to privacy of public servants without defining it
The Justice Srikrishna Committee recommending additional grounds.
Loose expressions, wide open criterion
This can undo the positive gains of RTI Act.

‘Likely’ and ‘harm’ 1. protect public servant from any likely harm by disclosure.
Both ‘likely’ and ‘harm’ are open ended.
“(j) information which relates to personal data which is likely to cause harm to a data principal, where such harm outweighs the public interest in accessing such information having due regard to the common good of promoting transparency and accountability in the functioning of the public authority;

Harmful ‘harm’ Section 3 (21) says:
“Harm” includes— (i) bodily or mental injury; (ii) loss, distortion or theft of identity; (iii) financial loss or loss of property, (iv) loss of reputation, or humiliation; (v) loss of employment; (vi) any discriminatory treatment; (vii) any subjection to blackmail or extortion; (viii) any denial or withdrawal of a service, benefit or good resulting from an evaluative decision about the data principal; (ix) any restriction placed or suffered directly or indirectly on speech, movement or any other action arising out of a fear of being observed or surveilled; or (x) any observation or surveillance that is not reasonably expected by the data principal.

New escape gates 1. Not only personal data but data relating to personal data also can be denied.
2. Likely to cause harm
3. Might cause bodily injury or likely to
4. Might cause mental injury or likely to
5. Loss of property or employment or likely
6. Loss of reputation or humiliation or likely
7. Subjection to blackmail or extortion or likely
8. Possible loss of benefit, withdrawal of service
9. Becomes restriction on speech or movement
10. Subjects him to observation

Should we protect black sheep from blackmail? All corrupt public servants can celebrate this Bill. It will safeguard black sheep among public servants from possible black mail!
ten exit gates to corrupt persons

SC on Right to Privacy Privacy integral part of fundamental Rights under Part III of Constitution of India. SC 9 JJ bench
an exhaustive list or catalogue cannot be made. This verdict prevents any kind of snooping', like individual freedom, 'individual house, marriages, sexual orientation, right to space, right to move freely, right to eat what an individual likes, right to be left alone are protected both within the home and at public places to the extent necessary'.

Reasonable Restrictions on Privacy We need to examine whether a limitation like ‘reasonable restrictions’ or procedure established by law’ will apply to fundamental right to privacy.
The government to examine and put in place a 'robust regime' for data protection in the modern era, saying

No definition Puttaswamy judgement did not codify the definition of privacy,
nor did it offer a detailed test against which restrictions may be judged.
to be dealt with on a case-to-case basis. The judgment did go into the question of reasonable restrictions, and
whether the “reasonable expectation of privacy” test is appropriate for India.

Three requirements “The first requirement that there must be a law in existence to justify an encroachment on privacy is an express requirement of Article 21.
For, no person can be deprived of his life or personal liberty except in accordance with the procedure established by law.”..

Second and third needs “Second, nature and content of the law which imposes the restriction falls within the zone of reasonableness mandated by Article 14, which is a guarantee against arbitrary state action.
The third - the means which are adopted by the legislature are proportional to the object and needs sought to be fulfilled by the law..”

Broad exceptions The state has to identify its legitimate aims.
For instance protecting national security,
preventing and investigating crime,
encouraging innovation and
the spread of knowledge, and
preventing the dissipation of social welfare benefits”.

Is this robust regime? Whether ‘The Personal Data Protection Bill, 2018 on 27th July 2018, proposed robust regime to protect privacy, and also
the fair and reasonable restrictions on that fundamental right?
Privacy as a fundamental right is fine, how about privacy as a restriction on other fundamental rights like RTI and Freedom of Expression?

Consent Consent of data principal obtained by data fiduciary – it should be informed consent, not just informed, it should be given only after properly understanding.
A mere signature on proforma consent cannot be consent.
There is no protection to data principal from routine and proforma based consent. Law provided for obtaining consent. There should be prescribed freedom not to give consent.

Deficiencies There is no privacy law till today
The Bill did not define privacy
Personal data and sensitive personal data are defined. A couple of aspects of privacy only.
Does not protect the privacy of citizens from the surveillance, and tapping and trappings of state power.
Provided a frail and weak regime for commercial data processers to obtain data and misuse.

S 42…Security of State Section 42 Security of State:
(1) Processing of personal data in the interests of the security of the State shall not be permitted unless it is authorised pursuant to a law, and is in accordance with the procedure established by such law, made by Parliament and is necessary for, and proportionate to, such interests being achieved.

Exemptions from Data protection obligations, Chapter III- Grounds of Processing of Personal Data, IV- Grounds of Processing Sensitive Personal Data, V- Personal and Special Personal Data of Children, VI- Data Principal Rights, VII- Transparency of Accountability measures and VIII deals with Transfer of Personal Data outside India; these will not apply to Law to be made by Parliament according to S 42.

Prevention of Crime 43. Prevention, detection, investigation and prosecution of contraventions of law.— (1) Processing of personal data in the interests of prevention, detection, investigation and prosecution of any offence or any other contravention of law shall not be permitted unless it is authorised by a law made by Parliament and State Legislature and is necessary for, and proportionate to, such interests being achieved.

S 44. Legal rights and claims Section 44 Processing for the purpose of legal proceedings.— (1) Where disclosure of personal data is necessary for enforcing any legal right or claim, seeking any relief, defending any charge, opposing any claim, or obtaining any legal advice from an advocate in any impending legal proceeding such processing shall be exempted from the following provisions: (a) Chapter II, except section 4; (b) Chapter III; (c) Chapter IV; (d) Chapter V; (e) Chapter VI; and (f) Chapter VII, except section 31.

Journalistic purposes Exception 4 research purposes
Exception 5 Domestic purpose
Exception 6 Journalistic purposes

Demonstration 47: Journalistic purposes.—
(1) Where the processing of personal data is necessary for or relevant to a journalistic purpose, the following provisions of the Act shall not apply—
(a) Chapter II, except section 4; (b) Chapter III; (c) Chapter IV; (d) Chapter V; (e) Chapter VI; (f) Chapter VII except section 31; and (g) Chapter VIII.
(2) Sub-section (1) shall apply only where it can be demonstrated that the processing is in compliance with any code of ethics issued by— (a) the Press Council of India, or (b) any media self-regulatory organization.”

Pre censorship To say unless it is processing of data is in compliance with any code of ethics of PCI or any media self regulatory organization, they cannot process or write about personal data is in breach of fundamental right. This restriction on freedom of speech and expression on media writings on the ground of ‘personal data’ processing on the criterion of a code of PCI or any other self-regulatory organization will amount to unreasonable restriction on freedom, pre-censorship and will fail the judicial scrutiny because it violates Article 19(1)(a) and (2).

S 27. Right to be forgotten Section 27 of the draft Bill proposed a right to be forgotten. The Bill proposed an adjudicatory forum to decide on disclosure on the basis of right to be forgotten that can override Right to Information of citizen. S 27 says:
(1) The data principal shall have the right to restrict or prevent continuing disclosure of personal data by a data fiduciary to the data principal where such disclosure-
a) has served the purpose for which it was made or is no longer necessary;

Adjudicating officer (b) was made on the basis of consent under section 12 and such consent has since been withdrawn; or
(c) was made contrary to the provisions of this Act or any other law made by Parliament or any State Legislature.

(2) Sub-section (1) shall only apply where the Adjudicating Officer under section 68 determines the applicability of clause (a), (b) or (c) of sub-section (1) and that the rights and interests of the data principal in preventing or restricting the continued disclosure of personal data override the right to freedom of speech and expression and the right to information of any citizen.

Powers of adjudicating officer (3) In determining whether the condition in sub-section (2) is satisfied, the Adjudicating Officer shall have regard to—

(a) the sensitivity of the personal data;
(b) the scale of disclosure and the degree of accessibility sought to be restricted or prevented;
(c) the role of the data principal in public life;
(d) the relevance of the personal data to the public; and
(e) the nature of the disclosure and of the activities of the data fiduciary, particularly whether the data fiduciarysystematically facilitates access to personal data and whether the activities would be significantly impeded if disclosures of the relevant nature were to be restricted or prevented.

Who are persons of ability? (4) The right under sub-section (1) shall be exercised by filing an application in such form and manner as may be prescribed.

(5) Where any person finds that personal data, the disclosure of which has been restricted or prevented by an order of the Adjudicating Officer under sub-section (2) does not satisfy the conditions referred to in that sub-section any longer, they may apply for the review of that order to the Adjudicating Officer in such manner as may be prescribed, and such Adjudicating Officer shall review her order on the basis of the considerations referred to in sub-section (3).

The Bill prescribed under Section 68 a separate adjudicatory wing, with adjudicating officers who are persons of ability integrity and standing, with not less than seven years of experience in the fields specified.

What is right to be forgotten? If an individual desires to "determine the development of his life in an autonomous way, without being perpetually or periodically stigmatized as a consequence of a specific action performed in the past”,
This vague concept of European Union and France is being introduced as part of right to data protection by Justice Srikrishna Committee. The US preference of transparency and right of free speech to so-called right to be forgotten, should have been taken.

Conclusion If data principal happens to be public servant (eg former minister), and data fiduciary is a newspaper or web journal, the freedom to criticise the public personalities, their public policies based on their statements and activities will be in jeopardise, and
journalist has to wait for the decision of adjudicating officer to clear writing about it.
A citizen seeking access to such information will be confused whether to approach CIC or DPA.
Though named as adjudicating officers they are judges but subordinate officers to the members of Data Protection Authority.

Criminal leaders will enjoy this right Under this Bill the former Minister can apply to AO to prevent the media from publishing because the information served its ‘purpose’ and AO considers that his right to be forgotten overrides freedom of press of media.

Contrary to RTI Act This conflicts with the RTI Act, independent adjudicating power of CIC and the Fundamental Rights chapter of Constitution of India.
This undermines the very existence of the Information Commissions in Centre and States. Under this right a public servant or political leader can restrict disclosure of ‘data’ of his earlier conviction or truthful accounts of his public life, of which he has a right to be forgotten.

Seriously interferes with press freedom The Srikrishna Committee Report, thus seriously interferes with the freedom of speech and expression under Article 19(1) and imposes unreasonable restrictions on the ground of privacy.

Don’t replace 8(1)(j) Expands the ground of denial with confusion.
Mental injury, loss of reputation and subjection to black mail are some kinds of the ‘harm’, to avoid which information can be denied on the excuse of ‘privacy’.
This amendment is wholly unnecessary. Existing Section 8(1)(j) has better balance privacy and RTI.

Delete right to be forgotten Right to be forgotten has to be deleted, because it creates new grounds against disclosure of information under RTI Act beyond SS 8-9 and
Introduces the pre-censorship and prior restraints on Media from processing the data and publishing, which violates Article 19(1(a) and 19(2) of the Constitution of India.
Creates an authority parallel Information Commissioner to deal with disclosure or permission to process the data, if the data principal happens to be public servant, data fiduciary the media.

Exception 42 useless Security of state is a ground to allow data processing under DPA Bill and order disclosure under RTI Act [s8(1)(a)], but this Bill does not explain this ground of exception, and leaves it for future legislation. This does not serve any purpose.
This will lead to contradiction with RTI Act, with another proposed law on the subject. Multiple laws will lead to confusion and contradiction.

Exempt criminal investigations S 43: Exemption for criminal investigation is permitted under this section, but does not lay down any law.
RTI Act section 8(h) covers this area.
No other law is needed.
If new law is made as suggested the laws will multiply and confusion increases.

‘Journalistic purposes’ is harmful It permits data processing/publication for journalistic purpose, but journalist has to demonstrate that publication is accordance with code of conduct etc.
Adjudicating officer will decide. Conflict and confusion under Section 27 (point 1) above will prevail.
Its violative of Article 19(1)(a) and Article 19(2) as this imposes another prior restraint on media freedom.
Adjudicating officer with a rank below the CIC will be deciding issues of disclosure under this Bill. After review before Adjudicating Officer, appeal lies before Data Protection Authority. Two parallel institutions on privacy based non-disclosure and disclosure of personal information in public interest will create confusion and uncertainty. This has to be avoided.

Thank you very much for
your kind attention

Data Protection based Amendments to RTI

Related Topics

Share

Embed code

Download this presentation From Below

Presentation Transcript