Data protection bill: Will India’s hard-won information law get weaker?

A crucial new law that aims to protect the personal data of Indians will dilute another landmark legislation that brought much-needed transparency into government functioning, experts say.

Until last week, India did not have a law to regulate how the personal information of individuals is collected, stored and processed. The Digital Personal Data Protection Bill, which was passed in parliament, fulfils that long-standing demand.

But privacy experts have raised serious concerns, pointing out that the law does not protect citizens from surveillance and that it gives excessive power to the federal government in terms of application.

One major criticism is the change the legislation makes to the landmark right to information (RTI) law, which allows people to access data from the government. Since it was passed in 2005 – after years of campaigning – millions of Indians have used the RTI law to ask questions and demand information from government departments and officials.

But the new legislation changes a provision of the RTI law to exempt “personal information” from being disclosed – this will affect a majority of the information currently sought under it.

“Everything that people have been using the RTI law for – to hold governments accountable, to fight corruption [etc.] – has somewhere an element of personal information,” says Anjali Bhardwaj, co-convenor of the National Campaign for People’s Right to Information, which was critical in getting the RTI law passed in 2005.

Madan Lokur, a former Supreme Court judge, says that the amendment “will emasculate the RTI to a large extent”.

While the application of the RTI law was never perfect – information was often denied on flimsy grounds and there have been several attempts by successive governments to dilute it – activists fear the latest change will make answers almost impossible to access.

The RTI law covers a wide ambit of organisations, including all departments formed under the Constitution or any government law or notification. Even organisations that are substantially financed by any government, even indirectly, are covered.

The RTI Act’s default position is that all information should be made available to citizens when requested, barring a few exceptions such as national security.

One of the clauses, which is under contention, says that if the information is of a personal nature and does not relate to any “public activity” or would cause an “unwarranted invasion” of an individual’s privacy, then the officer can deny the request – unless they find that it should be made available in “larger public interest”.

A 2012 committee on privacy law headed by Justice AP Shah had recommended that disclosures under the RTI Act should not constitute an infringement of privacy.

The new data protection law overrides this clause. It merely says that any information that “relates to personal information” can be denied – which could include any answer that identifies an individual.

“Earlier there was a filter that personal information should not have a relationship with any public activity or unwarranted invasion of privacy,” says Shailesh Gandhi, a former Central Information Commissioner who was responsible for deciding on complaints under the RTI Act.

Mr Gandhi says that to ensure that the law was easily implemented, it also spelt out that if information cannot be denied to a legislature, it should not be denied to an individual as well.

But now there is a blanket ban on personal information, which Mr Gandhi says is problematic, as “you could relate any information to a person one way or the other”.

The data protection law also says that non-compliance with it could attract hefty monetary fines, going up to 2.5bn rupees ($30.1m; £23.7m). This can discourage officers from disclosing answers which could be related to personal information.

“Even if they impose a [lower fine], which officer would take the risk [of disclosing personal information in public interest]?” Mr Gandhi asks.

Federal minister Ashwini Vaishnaw has said in an interview that the change in the law takes into account a landmark 2017 Supreme Court ruling on privacy “which said personal data can be processed if it passes the test of legality, legitimacy, and proportionality” and that it won’t affect the RTI.

Activists fear the change will affect their ability to seek information that has helped check corruption and ensure the delivery of basic rights.

“For instance, under the National Food Security Act, to check if there is corruption and someone does not get their rations, then people try to access information about fair-price shops and their sales registers to find out who was sold ration,” Ms Bhardwaj says. This helps check for pilferages in the ration given by the government’s public distribution system.

She also points out that Dalit (formerly known as untouchables) students have used the law to ask colleges to provide data about the admission process if they were not allotted a place even when they had the required marks.

Without this information, “the RTI Act would not keep a check on corruption and [this would] reduce transparency”, Mr Gandhi says.

He points to an instance during his tenure where a person got a copy of the degrees of doctors appointed at a government hospital. “After going through them, they found out that there were several people who held fake degrees,” he says.

Such answers could become unavailable under the new law, he believes, since they would disclose the personal information of individuals.

Even now, officials deny many RTI requests by just saying that the information is personal, Mr Gandhi says. He now expects these denials to increase.

The change doesn’t affect a section in the RTI law that says that says that even if the information falls under any of the exceptions (such as personal information), an officer could still allow access to it if the public interest “outweighs the harms to the protected interests”.

But this flips the burden on people seeking the information.

“A person seeking information under RTI does not have to justify why they are seeking the information,” Ms Bhardwaj says. “But now, I will have to prove that there is a public interest and that its non-disclosure has larger harms to the protected interest.”

BBC News India is now on YouTube. Click here to subscribe and watch our documentaries, explainers and features.