Some MPs referred to centralization of power in the law. How do you respond to the criticism?

The Constitution has clearly said where the laws will be made and who will make the laws. Under List 1, the central government has the power to make laws. The legal structure regarding internet and digital economy has to be done by the central government as part of the List 1, Schedule 7 of the Constitution. Where is the question of centralizing? The law has to be made by the central government only in this case. Then, implementation can be done in a variety of ways and here, we have created a totally democratized way of implementing. With the digital by design access to justice, the use of 22 languages, the ability to understand, and with the fair and reasonable consent form, where they don’t give big legalese, where it’s properly itemized for selecting information—these things actually cut out the big barriers between a citizen who seeks justice to the body that will provide justice. It’s actually significant decentralization. 

To that point, is there no merit in having state-level data protection boards?

Data or digital economy doesn’t follow physical boundaries, a jurisdiction. Having separate state data protection boards will basically mean a fight over jurisdiction, whereas having a democratized way of digital implementation, where total decentralization will happen, in that way, the philosophy of democratizing technology gets implemented, and citizens living in different parts of the country get equal access to justice.

One of the biggest issues faced by consumers is that user consent taken by apps continues to be very broad, and not limited to the purpose.

The consent has to be fair and reasonable under Section 6.

Would that be open to interpretation?

No; when we make the rules, we will say what is fair, what is reasonable. We’ll make it itemized. We’ll make sure that this is clearly understood by the consent-giver and also, since we have given the provision for 22 languages, this will make it even more accessible to the people who don’t know English. All apps will now have to give the option to see the consent form in 22 languages.

How will fair and reasonable be spelt out?

Fair and reasonable is a very clearly defined construct in the law. We use that phrase which has been used at multiple ways, interpreted so many times for the courts, and then define what is fair and reasonable in the rulemaking process. So, rulemaking gives you that flexibility. Industry says that no, I cannot do this, and people also say that except that yes, this is not the right thing. Then we can come to a common understanding and then take what is fair and reasonable.

On the issue of compensation, can the government enable digital access to compensation?

This is a bigger question of reforming the judicial system, which is significantly beyond the mandate of this bill. Compensation is to civil courts, and they follow the Civil Procedure Code. That’s part of our judicial architecture.

For people seeking compensation under this law, how will it be merged with that civil procedure?

Compensation under any other law is treated in exactly the same way by the civil courts, by the civil procedure. That cannot be made part of this problem. That’s a bigger, much bigger question of reforming the judiciary.

Will the judiciary be sensitized in any way to the changes that will happen in this law, so that when a compensation matter does come up with them under this law, it becomes that much faster?

The judiciary itself is getting changed, a lot of reform is also happening. Also, a lot of judicial digitization is happening, e-court projects are being implemented. During covid, we have seen how the technology adoption rate significantly increased in the judiciary also. So, I would not like to go beyond the remit of the law. This law is about how we protect citizens’ privacy.

One of the MPs also mentioned that the word privacy was missing from the bill. How do you respond to that?

That’s a very legalistic way of looking at it. The three principles of the Puttaswamy judgement – legality, legitimacy and proportionality — do you write those three principles in exactly the same way or do you write a law which meets those three principle? All the sections that we have written meet all those principles.

When will industry consultations for the rules under the law begin?

We’ve already started consultations with the industry for implementing the law. Most industry participants have told us that they already have in place structures and business processes which will be compliant with our legislation. The rulemaking process will also be very fast. Again, the rules will be simple, in very clear language, as least prescriptive as possible. There is flexibility in implementation, and that process is already on.

Would you want to set an outer limit for industry-readiness?

A few months.

There maybe cases when industry may come up with different interpretations of the same rule, or provision. How will the government respond to that?

In the rulemaking process in India, everything has to be within the four walls of the Constitution. Now, within those four walls of the law, every interpretation has to be made. Rules interpretation is not something which has ever been found as a major problem in the Indian legislative system. There are things about interpretation of the law, which has to be made in line with the Constitution.

Now, within that framework already, the law is compliant with Puttaswamy judgment. Supreme Court has given that mandate. So, I don’t see that as a major issue.

What will be the guidelines to data fiduciaries including government entities, some of which are the biggest collectors of user data?

Government is not the biggest collector, social media platforms have multiple times larger data than what the government has. There’s a myth being propagated by some people. All the important provisions that have been enacted in the law, the exemptions to government are very few and specific. Government bodies, government data fiduciaries, for example, Aadhaar, GSTN, have already implemented significant processes which are compliant with the law.

What about government entities that are not prepared?

They will get prepared. The framework has been created by Aadhaar, Cowin, GSTN, income tax; so, it will be a seamless transition.

Updated: 11 Aug 2023, 11:49 PM IST