Bengaluru: When in February 2022 Muslim college students in coastal Karnataka protested a ban on wearing the hijab, some received abusive and threatening calls from unknown numbers, after their names and number were leaked and circulated online via WhatsApp and other social media. 

The parents of six Muslim women students filed police complaints. Such data leaks obviously jeopardise safety but are also a violation of a fundamental right to privacy guaranteed under Article 21 of the Indian Constitution.

As data leaks and privacy issues metastasise in a nation with nearly 1.2 billion cell phone connections, a proposed new law called the Personal Data Protection Bill (or PDP Bill) 2019, is expected to address a diverse range of privacy violations, whether through government computer applications or public institutions, non-consensual data collection by private entities and attempts by the State to surveil citizens.

It was only in 2017 that the right to privacy was recognised as a constitutional right when the Supreme Court stated that it was important to protect the “inner sphere of the individual from interference from both State and non-State actors”. 

The PDP Bill is expected to address such violations of the right to privacy through two wings: the Data Protection Authority (DPA) of India to govern and protect the privacy of citizens; and the DPA’s independent judicial wing to impose penalties and award compensation for privacy breaches. 

But a reading of the PDP Bill makes it evident that the adjudicating officer or officers of the judicial wing will be appointed by the authority they are meant to judge and does not factor in key principles of being an impartial ombudsman, such as accountability, transparency and effective judicial remedies.

The manner and terms of the adjudicating officer’s appointment, jurisdiction and experience have been left to the union government to determine. A legislative framework with serious gaps in its enforcement design leaves the law vulnerable to misuse by the government of the day. 

The Importance of Independence

The primary responsibility of the DPA is regulatory in nature. The DPA  defines privacy standards; obligations of entities collecting and processing personal data; and the rights of those whose personal data is collected. 

Much has been said (here, here and here) about safeguarding the DPA from executive and political interference. Responses to the PDP Bill as well as a December 2021 joint parliamentary committee (JPC) report on the subject have explored the human rights implications of a non-independent DPA particularly the potential of weak or biased enforcement of rights against the government. 

A key function of the PDP Bill lies in its enforcement mechanism: how can citizens ensure that their rights are protected and how can they seek justice for a breach of rights. 

This is where the role of its judicial wing is relevant. The adjudicating officer will decide on complaints relating to violations under the Bill and impose penalties or grant compensation to the aggrieved persons. 

While the Bill recognises the need for an independent adjudicating officer, it appears not enough deliberation has gone into whether the current enforcement design fulfils this requirement. 

What’s Needed To Protect Core Constitutional Values 

The division of functions between the DPA and adjudicator stems from its self-declared doctrine of separation of powers—the same principle that divides the branches of the State into legislative, executive and judiciary.

Many regulators, including the Securities and Exchange Board of India, the Telecom Regulatory Authority of India, state Real Estate Regulatory Authorities and the Competition Commission of India, have independent judicial branches created by their parent statutes. 

However, the roles of the DPA and the judicial wing under the PDP Bill, are not comparable to those of existing sectoral regulators. The DPA is similar to other “fourth branch” institutions, which protect core constitutional values, such as the Election Commission or the Information Commission, as member of Parliament Amar Patnaik, a member of the JPC  on the PDP Bill, wrote in April 2020.

These “fourth branch” institutions require an additional level of constitutional entrenchment to ensure their independence, so that the independence of the two wings from one another is guaranteed, something the PDP Bill fails to do. 

Currently, the design and powers of DPA and its judicial wing are a blend of earlier sectoral regulators and “fourth branch” institutions. 

The adjudicating officer under the PDP Bill has the power to award compensation. Determination of compensation is treated as a judicial function since it involves a process of adjudication. The adjudicating officer also has the power to restrict or prevent the disclosure of personal data of individuals when enforcing a citizen’s right to be forgotten. 

This right, read under the right to privacy, allows individuals to seek the removal of personal data from the public if it infringes on their privacy. Enforcement of such a right requires careful balancing of three fundamental rights: the right to privacy, freedom of speech and expression, and right to information. 

In 2007, the Competition Act, 2002, was amended to grant the power of compensation to an appellate tribunal from the Competition Commission as a result of a writ petition challenging its constitutionality, 

The Competition Commission earlier enjoyed the powers of a judicial body, and if the Commission were to have such powers, the chairperson had to be a retired chief justice or judge appointed by judicial members and not a bureaucrat appointed by the executive. Now, after the amendment, the power to award compensation rests solely with the National Company Law Appellate Tribunal.

Along similar lines, the National Consumer Disputes Redressal Commission stated that consumer forums cannot enforce fundamental rights since “they do not exercise the jurisdiction of Hon’ble High Court or Hon’ble Supreme Court under Article 226 or Article 32” of the Constitution. 

Despite this, the power to award compensation for harm caused by violations of citizens’ right to privacy and enforce the right to be forgotten is left to a person appointed by the DPA with no prior judicial experience. 

Seeking Damages Is Not Up To You

The PDP Bill, as it is now designed, allows citizens to complain to the DPA about privacy violations, for instance, someone whose medical diagnosis has been leaked by a hospital to a drug company.

At this stage, the DPA could, after an internal inquiry, impose administrative sanctions on the hospital holding and processing such data, such as warnings or suspension of businesses. 

But if the victims of the data leak seek monetary compensation for any harm they suffered, it is up to the DPA to decide whether to forward their complaint to the adjudicating officer (see figure 1 summarising the redressal process). 

The adjudicating officer or officers are appointed by the DPA and shall be, according to the Bill, “persons of ability, integrity and standing”, with specialised knowledge and professional experience in the field of law, cyber and internet laws, information technology law and policy, data protection and related subjects. 

While the DPA will appoint the adjudicating officer, rules regarding the number of adjudicating officers, manner and terms of appointment and jurisdiction will be defined by the union government, taking into account “operational segregation, independence and neutrality of the adjudication”.

In other fourth-branch institutions, such adjudicators are appointed on the recommendation of a selection committee.

In The Past, Govt Has Moved Adjudication Powers

The two main functions of the adjudicating officer in the PDP Bill are to: impose penalties for non-compliance of various kinds under the Bill; and award compensation to those suffering harm as a result of such non-compliance. 

Contraventions recognised by the PDP Bill include failure to adhere to security safeguards, failure to take prompt and appropriate action in response to a data security breach and failure to comply with directions or orders issued by the DPA.

The adjudication officer must conduct an inquiry and can summon and enforce the attendance of those who can give evidence or produce documents that “may be useful for or relevant to the subject matter of the inquiry”.  

Another important function of the judicial wing, with potentially far-reaching consequences, as we said, is the adjudication of ‘right to be forgotten’ cases. Currently, high courts are hearing cases involving the right to be forgotten or the right to erasure. 

In 2022, for instance, Indian actor Ashutosh Kaushik filed a petition in the Delhi high court seeking the removal of public information regarding a drink-driving incident involving him in 2008. He claimed that public knowledge of this incident had impacted his personal and professional life. Similar petitions have been filed in other courts. 

In such cases, a citizen can file a complaint directly with the adjudicating officer, who is required to balance the person’s right to privacy with the freedom of speech and expression and the right to information of another citizen. 

Adjudicators Appointed By Authority They Are Meant To Judge 

The role of the adjudicating officer can be likened to that of the judiciary: empowered to deal with questions that have implications on fundamental rights and required to hold union and state governments accountable on behalf of citizens. 

Given this role, the adjudicating officer should be independent of the DPA and governments—a principle recognised by the Bill and the 2018 Srikrishna Committee Report, which highlights the need for a judicial wing to function “at arm’s length” from the remaining wings of the DPA. However, the terms of the appointment of the adjudicating officer and the redressal process available to citizens, in their current form, do not inspire confidence that this independence will be guaranteed. 

It is unclear how the adjudicating officer can operate independently of the very authority that appoints them. This is unlike the appointment process of members of the DPA, appointed by the union government on the recommendation of an independent selection committee composed of the cabinet secretary and two more bureaucrats.

Another important consideration in the creation of a judicial wing is to safeguard it against possible influence by the executive. This means transparency in appointment and grant of powers to the adjudicating officer. This is brought into doubt by the fact that the union government will decide the manner and terms of appointment, jurisdiction and experience required of the adjudicators. 

The Bill does not define these criteria, which means it will be left to the government after the DPA and adjudicating officers are appointed.

Limiting Citizens’ Access to Remedies 

“A constitutional democracy can survive when citizens have an undiluted assurance that the rule of law will protect their rights and liberties against any invasion by the state and that judicial remedies would be available to ask searching questions and expect answers when a citizen has been deprived of these, most precious rights.”

This is what Justice D Y Chandrachud in the 2017 Supreme Court right to privacy judgement, Justice KS Puttaswamy vs Union of India. They reaffirm a citizen’s right to accessible and effective recourse to remedies in the event of any violation of rights, liberties or dignity. This is one of the central objectives of a legislative framework for privacy. 

The current Bill does not allow citizens to directly seek remedies against public and private entities holding their personal data. While they have an unrestricted right to complain and seek compensation, the decision to act upon them lies squarely with the DPA.

Neither the Srikrishna Committee report nor the JPC report explains why citizens cannot directly access the adjudicating officer.

Moreover, if the DPA chooses not forward their complaint to the judicial wing, citizens have no recourse to appeal such a decision under the current Bill. This provision, read with the bar of jurisdiction of civil courts to entertain any suit or proceeding that the adjudicating officer is empowered to determine, substantially hinders a citizen’s access to justice. 

At Stake: An Unenforceable Right

Balancing and enforcing fundamental rights have long been the responsibility of the Supreme Court and High Courts. The Indian Constitution guarantees citizens an unrestricted right to approach these courts when these are breached. 

The current draft of the PDP Bill grants similar powers to an officer who may not be necessarily qualified or equipped to deal with such questions. An expert in the areas of technology and privacy law cannot possibly be the sole arbiter of disputes that have consequences on human dignity. 

Over a period of six months in 2021, India accounted for the second-highest volume of content takedown requests before Google. Under the new Bill, the adjudicating officer can now hear such cases. Unlike consumer courts, which are available at a district and state level, the PDP Bill does not mandate decentralisation of the judicial wing, which would have eased citizens’ access to justice. 

For over a decade there have been calls for a legislative framework that provides effective protection to citizens’ right to privacy. But the Bill in its current form is riddled with gaps when it comes to enforcing the very right that it recognises. 

Its lack of a strong enforcement mechanism, without sufficient transparency and accountability, has the potential to undo the statutory recognition of the right to privacy.  

In 2017, the landmark Puttaswamy case upheld that the legislative framework should ensure that citizens' right to privacy is protected against State and non-State actors. The judicial wing is a key institution that will implement this mandate. 

With the PDP Bill up for amendments again, it is hoped that some aspects of the enforcement of the right to privacy will be deliberated further. 

(Rishika Rangarajan is a Research Fellow at the National Law School of India University, Bengaluru, writing on regulatory governance in India.)