[This two-part essay has been authored by Aarya Pachisia, a 4th-year law student at Jindal Global Law School. Part Two can be found here.]
Technology is advancing at lightning speed, making privacy violations inevitable. Today, machine learning software is sophisticated enough to predict one’s sexual orientation, political and religious affiliation merely by processing their likes on Facebook. The Whatsapp Snooping scandal is another instance, where WhatsApp has filed a case in the court of California against the NSO group for hacking targets’ phones through the app. The case brought to light that unchecked power and absence of proper legal mechanism can lead to gross violations of right to privacy.
The Sri Krishna Committee (‘the Committee’) was set up in 2017 post the Puttaswamy judgment to provide for recommendations for the Personal Data Protection Bill, 2019 (‘The Bill’), a legislation which would regulate cross-sectoral data flow, safeguard the fundamental right to privacy and codify rights and obligations of different actors under the Bill. Major changes were suggested to the Data Protection Bill, 2019 after the draft was released in December 2019. Therefore, the Bill was later referred to the Joint Parliamentary Committee headed by Ms Meenakshi Lekhi. It is due to be placed before the Lok Sabha in the upcoming monsoon session of the Parliament. The Bill was apparently overhauled and 89 amendments were introduced to it. However, such amendments are not currently available in the public domain. It becomes necessary to highlight possible issues with the 2019 Bill before it is introduced in the monsoon session as it will allow the citizens to identify the fractures of current Bill and ensure that the same is not repeated in the amended Bill.
This article is the first article of a two-part series. The overarching argument that the author seeks to advance through the essay is that although the Bill seems to be a step towards codifying the rights and obligations of data principals and fiduciaries, in reality, it confers unchecked powers upon the executive that consequently dilutes the right to privacy. The Bill exercises excessive control over all the major actors under the Bill – data principal, data fiduciaries and the Data Protection Authority of India (‘DPAI’), an independent regulatory authority sought to be established under the Bill that shall regulate and adjudicate upon the issues arising due to data breaches. Data Protection law is founded on the pillars of accountability and transparency.
Homogenous Composition of the Selection Committee under the Bill
In the first part, the author argues that the provisions of the Bill considerably dilute the institutional independence of the regulatory body. The regulatory feebleness of the DPAI will be elucidated upon by referring to the concept of regulatory capture. Regulatory capture has been defined as the process by which regulation, in law, is repeatedly directed away from public interest and towards the interest of the regulated industry, by the intent and action of that industry. In this article, I will argue that it is not the data fiduciaries (‘the industry’) but the State that captures the regulatory authority and diverts the regulation away from public interest to achieve its political interests.
DPAI will be vested with the power to regulate personal data flow, to keep a check on data fiduciaries, and to protect the interest of data principals, etc. Its major functions include – monitoring and enforcing, legal affairs and policy setting, research and awareness, inquires, grievance handling and adjudication. The Committee had recommended the selection committee to consist of the Chief Justice of India or her nominee, the Cabinet Secretary and one person with expertise and repute in the data technology field. This prevents a particular limb of the polity from gaining too much power over the DPAI, consequently, upholding its independence.
Independent regulatory bodies are organizationally separate from the governments and are headed by unelected officials. They are given power over regulation but they are also subject to control by elected politicians and judges. In the present case, it is necessary to maintain institutional independence of DPAI for two reasons: First, it is an entity responsible for safeguarding a fundamental right and second, the state’s control over the Authority – allied with its inevitable role as the primary litigant – threatens the institutional legitimacy of the DPAI. The unfettered power of the executive over DPAI serves only to defeat the purpose for which it was set up. Therefore, it becomes imperative to maintain certain degree of separation between the executive and the regulatory body.
(i) Regulatory Capture of the DPAI
Contrary to the recommendation, under section 42(2) of the Bill, the selection committee for appointing board members of DPAI, exclusively constitutes of the members of the executive. Members of Judiciary and an independent professional, as recommended, have been excluded from the selection process. The absolute control of the executive over the selection committee compromises with DPAI’s institutional independence. The homogenous composition of the selection committee, in essence, sheds light on board members of DPAI being representatives of the executive. The regulatory capture unfolds in this particular situation. The independence of the selection committee of regulatory bodies or they would be vulnerable to the demands of politics/government in power. In this particular situation, the appointment process is absolutely controlled by the executive, thereby, threatening the DPAI to being reduced as an instrument to advance political interest of the government. The selection committee under the Bill constitutes of Cabinet Secretary of the Central Government, Secretary of Government of India of the of Ministry Legal Affairs and Secretary of the Govt of India in the Ministry of Department dealing with Electronics and Technology. Thus, the executive has absolute control over the appointment process of the board of DPAI. The 6 full-time members of the board shall be the representative of the executive. This provision secures the interest of the state above all the other actors under the Bill. The executive by becoming the sole appointing authority has reserved its unfettered power over the DPAI.
(ii) Applying the principle of Tribunals to Independent Regulatory Authority
Additionally, I would like to argue for the application of principles laid down by the Supreme Court with respect to tribunals in India. The provision dealing with composition of selection committee in the National Tax Tribunal Act was struck down by the Supreme Court in the NTT case as it had more executive members than judicial members. The entire Act was struck down for being unconstitutional, one of the grounds for the same was that it contravened with institutional independence of the Tribunal. The court also struck down the provisions which empowered the executive to transfer, decide upon the location, jurisdiction and constitution of benches as it amounted to excessive executive interference since the central government shall be a party in every case. According to the court, the majority executive members undermine the independence of the tribunal. This principle would not, prima facie extend to those Tribunals which review the actions of independent regulators such as the Securities Exchange Board of India, the Competition Commission of India or the Telecom Regulatory Authority of India. These regulators have independent statutory existence apart from the central government.
Since DPAI is an independent regulatory body, prima facie the test does not apply; however, at least the spirit of the test must operate in this instance in view of the composition of the DPAI. The test should be specifically applied to DPAI for two major reasons which should be read together. First, DPAI is responsible for regulating and safeguarding fundamental right (right to privacy) and second, in certain situations, the state agencies can process data of its citizens without their consent. Therefore, the State shall also be a major litigant if allegations of illegal processing are raised against it. It is necessary to note that I argue for the application of this principle to an independent regulatory body in the spirit of interpretation since an explicit application will not be possible as mentioned in the Report cited above.
The composition of the selection committee shows a direct link between the members of DPAI and the executive alluding to lack of independence of the Authority. Thus, applying the rationale laid down in the NTT case to an independent regulatory body only when those two conditions are fulfilled. Following which, the provision for selection committee can be struck down. Furthermore, the NTT Act was struck down as being unconstitutional, since it was a tribunal which had been vested with the extant subject matter jurisdiction of a High Court, but did not enjoy at least as much of the Constitution protection that the High Court enjoyed in respect of its independence from the executive.
The DPAI also perform adjudicatory functions. The appellate adjudicatory officers are to be appointed by the board members of DPAI who are solely appointed by the executive members. Therefore, undermining the independence of the Authority. The number of adjudicatory officers in the appellate court appointed, their jurisdiction, manner and terms of appointed shall be determined by the central government. RTI Amendment Act that brought about similar changes has been heavily criticized. It was argued that vesting the power to decide the salary, jurisdiction upon central government undermines the independence of the judges. Therefore, following the principle laid down in the NTT case, the provisions vesting executive with such power may also be struck down.
The instances given above make the pro-regime bias apparent. When a statutory body is being set up in order to protect the fundamental rights of its citizens, it becomes necessary to ensure its independence and transparent functioning. The author is not arguing for complete exclusion of the executive but I propose to adopt the recommendation given by the Committee which offers equal representation from both the limbs of the government. Although, there is no fixed formula to establish an independent regulatory body, it is necessary to maintain both the accountability and independence of such bodies, especially when such a regulatory body is responsible for safeguarding and protecting fundamental right, like the right to privacy.