FSMI strongly criticises the proposed Data Protection Bill put forth by Sri
Krishna Committee. The bill completely fails to protect the data of the user
while providing Government access to personal data without any checks
and balances. The situation where the Data agencies of Government are not
being regulated creates a scope for mass surveillance and legitimises any
data collection by the Government.
In addition, FSMI criticises this lax regulation which gives a free hand to
employers in collecting and processing data for the purposes of recruitment,
termination, assessment etc of the employees – without taking their consent.
The report places the onus of any legal consequences on the user in the case
of withdrawal of consent. This is unjust and places undue pressure on the
part of the user to forcibly retain consent. User privacy and rights are
neglected completely by not providing any means for erasure of personal
Far from protecting user data, the bill has no provision for any inquiry about
data collected by the Government. It exempts the Government from any
consequences of data breach. This proposition is dangerous considering the
recent breaches of personal data which were collected during aadhar
This draft bill subverts the provisions of the RTI Act, crippling citizen's
right to information. This is a move aimed at reducing transparency and
accountability of the Government.
In the name of data localisation, the bill mandates complete mirroring of
data within the country. This is clearly a provision which could allow the
Government to gain access to any database of Indian users.
Though the bill talks about 'Privacy by Design' and 'Transparency', it fails to
implement these principles in a concrete and binding manner.
The objective of any strong data protection law should be to protect the data
privacy of the people and make sure that they have ultimate control over it.
Regulations must be made in order to uphold individual privacy and prevent misuse of data (including data breaches).
FSMI demands that the government not accept this draft bill in its current
form and a stronger data protection law which puts control of data in the
peoples' hands be drafted.