In their letter to Retired Justice BN Srikrishna, the volunteers said the group was trying to adopt the highest standards of transparency to ensure that autonomy, dignity and privacy were protected in the data protection law.
“We believe that the formulation of a privacy statute for our republic must be a public process with the widest possible citizen and stakeholder engagement, aimed at putting in place and enforcing the highest standards of privacy oversight and rights regarding data for all Indians,” the group wrote in a letter dated June 8.
The draft bill speaks about storage and the collection of personal data only for certain purposes and the time required to fulfil those purposes. It also allows for data subjects, i.e. citizens to request their data to be deleted from servers.
The draft law also calls for informing the subjects of surveillance who undergo the interception of communication about the said interception within 60 days. The authorised officer seeking permission for surveillance has to approach the appropriate Surveillance and Interception Review Tribunal and get an order before going ahead with the interception.
Additionally, the law also envisages the formation of a privacy commission whose members will be appointed by the President. This commission will work as the supreme body in judging the matters of data privacy violations and providing permissions or revoking them when it comes to the collection, storage or processing of personal data. The draft bill seeks to have a director general of surveillance and interception reform apart from a number of other additional, joint, deputy or assistant directors general and other such officers who may be required to carry out the commission’s duties effectively.
The bill also proposes "exemplary” penalties for those who refuse access to essential goods and services such as subsidised foodgrains to citizens who do not have a certain identity document but have an alternative method to establish identity.
“The data subject shall be entitled to exemplary damages where an essential service has been denied despite the existence of pre-existing alternative means of identifying the data subject,” the draft bill states. “No essential services, by whosoever provided... shall be withheld on the ground that consent to share personal data in a particular manner for the purpose of identification, has not been obtained or has been withheld or such data has not been collected at the time the data subject claims the service.”