Centre for Internet and Society

India’s ‘Self-Goal’ in Telecom

Shyam Ponappa — 2020-04-09T07:18:26Z

This post was first published in the Business Standard, on March 5, 2020.

The government apparently cannot resolve the problems in telecommunications. Why? Because the authorities are trying to balance the Supreme Court order on Adjusted Gross Revenue (AGR), with keeping the telecom sector healthy, while safeguarding consumer interest. These irreconcilable differences have arisen because both the United Progressive Alliance and the National Democratic Alliance governments prosecuted unreasonable claims for 15 years, despite adverse rulings! This imagined “impossible trinity” is an entirely self-created conflation.
If only the authorities focused on what they can do for India’s real needs instead of tilting at windmills, we’d fare better. Now, we are close to a collapse in communications that would impede many sectors, compound the problem of non-performing assets (NPAs), demoralise bankers, increase unemployment, and reduce investment, adding to our economic and social problems.
Is resolving the telecom crisis central to the public interest? Yes, because people need good infrastructure to use time, money, material, and mindshare effectively and efficiently, with minimal degradation of their environment, whether for productive purposes or for leisure. Systems that deliver water, sanitation, energy, transport and communications support all these activities. Nothing matches the transformation brought about by communications in India from 2004 to 2011 in our complex socio-economic terrain and demography. Its potential is still vast, limited only by our imagination and capacity for convergent action. Yet, the government’s dysfunctional approach to communications is in stark contrast to the constructive approach to make rail operations viable for private operators.
India’s interests are best served if people get the services they need for productivity and wellbeing with ease, at reasonable prices. This is why it is important for government and people to understand and work towards establishing good infrastructure.

What the Government Can Do

An absolute prerequisite is for all branches of government (legislative, executive, and judicial), the press and media, and society, to recognise that all of us must strive together to conceptualise and achieve good infrastructure. It is not “somebody else’s job”, and certainly not just the Department of Telecommunications’ (DoT’s). The latter cannot do it alone, or even take the lead, because the steps required far exceed its ambit.

Act Quickly

These actions are needed immediately:

First, annul the AGR demand using whatever legal means are available. For instance, the operators could file an appeal, and the government could settle out of court, renouncing the suit, accepting the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) ruling of 2015 on AGR.

Second, issue an appropriate ordinance that rescinds all extended claims. Follow up with the requisite legislation, working across political lines for consensus in the national interest.

Third, take action to organise and deliver communications services effectively and efficiently to as many people as possible. The following steps will help build and maintain more extensive networks with good services, reasonable prices, and more government revenues.

Enable Spectrum Usage on Feasible Terms

Wireless regulations

It is infeasible for fibre or cable to reach most people in India, compared with wireless alternatives. Realistically, the extension of connectivity beyond the nearest fibre termination point is through wireless middle-mile connections, and Wi-Fi for most last-mile links. The technology is available, and administrative decisions together with appropriate legislation can enable the use of spectrum immediately in 60GHz, 70-80GHz, and below 700MHz bands to be used by authorised operators for wireless connectivity. The first two bands are useful for high-capacity short and medium distance hops, while the third is for up to 10 km hops. The DoT can follow its own precedent set in October 2018 for 5GHz for Wi-Fi, i.e., use the US Federal Communications Commission regulations as a model.1 The one change needed is an adaptation to our circumstances that restricts their use to authorised operators for the middle-mile instead of open access, because of the spectrum payments made by operators. Policies in the public interest allowing spectrum use without auctions do not contravene Supreme Court orders.

Policies: Revenue sharing for spectrum

A second requirement is for all licensed spectrum to be paid for as a share of revenues based on usage as for licence fees, in lieu of auction payments. Legislation to this effect can ensure that spectrum for communications is either paid through revenue sharing for actual use, or is open access for all Wi-Fi bands. The restricted middle-mile use mentioned above can be charged at minimal administrative costs for management through geo-location databases to avoid interference. In the past, revenue-sharing has earned much more than up-front fees in India, and rejuvenated communications.2 There are two additional reasons for revenue sharing. One is the need to manufacture a significant proportion of equipment with Indian IPR or value-added, to not have to rely as much as we do on imports. This is critical for achieving a better balance-of-payments, and for strategic considerations. The second is to enable local talent to design and develop solutions for devices for local as well as global markets, which is denied because it is virtually impossible for them to access spectrum, no matter what the stated policies might claim.

Policies and Organisation for Infrastructure Sharing

Further, the government needs to actively facilitate shared infrastructure with policies and legislation. One way is through consortiums for network development and management, charging for usage by authorised operators. At least two consortiums that provide access for a fee, with government’s minority participation in both for security and the public interest, can ensure competition for quality and pricing. Authorised service providers could pay according to usage.
Press reports of a consortium approach to 5G where operators pay as before and the government “contributes” spectrum reflect seriously flawed thinking.3 Such extractive payments with no funds left for network development and service provision only support an illusion that genuine efforts are being made to the ill-informed, who simultaneously rejoice in the idea of free services while acclaiming high government charges (the two are obviously not compatible).
Instead of tilting at windmills that do not serve people’s needs while beggaring their prospects, commitment to our collective interests requires implementing what can be done with competence and integrity.

Shyam (no space) Ponappa at gmail dot com
1. https://dot.gov.in/sites/default/files/2018_10_29%20DCC.pdf
2. http://organizing-india.blogspot.in/2016/04/ breakthroughs- needed-for-digital-india.html
3. https://www.business-standard.com/article/economy-policy/govt-considering-spv-with-5g-sweetener-as-solution-to-telecom-crisis-120012300302_1.html

For more details visit https://cis-india.org/internet-governance/indias-self-goal-in-telecom

Programme Associate (Communications)

gurshabad — 2020-08-09T13:51:27Z

The Centre for Internet & Society (CIS) is seeking applications for the position of Programme Associate (Communications), to support its Access to Knowledge (CIS-A2K) Programme. In keeping with efforts within the larger Wikimedia movement in encouraging an inclusive workplace and addressing issues of gender disparity This position is presently open only to applicants who identify as women.

Context of the CIS-A2K programme

As an affiliate of the Wikimedia Foundation, the nonprofit behind Wikipedia and it’s sister projects, we design and implement different initiatives with an aim to create high-quality content and bring new contributors to Wikimedia projects in Indian languages. The initiatives are premised on various themes and seek to create a multilingual repository of knowledge using Wikimedia projects as a platform. You are encouraged to carefully read through the CIS-A2K work plan before making the application. You will work cohesively with the Wikimedia community and the Wikimedia India communities to meet the specific goals of each language community in India. You will be a part of a small team of 5 to 10 members doing high visibility and high impact work. Please learn more about CIS-A2K here.

Position Summary

As Programme Associate, your job will be to support the Team’s larger goals -- growth of Indian language Wikipedias, other Wikimedia projects and the contributor communities. Your primary responsibility will be to support the Programme Associates -- that spearhead our on-ground programmatic activities -- with regular communication with the community and the outside world.

Responsibilities

Storytelling and all other forms of of communication-related responsibilities are two major focus areas of this job. You will explore conventional to new media to share the stories of the many of volunteers that make Wikipedia and Wikimedia projects such great knowledge repositories
Creating original stories of challenges and success of the Indian language Wikimedia communities, including the ones that we closely work with Being the interface between A2K team and the community and lead different kinds of communications activities
Sharing the work of the community and A2k team in a regular manner through print media, newsletters, social media, mailing list updates, blog posts etc., including timely announcement of programme activities on these platforms
Providing training on effective communications to the communities on a need basis and enabling them to independently tell their own stories in their own languages
Support with writing, review and editing of the annual work plan and reports of the programme
Interviewing Wikimedians under the ambit of the WikipediansSpeak project and beyond, and share the story of the Wikimedia community widely in the media

Required skills

Good communication skill in writing and speaking, which will be required for correspondence, blog, report etc writing
Experience of blog post, report etc writing
Prior experience of working in a collaborative community, preferably online.
Strong understanding of the internet and work of the Wikimedia movement.
Active participation as a Wikimedia volunteer would be an asset, though not a prerequisite. Demonstrated experience working in a global, multi-cultural team environment.
Must be fluent in English and at least one Indian language.
A good understanding of the cultural and knowledge universe of one Indian language will be an added advantage.
Ability to integrate with and understand the complexity of the Indian Wikimedia community.
Prior experience/ knowledge in working with social media for professional communication would be an added advantage.
Prior experience/knowledge in liasioning with conventional print/broadcast media would be an added advantage.

Characteristics of the Programme Associate

High level of commitment: The Programme Associate should believe in the values of CIS and Wikimedia projects, exude enthusiasm for the mission and can powerfully embody and communicate the mission.
Intellectual curiosity and flexibility: Must enjoy tackling difficult, ambiguous problems and able to incorporate new knowledge into how one approaches situations and generates solutions, loves learning from others while expanding intellectual horizons.
Open and transparent: Have a high level of integrity and be comfortable working in a highly transparent fashion, open to input and feedback, a proactive and candid communicator who isn't afraid to bring others in when things are off-track or when they need help and should be able to handle criticism in a mature fashion.
Community builder: It is essential that the Programme Associate sees themself as a partner to and supporter of the Wikimedians who have and will continue to be the leaders in building the Wikimedia projects. The Programme Associate must be willing and able to work with a diverse array of people, many of whom come from non-traditional backgrounds and have a fervent commitment to Wikimedia movement’s community-led nature.
Strong cultural competency: Able to navigate in a global movement and on a global team in addition to navigating the complexity of India.

Location: Candidate willing to work from CIS’s Bangalore office will be preferred. Remote working option may be considered for experienced Wikimedians

Remuneration: Compensation structure will be determined by the level of expertise, experience and current remuneration.

Do not send anymore application now. the last date is over
To apply, please send your resume to Tito Dutta (tito+comm@cis-india.org) and cover letter by 21 May 2020 (applications must be submitted with cover later before 21 May 11:59:00 IST, please ensure to apply through email only).

For more details visit https://cis-india.org/jobs/programme-associate-communications

Programme Associate (Graphic designer)

gurshabad — 2020-05-12T16:01:42Z

The Centre for Internet & Society (CIS) is seeking applications for the position of Programme Associate (Graphic designer), to support its Access to Knowledge (CIS-A2K) Programme. In keeping with efforts within the larger Wikimedia movement in encouraging an inclusive workplace and addressing issues of gender disparity Women applicants are encouraged for this position, however this position for anyone to apply.

Context of the CIS-A2K programme

Position summary

CIS-A2K is looking for an ideal candidate who will help the program as a graphic designer, the work will include creating and preparing graphic content such as images, media files etc related to the A2K programme. This will be a full-time position, based at the CIS office in Bengaluru. and. The designation will be Programme Associate (PA)

Responsibilities

Creating images, posters, banners, infographics, and other promotional materials for events and announcements, which will be circulated on social media channels and used in reports.
Strategising and designing reports (progress reports, impact reports, and proposal forms), and newsletters, to make them more accessible.
Helping and working with Wikimedia community members to create relevant visual content.
Developing illustrations, logos, and other graphic material digitally or by hand.

Required skills

Proven experience with graphic design (note related education qualification is a plus, but not mandatory)
A strong portfolio of illustrations and visual communication material
The person must have good experience in creating and preparing graphic content using design software like Adobe Creative Suite, Inkscape, and GIMP (free software usage experience will be preferable)
Relevant degree holders will be given preference.
Prior knowledge of working with open knowledge or open-source community will be a plus.
Candidates who are part of the Wikimedia community, or who have experience in contributing to Wikimedia projects will be given preference.
Ability to work methodically and meet deadlines.

Location: The position is based out of the CIS’s Bangalore office.
Remuneration: Compensation structure will be determined by the level of expertise, experience and current remuneration.
To apply, please send your resume and cover letter to Tito Dutta (tito+gd@cis-india.org) by 24 May 2020 11:59 pm IST (applications won't be accepted after the deadline)

Please do not miss the +gd part in the email, that is an email filter for us)

For more details visit https://cis-india.org/jobs/programme-associate-graphic-designer

Indian Wikimedian Communities and the Gender Gap - A Space of Change, Negotiation, and Growth

bhuvana — 2020-03-09T12:15:16Z

This blog post covers key findings of the Wikipedia Gender Gap research completed by Ting-Yi Chang in April 2018. The paper was titled “Examining Female Editors’ Identity and Agency Negotiation Process within Indian Wikimedia Projects and Communities”. Here Ting-Yi brings us several observations on how the contributions by women editors' impacts Indian Wikimedia. This research focuses on participation of the women in Wikimedia activities with an emphasis on creating safe spaces and encouraging skill development.

More than two years have passed since I left India and the Indian Wikimedian communities who supported my research with considerable generosity and invaluable insights. The paper “Examining Female Editors’ Identity and Agency Negotiation Process within Indian Wikimedia Projects and Communities” was eventually finished in April 2018, featuring a qualitative analysis on 21 female Indian Wikimedians’ experiences within the communities^{^[1]}.

Due to the nature of a university thesis, the paper put great emphasis on theoretical framework testing and application, which was a good exercise for a young researcher but a rather non-approachable piece for the general public. This blog post serves to mitigate this gap to cover the key findings through 6 Q&As.

Research Context
When engaging with Indian Wikimedian Communities and looking at literature on Information and Communication Technology for Development (ICT4D), I figured that a lot of attention was given to the question of access, awareness, and skills - “Do women have internet access and devices?” “Is there enough awareness among women?” “Do women have enough technical skills to participate in online activities?”

However, for me, empowerment means asking more than these questions. After a woman has gained enough access, awareness, and skills, shouldn’t we ask: “How does she feel when she goes online or participate in a project like Wikipedia editing?” “Does her identity as a woman influence her power and the choices she makes in a male-dominant online community?” “How can we do better as a community to sensitize ourselves and make women feel more welcoming in the online space?”

This research hence used Wikimedian Communities in India as a case study to answer the following questions:

Q1: Is a free and open knowledge movement friendly to female Wikimedians and beginners?
The research found that almost all female participants who we interviewed expressed that they are in support of a free and open knowledge movement. Some of them also stated that their pride and passion in their mother tongue and culture was a major factor that motivates their participation. However, while answering this question, many also mentioned the barriers posed by a “free” movement. Since participating in Wikimedia projects is a volunteer work, some female Wikimedians reflected that they had to face doubts and questioning from their family who did not see their involvement as something beneficial - at least not on a monetary level. Many also mentioned the opportunity costs that are unique to a female Wikimedian. For example, women may be expected to take up more caretaking and household chores that would prevent them from going to community meetups and editing events. In other words, a “free” and “volunteer-based” project imposes an invisible threshold of privileges - those who have higher educational backgrounds, more disposable income and time are more likely to participate. Hence, Wikimedia projects’ free and open nature could be a double edged sword.

Q2: Is a Wikimedian community an effective space for gender/feminist movements?
Since there is an increase in the awareness of the Wikipedia gender gap and in the number of Gender Gap Bridging initiatives, it is easy to assume that a Wikimedian community is an effective space for movements. However, our research found that these movements and initiatives in Indian Wikimedian Communities have usually been small by scale, temporary, and event-based (e.g. gender gap bridging themed edit-a-thons). The reason behind could be that Wikimedian Communities’ main objective is essentially content creation, resulting in the situation that movements are usually associated with content creating activities. Alternatively, having the space for “non-productive” discussion and sensitizing training could in fact be productive and helpful for the community health as a whole. For example, I noted that building a “socializing” space creates a sense of belonging to many female Wikimedians and could possibly increase their willingness to be part of the projects in the long run.

Q3: Do female Wikimedians find that their online identity are unaffected by offline identities such as gender?
To quickly answer this question - No, a woman’s offline identity is very much connected to her online identity and experience. Through the interview process, we’ve learned that many female Wikimedians have chosen to primarily engage online in order to avoid uncomfortable offline interaction. However, it was also mentioned that online harassment, threats, and discrimination are still a common experience. Some informants also mentioned that in such close-knit communities like the Indian Wikimedian Communities, it is hard to be fully online or anonymous. Offline interaction and events actually are a very important part of community engagement that female Wikimedians risk missing out on. Hence, reconstructing both the online and offline community space are necessary as there is no one space that is “genderless.”

Q4: Do female Wikimedians perceive that they are treated fairly and receive equitable resources and opportunities within the Wikimedian communities?
Many female Wikimedians reflected that they felt welcome and treated equality as members of the Wikimedian Communities. Some even raise examples on how they were recognized as key contributors in their language communities. However, there are also comments on the “tokenizing” aspect of a seemingly well-intended, equitable practice. In one interview, an informant mentioned that she was “reminded” that the opportunity she was given was a perk based on her gender. Yet another informant stated that she was given opportunities but not on a decision-making level. Some other informants also mentioned that in order for women to be recognized as productive contributors, there needs to be changes on the inherent biased guidelines on what is “verifiable” and “notable” knowledge. In other words, it is not only on a community level that women could face discrimination, it is also in the knowledge system where we must challenge inequality.

Q5: Do female Wikimedians feel free when they are editing and engaging in the communities?
Many female Wikimedians stated that they feel free as in free to edit and to learn. Some, however, stated that when it comes to procedural freedom on how they should be writing and how they should contribute in the community, there are still certain pressure on women imposed by more experienced Wikimedians.

Q6: Does participating in Wikimedian community activities help female Wikimedians gain confidence and skills to pursue self-realization?
Most female Wikimedians who had worked on the projects for a while and took leadership positions in their communities commented that the experience enabled them to adopt new skills and confidence that they found useful in Wikimedia projects and beyond. Many commented that they were able to explore different possibilities and knowledge through the projects and through learning with the communities who have taught to inspired them. Some, however, also mentioned that although they have gained new skills, there is a certain level of self-censorship on things a female Wikimedian could say and edit on. For example, they take “calculated risk” when editing Wikipedia pages on feminist topics and other more debated gender issues which often attract conflicts. Some also mentioned that their self-realization and accomplishments need to be recognized instead of belittled or brushed off because of their gender. This reminds us that building confidence, skills, and pursuing self-realization is not an individual goal, it is so intrinsically connected to the community that we work together. Creating and maintaining a healthy community culture is hence imperative.

The link to the full paper can be found here.

^{^[1]} There were 23 informants participating in the research data collection process. 21 of them were female-identified individuals while the remaining 2 non-female interviewees were key informants within the communities.

For more details visit https://cis-india.org/a2k/blogs/indian-wikimedian-communities-and-the-gender-gap-a-space-of-change-negotiation-and-growth

PDF ASEAN Literature Review

pranav — 2020-03-05T17:32:20Z

For more details visit https://cis-india.org/internet-governance/pdf-asean-literature-review

Digital ID Kenya Case Study

pranav — 2020-03-02T13:15:55Z

For more details visit https://cis-india.org/internet-governance/digital-id-kenya-case-study

Digital ID Healthcare Case Study

pranav — 2020-03-02T11:46:25Z

For more details visit https://cis-india.org/internet-governance/digital-id-healthcare-case-study

Digital ID India Case Study

pranav — 2020-03-02T11:30:30Z

For more details visit https://cis-india.org/internet-governance/digital-id-india-case-study

Divergence between the GDPR and PDP Bill 2019

pallavi — 2020-02-21T13:05:08Z

For more details visit https://cis-india.org/internet-governance/divergence-between-the-gdpr-and-pdp-bill-2019

CIS' General Comments to the PDP Bill 2019

pallavi — 2020-02-21T10:10:54Z

For more details visit https://cis-india.org/accessibility/blog/cis-general-comments-to-the-pdp-bill-2019

Annotated ver PDP Bill 2019

pallavi — 2020-02-21T10:08:41Z

For more details visit https://cis-india.org/accessibility/blog/annotated-ver-pdp-bill-2019

CIS Comments PDP Bill 2019

pallavi — 2020-02-21T10:02:22Z

For more details visit https://cis-india.org/accessibility/blog/cis-comments-pdp-bill-2019

Gen Comments PDP Bill 2019

pallavi — 2020-02-21T10:00:16Z

For more details visit https://cis-india.org/accessibility/blog/gen-comments-pdp-bill-2019

Platformisation of Domestic Work in India: Report (February 2020)

sumandro — 2020-02-17T07:21:17Z

For more details visit https://cis-india.org/raw/platformisation-of-domestic-work-in-india-report-february-2020

Comments to the Personal Data Protection Bill 2019

Amber Sinha, Elonnai Hickok, Pallavi Bedi, Shweta Mohandas, Tanaya Rajwade — 2020-02-21T10:13:35Z

The Personal Data Protection Bill, 2019 was introduced in the Lok Sabha on December 11, 2019.

Please view our general comments below, or download as PDF here.

Our comments and recommendations can be downloaded as PDF here.

We have also prepared an annotated version of the Bill, where our detailed comments and recommendations can be viewed alongside the Bill, available as PDF here.

General Comments

1. Executive notification cannot abrogate fundamental rights

In 2017, the Supreme Court in K.S. Puttaswamy v Union of India [1] held the right to privacy to be a fundamental right. While this right is subject to reasonable restrictions, the restrictions have to meet a three fold requirement, namely (i) existence of a law; (ii) legitimate state aim; (iii) proportionality.Under the 2018 Bill, the exemption to government agencies for processing of personal data from the provisions of the Bill in the ‘interest of the security of the State’ [2] was subject to a law being passed by Parliament. However, under Clause 35 of the present Bill, the Central Government is merely required to pass a written order exempting the government agency from the provisions of the Bill.Any restriction on the right to privacy will have to comply with the conditions prescribed in Puttaswamy I. An executive order issued by the central government authorising any agency of the government to process personal data does not satisfy the first requirement laid down by the Supreme Court in Puttaswamy I — as it is not a law passed by Parliament. The Supreme Court while deciding upon the validity of Aadhar in K.S. Puttaswamy v Union of India [3] noted that “an executive notification does not satisfy the requirement of a valid law contemplated under Puttaswamy. A valid law in this case would mean a law passed by Parliament, which is just, fair and reasonable. Any encroachment upon the fundamental right cannot be sustained by an executive notification.”

2. Exemptions under Clause 35 do not comply with the legitimacy and proportionality test

The lead judgement in Puttaswamy I while formulating the three fold test held that the restraint on privacy emanate from the procedural and content based mandate of Article 21 [4]. The Supreme Court in Maneka Gandhi v Union India [5] had clearly established that “mere prescription of some kind of procedure cannot ever meet the mandate of Article 21. The procedure prescribed by law has to be fair, just and reasonable, not fanciful, oppressive and arbitrary” [6]. The existence of a law is the first requirement; the second requirement is that of ‘legitimate state aim’. As per the lead judgement this requirement ensures that “the nature and content of the law which imposes the restriction falls within the zone of reasonableness mandated by Article 14, which is a guarantee against arbitrary state action” [7]. It is established that for a provision which confers upon the executive or administrative authority discretionary powers to be regarded as non-arbitrary, the provision should lay down clear and specific guidelines for the executive to exercise the power [8]. The third test to be complied with is that the restriction should be ‘proportionate,’ i.e. the means that are adopted by the legislature are proportional to the object and needs sought to be fulfilled by the law. The Supreme Court in Modern Dental College & Research Centre v State of Madhya Pradesh [9] specified the components of proportionality standards —

A measure restricting a right must have a legitimate goal;
It must be a suitable means of furthering this goal;
There must not be any less restrictive, but equally effective alternative; and
The measure must not have any disproportionate impact on the right holder

Clause 35 provides extensive grounds for the Central Government to exempt any agency from the requirements of the bill but does not specify the procedure to be followed by the agency while processing personal data under this provision. It merely states that the ‘procedure, safeguards and oversight mechanism to be followed’ will be prescribed in the rules.The wide powers conferred on the central government without clearly specifying the procedure may be contrary to the three fold test laid down in Puttaswamy I, as it is difficult to ascertain whether a legitimate or proportionate objective is being fulfilled [10].

3. Limited powers of Data Protection Authority in comparison with the Central Government

In comparison with the last version of the Personal Data Protection Bill, 2018 prepared by the Committee of Experts led by Justice Srikrishna, we witness an abrogation of powers of the Data Protection Authority (Authority), to be created, in this Bill. The powers and functions that were originally intended to be performed by the Authority have now been allocated to the Central Government. For example:

In the 2018 Bill, the Authority had the power to notify further categories of sensitive personal data. Under the present Bill, the Central Government in consultation with the sectoral regulators has been conferred the power to do so.
Under the 2018 Bill, the Authority had the sole power to determine and notify significant data fiduciaries, however, under the present Bill, the Central Government has in consultation with the Authority been given the power to notify social media intermediaries as significant data fiduciaries.

In order to govern data protection effectively, there is a need for a responsive market regulator with a strong mandate and resources. The political nature of the personal data also requires that the governance of data, particularly the rule-making and adjudicatory functions performed by the Authority are independent of the Executive.

4. No clarity on data sandbox

The Bill contemplates a sandbox for “ innovation in artificial intelligence, machine-learning or any other emerging technology in public interest.” A Data Sandbox is a non-operational environment where the analyst can model and manipulate data inside the data management system. Data sandboxes have been envisioned as a secure area where only a copy of the company’s or participant companies’ data is located [11]. In essence, it refers to the scalable and creation platform which can be used to explore an enterprise’s information sets. On the other hand, regulatory sandboxes are controlled environments where firms can introduce innovations to a limited customer base within a relaxed regulatory framework, after which they may be allowed entry into the larger market after meeting certain conditions. This purportedly encourages innovation through the lowering of entry barriers by protecting newer entrants from unnecessary and burdensome regulation. Regulatory sandboxes can be interpreted as a form of responsive regulation by governments that seek to encourage innovation – they allow selected companies to experiment with solutions within an environment that is relatively free of most of the cumbersome regulations that they would ordinarily be subject to, while still subject to some appropriate safeguards and regulatory requirements. Sandboxes are regulatory tools which may be used to permit companies to innovate in the absence of heavy regulatory burdens. However, these ordinarily refer to burdens related to high barriers to entry (such as capital requirements for financial and banking companies), or regulatory costs. In this Bill, however, the relaxing of data protection provisions for data fiduciaries would lead to restrictions of the privacy of individuals. Limitations to a fundamental rights on grounds of ‘fostering innovation’ is not a constitutional tenable position, and contradict the primary objectives of a data protection law.

5. The primacy of ‘harm’ in the Bill ought to be reconsidered

While a harms based approach is necessary for data protection frameworks, such approaches should be restricted to the positive obligations, penal provisions and responsive regulation of the Authority. The Bill does not provide any guidance on either the interpretation of the term ‘harm,’ [12] or on the various activities covered within the definition of the term. Terms such as ‘loss of reputation or humiliation’ ‘any discriminatory treatment’ are a subjective standard and are open to varied interpretations. This ambiguity in the definition will make it difficult for the data principal to demonstrate harm and for the DPA to take necessary action as several provisions are based upon harm being caused or likely to be caused.Some of the significant provisions where ‘harm’ is a precondition for the provision to come into effect are —

Clause 25: Data Fiduciary is required to notify the Authority about the breach of personal data processed by the data fiduciary, if such breach is likely to cause harm to any data principal. The Authority after taking into account the severity of the harm that may be caused to the data principal will determine whether the data principal should be notified about the breach.
Clause 32 (2): A data principal can file a complaint with the data fiduciary for a contravention of any of the provisions of the Act, which has caused or is likely to cause ‘harm’ to the data principal.
Clause 64 (1): A data principal who has suffered harm as a result of any violation of the provision of the Act by a data fiduciary, has the right to seek compensation from the data fiduciary.

Clause 16 (5): The guardian data fiduciary is barred from profiling, tracking or undertaking targeted advertising directed at children and undertaking any other processing of personal data that can cause significant harm to the child.

6. Non personal data should be outside the scope of this Bill

Clause 91 (1) states that the Act does not prevent the Central Government from framing a policy for the digital economy, in so far as such policy does not govern personal data. The Central Government can, in consultation with the Authority, direct any data fiduciary to provide any anonymised personal data or other non-personal data to enable better targeting of delivery of services or formulation of evidence based policies in any manner as may be prescribed.It is concerning that the data protection bill has specifically carved out an exception for the Central Government to frame policies for the digital economy and seems to indicate that the government plans to freely use any and all anonymized and/or non-personal data that rests with any data fiduciary that falls under the ambit of the bill to support the digital economy including for its growth, security, integrity, and prevention of misuse. It is unclear how the government, in practice, will be able to compel organizations to share this data. Further, there is a lack of clarity on the contours of the definition of non-personal data and the Bill does not define the term. It is also unclear whether the Central Government can compel the data fiduciary to transfer/share all forms of non-personal data and the rights and obligations of the data fiduciaries and data principals over such forms of data. Anonymised data refers to data which has ‘ irreversibly’ been converted into a form in which the data principal cannot be identified. However, as several instances have shown ‘ irreversible’ anonymisation is not possible. In the United States, the home addresses of taxi drivers were uncovered and in Australia individual health records were mined from anonymised medical bills [13]. In September 2019, the Ministry of Electronics and Information Technology, constituted an expert committee under the chairmanship of Kris Gopalkrishnan to study various issues relating to non-personal data and to deliberate over a data governance framework for the regulation of such data.The provision should be deleted and the scope of the bill should be limited to protection of personal data and to provide a framework for the protection of individual privacy. Until the report of the expert committee is published, the Central Government should not frame any law/regulation on the access and monetisation of non-personal/ anonymised data nor can they create a blanket provision allowing them to request such data from any data fiduciary that falls within the ambit of the bill. If the government wishes to use data resting with a data fiduciary; it must do so on a case to case basis and under formal and legal agreements with each data fiduciary.

7. Steps towards greater decentralisation of power

We propose the following steps towards greater decentralisation of powers and devolved jurisdiction —

Creation of State Data Protection Authorities: A single centralised body may not be the appropriate form of such a regulator. We propose that on the lines of central and state commissions under the Right to Information Act, 2005, state data protection authorities are set up which are in a position to respond to local complaints and exercise jurisdiction over entities within their territorial jurisdictions.
More involvement of industry bodies and civil society actors: In order to lessen the burden on the data protection authorities it is necessary that there is active engagement with industry bodies, sectoral regulators and civil society bodies engaged in privacy research. Currently, the Bill provides for involvement of industry or trade association, association representing the interests of data principals, sectoral regulator or statutory Authority, or an departments or ministries of the Central or State Government in the formulation of codes of practice. However, it would be useful to also have a more active participation of industry associations and civil society bodies in activities such as promoting awareness among data fiduciaries of their obligations under this Act, promoting measures and undertaking research for innovation in the field of protection of personal data.

8. The Authority must be empowered to exercise responsive regulation

In a country like India, the challenge is to move rapidly from a state of little or no data protection law, and consequently an abysmal state of data privacy practices to a strong data protection regulation and a powerful regulator capable of enabling a state of robust data privacy practices. This requires a system of supportive mechanisms to the stakeholders in the data ecosystem, as well as systemic measures which enable the proactive detection of breaches. Further, keeping in mind the limited regulatory capacity in India, there is a need for the Authority to make use of different kinds of inexpensive and innovative strategies.We recommend the following additional powers for the Authority to be clearly spelt out in the Bill —

Informal Guidance: It would be useful for the Authority to set up a mechanism on the lines of the Security and Exchange Board of India (SEBI)’s Informal Guidance Scheme, which enables regulated entities to approach the Authority for non-binding advice on the position of law. Given that this is the first omnibus data protection law in India, and there is very little jurisprudence on the subject from India, it would be extremely useful for regulated entities to get guidance from the regulator.
Power to name and shame: When a DPA makes public the names of organisations that have seriously contravened data protection legislation, this is a practice known as “naming and shaming.” The UK ICO and other DPAs recognise the power of publicity, as evidenced by their willingness to co-operate with the media. The ICO does not simply post monetary penalty notices (MPNs or fines) on its websites for journalists to find, but frequently issues press releases, briefs journalists and uses social media. The ICO’s publicity statement on communicating enforcement activities states that the “ICO aims to get media coverage for enforcement activities.”
Undertakings: The UK ICO has also leveraged the threats of fines into an alternative enforcement mechanism seeking contractual undertakings from data controllers to take certain remedial steps. Undertakings have significant advantages for the regulator. Since an undertaking is a more “co-operative”solution, it is less likely that a data controller will change it. An undertaking is simpler and easier to put in place. Furthermore, the Authority can put an undertaking in place quickly as opposed to legal proceedings which are longer.

9. No clear roadmap for the implementation of the Bill

The 2018 Bill had specified a roadmap for the different provisions of the Bill to come into effect from the date of the Act being notified [14]. It specifically stated the time period within which the Authority had to be established and the subsequent rules and regulations notified.The present Bill does not specify any such blueprint; it does not provide any details on either when the Bill will be notified or the time period within within which the Authority shall be established and specific rules and regulations notified. Considering that 25 provisions have been deferred to rules that have to be framed by the Central Government and a further 19 provisions have been deferred to the regulations to be notified by the Authority the absence and/or delayed notification of such rules and regulations will impact the effective functioning of the Bill.The absence of any sunrise or sunset provision may disincentivise political or industrial will to support or enforce the provisions of the Bill. An example of such a lack of political will was the establishment of the Cyber Appellate Tribunal. The tribunal was established in 2006 to redress cyber fraud. However, it was virtually a defunct body from 2011 onwards when the last chairperson retired. It was eventually merged with the Telecom Dispute Settlement and Appellate Tribunal in 2017.We recommend that Bill clearly lays out a time period for the implementation of the different provisions of the Bill, especially a time frame for the establishment of the Authority. This is important to give full and effective effect to the right of privacy of the
individual. It is also important to ensure that individuals have an effective mechanism to enforce the right and seek recourse in case of any breach of obligations by the data fiduciaries.For offences, we suggest a system of mail boxing where provisions and punishments are enforced in a staggered manner, for a period till the fiduciaries are aligned with the provisions of the Act. The Authority must ensure that data principals and fiduciaries have sufficient awareness of the provisions of this Bill before bringing the provisions for punishment are brought into force. This will allow the data fiduciaries to align their practices with the provisions of this new legislation and the Authority will also have time to define and determine certain provisions that the Bill has left the Authority to define. Additionally enforcing penalties for offences initially must be in a staggered process, combined with provisions such as warnings, in order to allow first time and mistaken offenders from paying a high price. This will relieve the fear of smaller companies and startups who might fear processing data for the fear of paying penalties for offences.

10. Lack of interoperability

In its current form, a number of the provisions in the Bill will make it difficult for India’s framework to be interoperable with other frameworks globally and in the region. For example, differences between the draft Bill and the GDPR can be found in the grounds for processing, data localization frameworks, the framework for cross border transfers, definitions of sensitive personal data, inclusion of the undefined category of ‘critical data’, and the roles of the authority and the central government.

11. Legal Uncertainty

In its current structure, there are a number of provisions in the Bill that, when implemented, run the risk of creating an environment of legal uncertainty. These include: lack of definition of critical data, lack of clarity in the interpretation of the terms ‘harm’ and ‘significant harm’, ability of the government to define further categories of sensitive personal data, inclusion of requirements for ‘social media intermediaries’, inclusion of ‘non-personal data’, framing of the requirements for data transfers, bar on processing of certain forms of biometric data as defined by the Central Government, the functioning between a consent manager and another data fiduciary, the inclusion of an AI sandbox and the definition of state. To ensure the greatest amount of protection of individual privacy rights and the protection of personal data while also enabling innovation, it is important that any data protection framework is structured and drafted in a way to provide as much legal certainty as possible.

Endnotes

1. (2017) 10 SCC 641 (“Puttaswamy I”).

2. Clause 42(1) of the 2018 Bill states that “Processing of personal data in the interests of the security of the State shall not be permitted unless it is authorised pursuant to a law, and is in accordance with the procedure established by such law, made by Parliament and is necessary for, and proportionate to such interests being achieved.”

3. (2019) 1 SCC 1 (“Puttaswamy II”)

4. Puttaswamy I, supra, para 180.

5. (1978) 1 SCC 248.

6. Ibid para 48.

7. Puttaswamy I supra para 180.

8. State of W.B. v. Anwar Ali Sarkar, 1952 SCR 284; Satwant Singh Sawhney v A.P.O AIR 1967 SC1836.

9. (2016)7 SCC 353.

10. Dvara Research “Initial Comments of Dvara Research dated 16 January 2020 on the Personal Data Protection Bill, 2019 introduced in Lok Sabha on 11 December 2019”, January 2020, https://www.dvara.com/blog/2020/01/17/our-initial-comments-on-the-personal-data-protection-bill-2019/ (“Dvara Research”).

11. “A Data Sandbox for Your Company”, Terrific Data, last accessed on January 31, 2019, http://terrificdata.com/2016/12/02/3221/.

12. Clause 3(20) — “harm” includes (i) bodily or mental injury; (ii) loss, distortion or theft of identity; (ii) financial loss or loss of property; (iv) loss of reputation or humiliation; (v) loss of employment; (vi) any discriminatory treatment; (vii) any subjection to blackmail or extortion; (viii) any denial or withdrawal of service,benefit or good resulting from an evaluative decision about the data principal; (ix) any restriction placed or suffered directly or indirectly on speech, movement or any other action arising out of a fear of being observed or surveilled; or (x) any observation or surveillance that is not reasonably expected by the data principal.

13. Alex Hern “Anonymised data can never be totally anonymous, says study”, July 23, 2019 https://www.theguardian.com/technology/2019/jul/23/anonymised-data-never-be-anonymous-enough-study-finds.

14. Clause 97 of the 2018 Bill states“(1) For the purposes of this Chapter, the term ‘notified date’ refers to the date notified by the Central Government under sub-section (3) of section 1. (2)The notified date shall be any date within twelve months from the date of enactment of this Act. (3)The following provisions shall come into force on the notified date-(a) Chapter X; (b) Section 107; and (c) Section 108. (4)The Central Government shall, no later than three months from the notified date establish the Authority. (5)The Authority shall, no later than twelve months from the notified date notify the grounds of processing of personal data in respect of the activities listed in sub-section (2) of section 17. (6)The Authority shall no, later than twelve months from the date notified date issue codes of practice on the following matters-(a) notice under section 8; (b) data quality under section 9; (c) storage limitation under section 10; (d) processing of personal data under Chapter III; (e) processing of sensitive personal data under Chapter IV; (f ) security safeguards under section 31; (g) research purposes under section 45; (h) exercise of data principal rights under Chapter VI; (i) methods of de-identification and anonymisation; (j) transparency and accountability measures under Chapter VII. (7)Section 40 shall come into force on such date as is notified by the Central Government for the purpose of that section.(8)The remaining provision of the Act shall come into force eighteen months from the notified date.”

For more details visit https://cis-india.org/internet-governance/blog/comments-to-the-personal-data-protection-bill-2019