Word choice in data protection law, a dilution of rights

Source– The post is based on the article “Word choice in data protection law, a dilution of rights” published in “The Hindu” on 18th August 2023.

Syllabus: GS2- Polity

Relevance: Important Bills and Acts

News– India finally has a data protection law, called the Digital Personal Data Protection Act, 2023.

What are provision in data protection law related to consent for providing their data?

The enduring dilemma in data protection lies in establishing the criteria for consent. There are concerns relted to individuals providing a genuine choice when their data is utilized.

The legislation includes two relevant clauses.

As per one provision, individual must be properly informed about the details of your consent. Only clear postive signal from the individual part will be interpreted as consent.

However, this provision is counterbalanced by a second one. It allows data usage if you have “voluntarily provided” the data and have not indicated non-consent.

If you have “not indicated” refusal, governmental bodies and corporations might presume your consent for diverse uses without formally notifying you.

This lack of clarity will create confusion in legal proceedings as well as uncertainty in business circles regarding the correct benchmark for obtaining consent.

What are issues related to consent provision in new data protection law?

Obtaining consent may not always be feasible for the utilization of personal data.

For example, an individual’s decisions regarding their data could hinder various public operations like identity verification, targeting welfare benefits, and enforcing laws.

In previous versions of  law, personal data can be used without consent only if it was “essential” for a specific purpose related to legitimate state functions, fulfilling legal obligations, and addressing emergencies.

The data custodian had to establish that there were no viable alternatives to collecting and utilizing the information in the specified manner.

The 2023 legislation allows for data processing without consent when it is “for” rather than “necessary for” certain legitimate purposes.

This slight alteration in wording can have a substantial effect on the actual level of protection offered. Privacy issues will be there.

When the data undergoes processing without your consent, individual will not receive any notification of this occurrence. He will not have the opportunity to rectify incorrect data or remove unnecessary information afterward.

Data collected for one non-consensual purpose can be freely utilized for other purposes. This is in contrast to the stance of the Supreme Court of India. It has recognized principles like necessity and purpose limitation as integral to the right to informational privacy.