Search interesting materials

Friday, September 14, 2018

Privacy, Aadhaar, Data Protection: Statist Liberalism and the Danger to Liberty

by Anirudh Burman.

Kings will be tyrants from policy when subjects are rebels from principle.

                                         - Edmund Burke, Reflections on the Revolution in France

Edmund Burke wrote these lines in a scathing critique of the demise of ancient traditions of allegiance, fealty and "dignified obedience" in the wake of the French Revolution. These lines today apply in a very different sense to the search for state-centred solutions to protecting privacy and personal data. The discourse over privacy, identification and data protection shows that liberal concerns with state power co-exists with a preference for state coercion in the name of furthering ostensibly liberal objectives. This discourse is marked by the absence of underlying liberal principles based on societal and associational freedom, and instead, repeatedly shows a preference for state coercion for achieving its ends.

This discourse and the policy responses to the same fail to address two fundamental questions: first, what does the right to privacy seek to protect? Privacy is treated as an end in itself, and this has significant ramifications on how we think about constituting liberty in our society. Second, what institutional and associational processes are necessary to protect privacy? Institutional and associational processes that rely overwhelmingly on state coercion are counter-intuitive and may ultimately harm individual privacy and autonomy.

I address three major strands of the privacy discourse that address different aspects of the right to privacy, but share a common problem: the discourse is framed in a manner that treats privacy as an end in itself. The result of the nature of this discourse is that state power to infringe on privacy seems to have strengthened rather than weakened. I begin with analysing the existing discourse on the debate over whether India's increasingly ubiquitous identification system, Aadhaar, violates privacy rights or not. I argue that by focusing on Aadhaar's constitutionality vis-a-vis the right to privacy and not examining the ends for which Aadhaar is being used, the existing debates fail to question the use of state power via Aadhaar and its implications for privacy and liberty.

The next major strand of the privacy debate, the judgement of the Indian Supreme Court in Justice K.S. Puttaswamy v. Union of India ("Privacy judgement") also treats privacy as an end, rather than a means to protect other ends. As I argue, the consequence of the judgement is to provide clarity for the use of state power with respect to privacy rights rather than to elucidate those aspects of social existence that need protection from the state through privacy rights. Data protection, and the Personal Data Protection Bill proposed by the Justice Srikrishna Committee is the third major strand of the privacy debate. The Bill also treats privacy as an end. In seeking to protect data as an end in itself, it confers a wide jurisdiction on the proposed Data Protection Authority. By doing so, the Bill gives the Authority the power to potentially surveil all data in India in order to, ironically, protect data privacy.

I argue that by treating privacy as a broad right and an end in itself, we have defined the role of privacy in society narrowly. Instead, privacy as a right has to be discussed in specific contexts such as marriage, sexuality, crime records and employment history. Each context reflects a different tension between a specific public interest and the privacy interests of specific individuals. Only such specific discussions on how privacy rights can help individuals protect their freedoms, can further the interests of liberty in our society.

Efficiency, Privacy and Aadhaar

In the decades since independence, Indian politicians and intellectuals by and large agreed on the need for a social welfare state. Specifically, a State that would strive to provide health, education, food, and infrastructure to its populace. Despite the mixed record of the State in achieving these objectives, the premise of what the Indian State should do has not been challenged to any substantial degree. While the State has withdrawn from running industries and fostered private markets over the past three decades, the assumption that welfare is a fundamental task of the Indian State has not been questioned. In fact, the welfare state character of the Indian State has been significantly expanded in the past two decades through initiatives such as NREGA and others addressing food security and debt relief.

A central task before a welfare state is identification, or what James C. Scott calls the quest for "legibility". The search for legibility is rooted in policy makers' inability to comprehend complex realities and their consequent search for symbols or markers that make society comprehensible or "legible" to them. For the purposes of the State, individuals must be defined primarily in terms of specific traits (e.g. age, education, residence, income, profession, ethnicity, caste, etc.) While this quest for legibility is not confined only to the state, no state can act on its welfare mandate without making individuals legible. Benefits are distributed to individuals based on how a state identifies them. Thus, if only "the poor" can avail of LPG subsidies, defining who is "poor" becomes of central importance. Aadhaar is the product of this search for better identification, required due to ever-increasing welfare and regulatory functions the Indian State has to perform.

In the decades before Aadhaar was implemented, the manner in which the state identified beneficiaries was critiqued as being deeply flawed. The systems were rife with documented instances of poor implementation and fraud. Additionally, many in need of what the welfare schemes sought to provide lacked the documents to prove their eligibility for the same. While concerted efforts were made to improve public distribution systems through initiatives like computerisation, significant exclusions continued to take place. These improvements were also unevenly distributed across state governments, and subject to sustained political commitment.

Any improvements in targeting/identification however, have remained subject to new political diversions and demands from the State. NREGA for example, was a new social welfare scheme that required the determination of eligibility on metrics that were different from say, traditional PDS schemes. It required the State to collect and maintain information about individuals based on metrics that the Indian State had not collected in a systematic manner prior to its introduction. Every new scheme that requires benefits to be conferred to individuals had and continues to have its own metrics for eligibility (Jan Dhan Yojana requires very different kinds of identification requirements than say, Start-up India).

The demand for better and different forms of identification therefore increase each time a new benefit has to be made available to individuals. If the state has to perform an ever-increasing number of welfare functions, it will require ever-increasing information about intended beneficiaries, as it needs to know whom to include and whom to exclude. Over time, therefore, the extent of information collected about individuals increases due to the numerous functions the state is required to perform.

This is not just confined to welfare measures. Any state action that intends to regulate individual conduct has to determine whom to regulate and on what basis. If, for example, persons with criminal backgrounds are to be excluded from contesting elections, the state needs to collect and analyse information about the criminal backgrounds of those contesting elections. If the state intends to regulate banking, it needs to collect information about banks and financial firms.

The increase in the collection of information for discharging the functions demanded from the state constitute the source of the concerns with privacy. The largest threat to individual privacy therefore comes not from the existence of Aadhaar, but from the ever increasing number of regulatory functions and welfare measures demanded of the Indian State. Problems of identification systems are downstream of these demands. State-centred solutions, and unprincipled welfarism pose a greater threat to individual privacy and liberty than any single identification system used by the Indian State.

This is borne out by a careful analysis of the main points of contention in the Aadhaar and data protection debate.

Aadhaar is a database that maintains bio-metric and other personal identification information about individuals. If a government or private agency wishes to verify the identity of an individual, the Unique Identification Authority of India (UIDAI), as the custodian of the Aadhaar database, enables such authentication through specified mechanisms. Aadhaar does not maintain records of what was authenticated. It retains a record only of when a person's identity was verified and by whom, not for what purpose.

Aadhaar is therefore more or less a value-neutral utility. In itself, it does not have a fixed use other than to identify individuals. It is up to the user (the government or private agencies) to use it as a means of identification for a specific purpose. Such use depends solely on its utility as an accurate system of identification. It does not pre-suppose what the system is going to be used for. Its raison d'etre is to enable the state to identify individuals accurately, if required. Its existence, in fact, promotes discourse on what it ought to be used for, and how it ought to be used.

When Aadhaar was conceptualised and being created, the state promised that the system would be used for identifying beneficiaries of social welfare schemes. This has however, not remained the case. From tax compliance to school admissions and new phone connections, the use of Aadhaar has extended well beyond social welfare purposes. It is, however, important to note that this growth is demand-led for the large part. Government departments and agencies, as well as private firms, are using Aadhaar because it is a largely accurate database compared to other mechanisms for verifying individual identity. State authorities and private agencies are mandating Aadhaar-based authentication because they see value in it, not because the UIDAI says they must. The alleged threat to privacy has therefore come about not because Aadhaar exists, but because the State chooses to use it for discharging the functions demanded of it.

Some detractors have argued that Aadhaar is unconstitutional as some individuals are unable to access social welfare benefits due to authentication failures. In many such cases, the implementation by these departments and agencies has been faulty. Aadhaar authentication requires a connection to the central Aadhaar database, and this becomes problematic in cases of poor internet connectivity. In such cases however, it is the user agencies that are at fault. Making Aadhaar authentication mandatory in remote areas with low internet connectivity is an example of poor planning and implementation. It is the use of Aadhaar that must be debated.

This and other issues have been brought up in a clutch of cases currently pending before the Supreme Court. The cases in the Supreme Court however lay the blame on the existence of Aadhaar rather than its uses. Additionally, of the many grounds of challenge, there are some that are simply not amenable to effective redress through judicial mechanisms. The first is the question of exclusions. Any system of identification is designed to exclude. The purpose of identification is to enable inclusion at the cost of exclusion. The danger is that of unintended exclusions. People should not be excluded from benefits that were intended to be made available to them. The detractors of Aadhaar claim that the implementation of Aadhaar is leading to arbitrary exclusions, with persons who were previously included now being excluded. However, one must distinguish between the role of Aadhaar in unintended exclusions, and the uses of Aadhaar leading to unintended exclusions. For example, if there were no scheme called NREGA being implemented, there would be no Aadhaar-related exclusions from NREGA. In such a case Aadhaar would continue to exist, but not be the cause of any exclusions in NREGA. Exclusions are occurring because there is a welfare function that the state is discharging.

Another point of detraction has been that of data security and data leakage. The claim is yet again, that because of its potential for misuse, the use of Aadhaar for seeding information about citizens creates a potential for misuse. However, any information that the state stores by aggregating data using some other central identification ID (PAN numbers, passport numbers, Voter ID cards, etc) is subject to the same potential issues. Any central identifier that could be used to link multiple databases is likely to suffer from similar issues. If PAN numbers or mobile phone numbers are used to aggregate data about individuals instead of Aadhaar, the same fear of profiling is still likely to exist. The problem is therefore not with Aadhaar, but with the process of profiling individuals. It is therefore necessary to problematise the issue of profiling, rather than the use of Aadhaar for profiling.

The discourse on these issues reflects undue focus on means rather than ends. It is important to distinguish between Aadhaar as an instrumentality of the state, and the purposes for which Aadhaar can be used. It is the latter that leads to privacy concerns, not the existence of the instrumentality itself. The same privacy concerns will remain tomorrow if Aadhaar is replaced by another system of identification. The Indian state will continue to violate individual privacy, liberty and dignity if the ends to which systems of identification are used are not carefully examined, questioned, and thought through.

Some of these issues require political solutions, others judicial ones. The judiciary can provide judicial answers to legal questions. It is not a forum that can provide answers to questions of efficiency. It cannot help society decide on what is the most effective method of identifying individuals while respecting individual privacy. This is a political decision that has to be reached through a political process. The judiciary can also not answer questions as to what are "good" methods of data aggregation and storage. These are technocratic decisions that also have to come from the political process.

This is due to the very nature of the judicial process which seeks blunt answers to blunt questions - "is Aadhaar constitutional or not?". Any path the Supreme Court takes to balance competing interests such as privacy versus efficiency will be, at most, a second-best alternative to what sustained political engagement could have created. The nature of judicial outcomes is to provide perfect legal certainty by ending political contestation with legal certainty. Judicial interpretations of constitutions have the effect of ending political and legal disputes, not to create space for further political negotiations.

Any future negotiation can only take place by treating the court's decision as a given. A good example is the spectrum allocation case, where the Supreme Court held that telecom licenses were arbitrarily allocated, and that future allocations can only happen through auctions (subsequently modified by the Supreme Court in another case). Any further discourse on the subject had to deal with the fact that spectrum had to be mandatorily auctioned, with no possibility of discussions over better methods of spectrum allocation. This is what happens in most cases that come before constitutional courts. In the judcialisation of Aadhaar, we may have lost a significant opportunity to negotiate politically and improve its functioning.

The nature of relief claimed from the Supreme Court in the Aadhaar case asks some legitimate questions that the Supreme Court is well placed to answer, particularly with respect to whether the law should have been passed as a money bill, and in which instances Aadhaar can be made mandatory. But it also asks many questions that do not help address the real concerns about privacy - if all identification systems lead to exclusion, in what circumstances is exclusion constitutionally impermissible? If all data aggregation systems are potentially vulnerable to leakage and theft, in what circumstances is data leakage unconstitutional? If all state welfare functions lead to some kind of profiling, what kinds of profiling are constitutionally impermissible? In short, what are the values that the right to privacy seeks to protect?

Privacy judgement: Clarifying the use of state power

If the expectation from the Supreme Court in the case of Justice K.S. Puttaswamy v. Union of India ("Privacy judgement") was that it would explain what underlying values the right to privacy seeks to protect, it was belied. While the Supreme Court bench that decided this case was constituted because the Aadhaar bench made a reference to it, this case itself did not decide on privacy rights vis-a-vis Aadhaar.

In a remarkable feat of judicial activism the Court not only declared that there is a fundamental right to privacy, but that this right is an end in itself. The leading judgement (given by 4 out of 9 judges) states that the purpose of the Court in writing the Privacy judgement is to expound upon the right to privacy by providing a "doctrinal formulation".

The judgement lists a series of Indian cases in which a right to privacy has been claimed. As the Court itself notes after discussing these cases, many past judgements have held that a right to privacy exists under the Indian Constitution. What then, one might ask, was the need for this nine-judge bench? The answer provided by the Court was,

"...The deficiency, however, is in regard to a doctrinal formulation of the basis on which it can be determined as to whether the right to privacy is constitutionally protected..."

The Court therefore intends to assert the existence of a right to privacy as an end in itself, rather than a means to an end. Unlike all previous cases the Privacy judgement itself notes, this judgement was written with no applicability to a specific dispute before the court.

A long line of jurisprudence listed in the Privacy judgement highlights the fact that privacy has always been used to protect a specific interest or value: In Kharak Singh's case, it was privacy in the context of night-time domiciliary visits. In RM Malkani v. State of Maharashtra and PUCL v. Union of India it was privacy in the context of telephone tapping. In Gobind v. State of MP, the discussion on privacy was in the context of history-sheeting under state police regulations. In Malak Singh v. State of Punjab it was a surveillance register of specified categories of convicts. In Rajagopal, the judgement on privacy centred around the question on whether the autobiography of a convicted prisoner, allegedly co-authored by someone else, could be published. In Mr. X v. Hospital Z the issue of unauthorised disclosure of a patient's HIV status was in question. In Sharda v. Dharmpal the question of privacy rights arose in the context of a court order forcing a person to undergo a medical examination as part of divorce proceedings. In District Registrar and Collector, Hyderabad v Canara Bank, the question of privacy was in the context of the confidentiality of documents submitted to a public official. In the US Supreme Court case of Griswold v Connecticut that the Privacy judgement cites as well, - the right to privacy was held to exist in order to address a specific concern, namely the right of a married couple to use contraceptives.

In fact, globally, one would be hard pressed to find a judgement that is totally divorced from a factual dispute, that does not treat the right to privacy as essential to protecting other specific rights. Why does this matter? It matters because in treating privacy as an end, the judgement and the detractors of Aadhaar fail to deal with the underlying issues that infringe upon privacy and liberty. This in turn leads the Court to formulate tests that on closer inspection, clarify the use of state power with respect to privacy rights, without adequately explaining what those privacy interests are.

The Court notes that privacy is essential for the protection of individual autonomy and dignity. But it does not elaborate on what aspects of autonomy are worthy of being protected by privacy. Other than illustrating some examples of how the right to privacy could be applied to specific situations such as sexual orientation and data security, it provides no guidance on how this right to privacy is expected to interact with situations where individual privacy is subjected to larger societal interests. For example, the Court talks about the protection of individual identity in the context of data protection, but provides no explanation of what specific harms the right to privacy seeks to protect in the context of the misuse of personal data.

This is important as there are situations when individual autonomy and privacy may legitimately be circumscribed by societal interests. These include the disclosure of health records for buying health insurance or seeking health benefits, and the disclosure of income related information for claiming subsidies, etc. The judgement offers no consideration of the tension between individual privacy, liberty and public interest; this could only have been done in light of a specific dispute where the Court would have been forced to balance real and conflicting tensions.

Faced with this lack of factual circumstances, the Court in the Privacy judgement instead justifies possible constraints on privacy rights through a vague necessity doctrine. The Court states that the right to privacy can only be constrained by a parliamentary law made for a legitimate state interest, with constraints proportional to the object the law seeks to achieve.

It is, however, explicit in stating that the question of legitimate state interests in violating privacy rights can only be reviewed on the grounds of arbitrariness. In addition to laying down this test in the absence of specific circumstances, the judgement provides broad illustrations of what could be considered legitimate state purposes - national security, promotion of innovation, conferring social welfare benefits, etc. Unlike previous cases where the facts of the dispute ground the doctrinal points made by courts, the doctrinal points here can be construed widely or narrowly depending on the specific predilections of future courts.

The question of legitimate state interests is the question that should have occupied the attention of the Court - what kinds of infringements of privacy are permissible when specific actions of the State are claimed to be in furtherance of legitimate state interests? As per the Court, the only basis on which such a claim can be challenged is that of being arbitrary and disproportional. As long as there is no arbitrariness or disproportionality, infringements of privacy are permissible. However, neither arbitrariness or disproportionality are tests related directly to liberty and privacy in themselves.

For example, it is one thing to question whether the law related to telephone tapping is arbitrary or disproportional to the legitimate objectives of national security. It is another to question whether telephone tapping violates privacy or not. As per the test laid down by the Supreme Court, the law would not be unconstitutional if it were not arbitrary or disproportional. The test limits the discussion on the tension between privacy and national security only to the grounds of arbitrariness and proportionality. In doing so, the Court arguably missed an opportunity to create tests for legitimate state interests in interfering with privacy rights. Instead, the judgement of the Court illustrates a broad range of legitimate state interests where the state can interfere with privacy rights.

The same conclusion can be reached regarding the applicability of this judgement to other issues. If combating marital rape is a legitimate state interest, the Privacy judgement takes us no further in thinking about how to enter the private sanctuary of a bedroom in a way that respects the privacy of the married couple. Any law can be made as long as it is not arbitrary or disproportionate to a widely construed notion of a legitimate state objective. This is arguably an incomplete test, since it does not seek to balance the legitimate privacy interests of the married couple with the objectives of the state. The only balancing factors are that such laws not be arbitrary or disproportional. These tests are however, not related to liberty interests. The US Supreme Court in Griswold v. Connecticut found liberty interests that were violated by state laws that interfered with the use of contraceptives. Had that law been judged on the basis of arbitrariness and disproportionality, the outcome in the case may have been different.

State power has therefore been arguably expanded by limiting the grounds of challenge to arbitrariness and proportionality. It is therefore debatable whether we are better off than earlier, having created clear limits on the right to privacy, without any clear, substantive limits on state power. Only the state seems better off.

Personal Data Protection Bill: Leviathan On Steroids and the End Of Privacy

A logical consequence of treating privacy as an end in itself is the Personal Data Protection Bill proposed by the Justice Srikrishna Committee. Because the Bill treats data protection as an end in itself, it focuses only on the protection of data rather than the protection of interests that would be harmed by the unscrupulous use of data. The Bill casts a wide net, and in the process proposes the creation of arguably the most powerful and draconian state regulator India may ever see.

First, the lack of clarity of underlying values - the purview of the Bill extends to all data (in electronic form or otherwise). "Processing" of data is defined to include "collection" of data as well. So, the kirana store down the street that provides credit to customers for buying groceries on the basis of their previous repayments, a record of which it maintains in physical registers, would be subject to state supervision for its data management practices. The Bill mercifully provides some small exemptions for such "small entities" in Section 48 for manual processing, but they still have to comply with other data protection requirements.

Further, any discussion on specific privacy interests should have to deal with multiple conflicting interests - if individual privacy is important for the sake of, say, protecting individuals from online sexual harassment, a data protection law would have to deal with the tension between the right to access and participate on the internet freely and visibly, with the genuine potential for online abuse and harm. The provisions enabling data processing after consent would have to be tailored for this specific issue. Similarly, in its broad application of data protection requirements to the entire economy, the Bill fails to balance the tension between the conflicting interests of economic growth and data protection.

An example of the possible problems that may arise due to the lack of clarity on the ends of the Bill are the requirements regarding discrimination. The Bill states that "any discriminatory treatment" is a harm, and creates penalties and offences for causing such harm. But, devoid of any grounding of what forms of discrimination are permissible, this becomes an impossible standard to adhere to. Legitimate forms of discrimination such as preferring to lend money to people who pay back on time, over those who do not are essential to society. However, if a prospective borrower is refused a loan based on his or her credit history, this could constitute "harm" under the Bill.

Similarly, if an online matrimonial site shows its user only high net-worth suitors from Bihar based on an analysis of the user's past preferences, such discrimination would be beneficial for the user, but would be construed as discriminatory, unless there is clarity on what the provisions regarding discrimination seek to protect us from. But, since there is no real clarity on such ends, the supposedly safe route the Bill takes is to create a regulator with vague powers and ask it to protect data.

Parts of the Bill have been taken from the EU's General Data Protection Regulation (GDPR). The GDPR however sits on a bedrock of privacy jurisprudence (example) in the EU that goes back decades. We have borrowed the legislation without borrowing the privacy jurisprudence and the overall institutional ecosystem within which the GDPR operates. When the Bill is enacted, it will be interpreted and implemented without the underlying benefit of this jurisprudence. There will therefore be substantially less guidance for the proposed Data Protection Authority (DPA), and fewer checks on how it will interpret its powers.

Second, the claim that the DPA proposed by the Bill is a Leviathan on steroids is not a light one. One look at the definitions of "data" and "processing" confirms the wide scope of the law. In Section 60, the first function of the DPA is an ambiguous "monitoring and enforcing application of the provisions of this Act". In Indian state parlance this translates to: Use state coercion to solve every real or imagined problem provided you have the resources to do so. Even if the DPA were to construe such language strictly, it would have to intrude into almost all systems of data collection, storage and processing within the country to perform this function effectively. In the name of protecting data, it would necessarily have to supervise all data.

If for example, the DPA is to monitor compliance with the codes of conduct it is required to write for data processing, it will have to monitor the way in which data processors implement such codes with respect to their consumers. This will have to be done an economy-wide scale. One may argue that this can be done through less intrusive methods, but that is missing the point. The substantive power is there, and the powerful choice of how to regulate remains with the state. We shall remain at the mercy of liberal men, not liberal laws.

This broad jurisdiction is almost unprecedented for India. This is a huge departure from sector-specific jurisdictions carved out for other state agencies. The Reserve Bank of India can only collect data about banking and some other financial firms. SEBI can only do so with respect to the securities market. TRAI can only collect information about those in the telecommunications industry. The DPA is a regulator of data across sectors and jurisdictions. It will have the power to impose significant compliance costs and penalties on all individuals and enterprises that may collect data, even for purely incidental purposes.

Third, failure to abide by data protection requirements could land persons in jail. The offences under the Bill are proposed to be non-bailable. When combined with vaguely drafted provisions, this would have significant negative effects on society if the law is effectively applied. The Srikrishna committee report does not explain why such draconian punishments are required for the protection of data. Even serious crimes like murder are bailable. The report does not show any evidence to prove that misuse of data is a crime worse than murder.

The net consequence of the Bill, if enacted, would be this - the enactment of arguably the most powerful and intrusive regulatory agency in India, the enactment of draconian offences with great potential for misuse, and a punch in the face of private enterprise. Command and control is back, this time the driving force being the ideology of statism.

Conclusion: Privacy through the state, not from it

The ongoing discourse on privacy, Aadhaar and data protection leaves us with the inescapable role of the state as a mediating entity. In the Aadhaar discourse, the uses of identification will continue to be decided by the state without any clear agreement on what such uses should be. The right to privacy elucidated by the Supreme Court will have to evolve on a case-by-case basis as more state action relevant to privacy emerges. The Personal Data Protection Bill empowers the state to protect our data with broad and vaguely defined powers.

The fight for privacy as a means to protect individual liberty has, in the forms it takes today, led us to a point where state power on the whole, has been arguably strengthened vis-a-vis society. Contradictory to its stated aims, the current outcomes of the privacy debate are predicated on state coercion as a tool for protecting liberty.

It is a grave error to presume that the state will act benignly to uphold liberal values of privacy and autonomy. One reason is that these privacy values have not been sufficiently articulated - the discourse is almost entirely around means and not the specific interests the right to privacy seeks to protect. This can only be done by discussing privacy in specific contexts - if land records are to be made publicly accessible for increased efficiency in land markets, what is a reasonable expectation of privacy in such a context? Or, if the state wishes to build a sex offenders registry, how do privacy interests militate against such a system? As stated earlier, problems of identification systems are downstream of these issues. By not questioning the ends of identification systems like Aadhaar, its detractors are attempting to have their cake and eat it too. Even if Aadhaar is struck down, it is doubtful if privacy interests will be served in the long run.

Second, a liberal state cannot be built in isolation from the larger state apparatus. A state that habitually violates the rule of law and relies on draconian laws cannot be trusted implicitly to uphold liberal values just because the law empowering it is for a seemingly benign purpose. The Right to Education Act, a seemingly benign law, provides everyone the right to free and compulsory education, but does so by seriously constraining the right of private educational providers to actually provide education. This is routine for the Indian state - the pursuit of seemingly liberal objectives through coercive mechanisms. A state that routinely treats dissenters as traitors, evicts helpless landowners, and uses torture as an investigative tool, cannot reasonably be expected to act liberally in the interest of liberal values, especially if it is given draconian powers with vague objectives. It is reasonable to presume that the data protection law will suffer from the same illiberalism that we see in the Indian state.

A lot has been said of the misuse of data by private firms. A reasonably responsive state acts as a bulwark against such misuse. There is no bulwark against the state. If it is determined to take a certain course of action, whether it is the imposition of an emergency or the demonetisation of currency, no system of checks and balances is sufficient. Additionally, in the case of the data protection Bill, there has been no evidence shown by its proponents that the scale of the proposed data protection requirements is in any way commensurate to the dangers posed by private data companies.

Perhaps the greatest threat to individual liberty, autonomy and dignity comes from the fact that state action crowds out non-state action. State regulation operates to the exclusion of self-regulation. If, for example, the State determines the prices of essential commodities, private persons cannot negotiate and agree on the prices of such commodities. Though it has its problems, civic-associational regulation is often capable of much greater nuance and compromise than state regulation. State regulation in contrast, operates largely within binaries - permission versus prohibition, legality versus illegality, all enforced with coercive power behind it.

Those arguing in favour of privacy must avoid resorting to similar binaries. The present discourse rests on absolute moral claims about privacy, where political arguments should be made. Escalating political arguments to moral ones hastens the end of democracy. Since the moral claims of one side are considered odious and abhorrent by the other, no middle ground can be reached because collaboration with the opposition is treasonous in a moral fight. This spells greater danger for the survival of democracy; the only beneficiary is the increasingly-powerful State, and the stakes for capturing power become higher and higher. The impulse to turn to state-centred solutions has to be checked if individual privacy and dignity are to be preserved.


The author works with the National Institute of Public Finance and Policy, and is extremely grateful to Suyash Rai and Vasudha Reddy for discussions and inputs.

Friday, August 17, 2018


Positions in Tech Policy at NASSCOM, Noida

NASSCOM is growing its public policy team and has opening for Associates/ Sr. Associates/ Managers/ Senior Managers.

NASSCOM is the apex body for the 154 billion dollar IT BPM industry in India, an industry that had made a phenomenal contribution to India's GDP, exports, employment, infrastructure and global visibility.

Candidates would work on cutting edge technology policy involving issues of competition, privacy, data protection, cross border taxation, net neutrality, ethics and regulatory governance. They would focus on policy developments and challenges in E-commerce, Fintech, Start-ups, Cloud, IOT, AI and Blockchain.


Background in technology is essential; knowledge of public economics and law is desirable. Candidates who have published research papers, blogs and opinion articles in technology areas are preferred. Candidates with experience of working with (a) member of Parliament on policy formulation, (b) law firms on drafting policy inputs (c) reputed policy think tanks, and (d) leading business publications are preferred. Ph.D. applicants, including Ph.D. candidates, candidates with Masters in Public Policy or LLB are preferred.

For Managers and Senior Managers, five years of relevant experience in one or more areas is required. For Associates and Sr. Associates, minimum one year relevant experience is essential.


Compensation would be competitive.

How to Apply

Interested candidates may mail their resume to with a brief cover note explaining their suitability for the role.

Tuesday, August 14, 2018

An annotated reading list on the Indian bankruptcy reform, 2018

by Rajeswari Sengupta and Anjali Sharma.

The Insolvency and Bankruptcy Code, 2016 (IBC) was enacted two years back and its provisions for corporate persons have been operational for over eighteen months now. In this post we put together a compilation of writings on the Indian bankruptcy reform surrounding the IBC. We have categorised the articles and papers in themes that broadly reflect the evolution of the IBC reform process from its inception to its current status.

  • Problems in the pre-IBC framework.
  • The outcomes of a weak recovery and resolution framework
  • The IBC design and institutional framework
  • From design to law, and expectations from the new law
  • Unfolding of IBC implementation
  • The way forward on the reform agenda

Problems in pre-IBC framework

Corporate Rescue in India: The Influence of the Courts by Kristin van Zweiten, July 1, 2014. The corporate rescue framework under the Sick Industrial Companies Act (SICA, 1985) was slow and costly. Its provisions were interpreted and reinterpreted by judges in attempts to rescue companies destined for liquidation, mainly to protect the interests of workmen and employees.
The evolution of the corporate bankruptcy law in India by Nimrit Kang and Nitin Nayar, 2004. Prior to IBC, there was no single, comprehensive and integrated law on corporate bankruptcy in India. Liquidation and reorganisation were costly in terms of time and resources, did not encourage optimal valuation outcomes, and created incentives in favour of private benefits at the cost of firm value.
Evolution of the insolvency framework for non-financial firms in India by Rajeswari Sengupta, Anjali Sharma and Susan Thomas, June 22, 2016. The origin of the complex and fragmented framework for resolution and recovery can be traced back to its evolution. Over the years, policy adopted a piecemeal approach to reform, solving only a part of the complex problem, one at a time. This led to inefficient outcomes on the overall objective.
Inconsistencies and forum shopping in the Indian bankruptcy process by Aparna Ravi, November 12, 2015. Also see here. Fragmentation of laws and adjudication fora was a key factor resulting in delays and poor bankruptcy outcomes. A new unified bankruptcy code is an opportunity to reverse this trend by providing a linear and time bound mechanism for collective insolvency resolution.
Concerns about RBI's 'Strategic Debt Restructuring Scheme' by Ajay Shah, June 26, 2015. Restructuring mechanisms initiated by the Reserve Bank of India lacked legal foundation and sound economic thinking.
The Scheme of Arrangement as a Debt Restructuring Tool in India: Problems and Prospects by Umakanth Varottil, March, 2017. Scheme of Arrangements under the Companies Act is used sparingly for debt restructuring in India. The mere presence of a legal provision does not lead to its utilisation. The context and the associated institutions play a role in determining how such legal provisions are used.

The outcomes of a weak recovery and resolution framework

NPAs processed by asset reconstruction companies -- where did we go wrong? by Ajay Shah, Anjali Sharma, Susan Thomas, August 23, 2014. Asset Reconstruction Companies (ARCs) were not functioning well, despite their mandate under the secured credit law. Their ability to realise value was limited by an inefficient legal framework for bankruptcy. ARCs become a tool for delaying recognition of stress in bank balance sheets.
Methods for measurement of delays in the bankruptcy process by Dhananjay Ghei and Shubho Roy, November 25, 2016. Delays in the bankruptcy process destroy commercial value. Empirical research work in this field is now being conducted using state of the art techniques.
Building a better credit market by Bhargavi Zaveri and Radhika Pandey, March 12, 2016 India lacks a deep and well functioning credit market. Secured loans given by banks dominate the credit landscape. A comprehensive bankruptcy law is an important institutional reform required to fix this problem.
Are Indian banks systematically mispricing risk? by Harsh Vardhan, January 2, 2015. There is a systematic mis-pricing of corporate credit by banks. This impacts effective allocation of capital in the economy and could be a potential reason behind the recurring non-performing assets (NPA) crisis in Indian banking.
Balance sheet problems of the firms and the banks by Ajay Shah, July 25, 2015. Also see here. The credit boom of 2003-2008 was followed by a period of economic slowdown in the aftermath of the great financial crisis. Banks and their corporate borrowers faced significant balance sheet difficulties. This twin balance sheet crisis was aggravated by undercapitalisation of public sector banks, deficiencies in banking supervision and regulation, and the lack of a working bankruptcy regime.
Selective default on corporate bonds by Ajay Shah and Bhargavi Zaveri, October 25, 2015. Fragmented creditor rights enabled firms to selectively default on the claims of creditors that had weak legal protection.

The IBC design and institutional framework

Dealing With Failure by Susan Thomas, November 13, 2015. The design of the IBC can have a likely impact on the state of credit market development and entrepreneurship in India.
Firm insolvency process: Lessons from a cross-country comparison by Anjali Sharma and Rajeswari Sengupta, December 22, 2015. A review of the UK and Singapore corporate insolvency rameworks offered valuable lessons for reform of the Indian orporate insolvency resolution regime.
Personal insolvency: Lessons from the UK and Australia by Renuka Sane, December 28, 2015. A review of the UK and Australian personal insolvency frameworks offered valuable lessons for reform of the Indian ersonal insolvency resolution regime.
Setting up the ecosystem for personal credit by Renuka Sane, November 21, 2015. Also see here. A well functioning market for personal credit requires the presence of a machinery that deals with default. The draft IBC provisions on personal credit sought to address this objective.
A better bankruptcy regulator by Pratik Datta and Rajeswari Sengupta, January 9, 2016. Also see here. IBC proposed setting up a bankruptcy regulator, the Insolvency and Bankruptcy Board of India (IBBI), who will function like a mini-state in regulating insolvency professionals (IPs), IP agencies, information utilities (IUs) and the resolution procedures.
How to make courts work? by Pratik Datta and Ajay Shah, February 22, 2015. Well functioning courts are an essential ingredient of the bankruptcy reform process. This requires a complete overhaul of the underlying judicial infrastructure and procedures and ground-up reforms.
Understanding judicial delays in India by Prasanth Regy, Shubho Roy and Renuka Sane, May 18, 2016. A better understanding of the causes of judicial delays is required in order to build judicial capacity and design better functioning courts.
Building the institution of Insolvency Practitioners in India by Anirudh Burman, December 25, 2015. Also see here and here. A new cadre of regulated insolvency professionals play a critical role in IBC proceedings. A model of 'regulated self regulation' would enable the development of a market for these professionals, while ensuring that they are effectively regulated.
Ensuring information access during financial distress by Anjali Sharma, Shivangi Tyagi and Shreya Garg, December 17, 2015. Also see here and here. Access to indisputable information about the claims on the debtor reduces information asymmetry. The IBC proposed a competitive industry of entities called Information Utilities IUs) to maintain credit records for access during IBC proceedings.
Land market reform is an important enabler of bankruptcy reform by K.P. Krishnan, Venkatesh Panchapagesan and Madalasa Venkataraman, January 31, 2016. Collateral plays an important role in the credit usiness. Land and real estate constitute a large part of this collateral in India. Improved working of the land market is therefore crucial for effective functioning of IBC.

From design to law, and expectations from the new law

BLRC hands over the draft Insolvency and Bankruptcy Bill November 4, 2015. The Ministry of Finance published the report of the Bankruptcy Law Reforms Committee (BLRC) and the draft law for public consultation.
Insolvency and Bankruptcy Bill was tabled in Parliament today December 21, 2015. The legislative process for the IBC started.
Indian bankruptcy reforms: Where we are and where we go next by Ajay Shah and Susan Thomas, May 18, 2016. When IBC was finally enacted on May 28, 2016, there were many open questions about the state of Indian bankruptcy reforms.
Bankruptcy reforms: It's not the ranking that matters by Rajeswari Sengupta, November 13, 2015. The expectation that IBC would improve India's rank in the World Bank's Ease of Doing Business Report seemed to be a key driver of the pace of reform.
How will IBC 2016 deal with existing bank NPAs? by Rajeswari Sengupta and Anjali Sharma, December 5, 2016. Also see here. By the time of its implementation in December 2016, policy discourse was positioning the IBC as a mechanism to solve the bank NPA problem. The actual scenario was much more complex than this.

Unfolding of IBC implementation

An unsettling precedent under the IBC By Gausia Shaikh and Bhargavi Zaveri, Augist 8, 2017. An early Supreme Court judgment was not aligned with the design principles of the IBC.
Understanding the recent Banking Regulation (Amendment) Ordinance, 2017 by Pratik Datta and Rajeswari Sengupta, May 8, 2017. Also see here. In May, 2017, government amended the Banking Regulation Act, enabling RBI to direct banks to refer cases to IBC.
Essar Steel v. RBI: What lies ahead? by Pratik Datta, July 6, 2017. RBI identified 12 cases for IBC referral. One of the 12 companies, Essar Steel challenged the constitutionality of RBI's actions. Supreme Court upheld constitutionality while expressing concern over the RBI process.
Jaypee: consumer angle in IBC play by Aparna Ravi and Anjali Sharma, September 18, 2017. Also see here. IBC categorised creditors into financial and operational creditors. The question about classification of home buyers as creditors came up in the Jaypee Infratech case.
Concerns about the Indian bankruptcy reform by Ajay Shah, March 25, 2018. The Binani Cements case raised concerns about the actions of resolution applicants affecting the timeliness of the resolution process under IBC.
Don't rush to ban promoters from the IBC process by Adam Feibelman and Renuka Sane, November 17, 2017. Also see here. As the cases moved along, one major concern in public discourse was about permitting the promoters to re-gain control of their insolvent firms.
Understanding the recent IBC (Amendment) Ordinance, 2017 by Rajeswari Sengupta and Anjali Sharma, December 7, 2017. The government amended the IBC in December, 2017 to introduce disqualifications for promoters and their related parties.
Sequencing issues in building jurisprudence: the problems of large bankruptcy cases by Ajay Shah, July 7, 2018. Also see here. State capacity building requires sequencing, where the ecosystem learns to deal with simple things before taking on the complex problems. The Banking Regulation Amendment Ordinance of 2017, reversed this trend, bringing the 12 largest cases to a nascent law. This may have an impact on the sustainability of the IBC reform process.
Judicial Procedures will make or break the Insolvency and Bankruptcy Code by Pratik Datta and Prasanth Regy, January 24, 2017. Also see here and here. Judicial procedure and judicial interpretation of IBC provisions in respect of specific cases has altered the design elements of the law.
A Limiting Principle for the NCLT's New Powers Under the IBC by Adam Feibelman, by August 1, 2018.
The IBC Amendment Act, 2018 gives the NCLT the power to reject a plan approved by creditors in the IBC process. This raises concerns about judicial interventions in commercial decisions.
The proper purpose of insolvency law by Pratik Datta and Rajeswari Sengupta, May 6, 2018. The use of IBC to fulfill non-bankruptcy policy objectives may impact the effectiveness of the law in fulfilling its primary objective of timely resolution based on commercial decision making.
Watching India's insolvency reforms: a new dataset of insolvency cases by Sreyan Chatterjee, Gausia Shaikh and Bhargavi Zaveri, August 30, 2017. Also see here and here. There is a need to capture data to enable empirical analysis of the working of the IBC. The Finance research Group at IGIDR has put together a dataset of NCLT orders which helps understand the admission procedure and outcomes.
The Indian bankruptcy reform: The state of the art, 2017 by Ajay Shah and Susan Thomas, July 13, 2017. One year from the enactment of the law, several of the old questions remained unanswered and new areas of concern also cropped up. The need of the hour is the intellectual capacity to identify the problems, and come up with solutions so as to move closer to the ultimate desired outcome of IBC-high recovery rates.

The way forward on the reform agenda

Building institutional capacity

Does the NCLT Have Enough Judges? by Devendra Damle and Prasanth Regy, April 6, 2017. Adjudication capacity needs to keep pace with the growing case-load in order to meet the prescribed timelines in IBC.
Issues with the regulation of Information Utilities by Sumant Prashant, Prasanth Regy, Renuka Sane, Anjali Sharma, and Shivangi Tyagi, July 12, 2017. Also see here. IU regulations need review to ensure that a competitive industry of IUs come up. So far this is a missing piece in the institutional infrastructure.
Building State capacity for regulation in India by Shubho Roy, Ajay Shah, B. N. Srikrishna, Somasekhar Sundaresan, July 17, 2018.
This paper provides a conceptual framework for building state capacity in regulation in India which is a key institutional element in the IBC reform process.

Cohesive action on the reform agenda

Disclosure of default: The present SEBI disclosure regulation is adequate by Ajay Shah and Bhargavi Zaveri, January 11, 2018. Also see here. Disclosure of default enables early identification of stress, and prevents value destruction. The disclosure principles applicable to listed firms need to be enforced effectively to facilitate disclosure of defaults by listed companies, and of stressed assets by listed creditors.
RBI's proposal for a Public Credit Registry by Prasanth Regy, August 2, 2017. IUs, envisaged as credit information infrastructure institutions under the IBC, initially received RBI support. The RBI subsequently proposed setting up a public credit registry, which is on a parallel track to the IU concept of IBC.
Analysis of the recent proposed SARFAESI amendments: are these consistent with the Insolvency and Bankruptcy Code? by Rajeswari Sengupta and Richa Roy, May 29, 2016. The design of the newly implemented debt recovery law, which came after IBC, continues to be at variance with the IBC principle of a comprehensive law accessible to all creditors.

The missing pieces

Anticipating India's New Personal Insolvency and Bankruptcy Regime by Adam Feibelman, January 11, 2018. Also see here and here. The individual insolvency provisions of IBC are yet to be notified. The implementation of these provisions, will require significant preparation from stakeholders in terms of the design and capacity of institutional elements.
Cross Border Insolvency and the Indian Bankruptcy Code by Aparna Ravi, May 14, 2016. A framework for cross border insolvency based on the principles on international cooperation needs to be put in place.
Movement on the law for Resolution Corporation by Suyash Rai, June 19, 2017. A resolution framework for financial firms is the logical next step to the IBC, towards addressing the twin balance sheet problem.


Rajeswari Sengupta and Anjali Sharma are researchers at Indira Gandhi Institute of Development Research, Mumbai. The authors would like to thank the original authors of all the articles in this compilation.

This annotated reading list is open to collaborative development. If you have an article or paper that you think will enrich this list, please place it as a comment to this article and we will review it for inclusion.

Monday, August 06, 2018

Diagnosing and overcoming sustained food price volatility: Enabling a National Market for Food

by Anirudh Burman, Ila Patnaik, Shubho Roy, Ajay Shah.

We have a new paper, Diagnosing and overcoming sustained food price volatility: Enabling a National Market for Food, on the difficulties of Indian agriculture, and an implementation strategy for achieving a national market for food.

The problems of Indian agriculture

High food price volatility is a persistent difficulty of Indian agriculture. Policy responses have ranged from restricting or liberalising exports or imports, increasing or decreasing procurement and procurement prices. We conjecture there may be an element of Samuleson's Cobweb model at work, where high output leads to a crash in prices, that causes producers to reduce output, leading to a spike in prices.

The food market today is characterised by many small-to-medium producers, cartelisation, complicated administrative and legal structures that pre-date the economic reforms of 1991, and monopoly of, and intervention by, the State. The restrictions in the Indian agricultural economy hinder an efficient transmission of price signals from consumers to producers. Hence, the system teeters between boom and bust.

Restrictive policies and administrative bottlenecks have given a low elasticity of supply. Very high changes in prices are required to clear small gaps between supply and demand. With respect to most other goods and services, India has graduated into a normal market system, with the progressive removal of administrative and fiscal barriers to their trade within India. This allows for a normal transmission of information regarding demand and supply. This has not happened in agriculture.

The four missing elements

The solution strategy lies in four foundations of agricultural markets:

With well functioning storage, food could be transmitted from one time point to another, thus reducing the peaks and troughs of prices.
Futures markets
Well functioning futures markets can give guidance to private persons on decisions about sowing and storage.
International trade
The world market can act as a buffer stock: when there is a glut in India, food would be exported, and vice versa.
National market
A national market is required to achieve smoothing between the large number of micro-markets within the country. Food would move from areas with high output to areas with low output.

Our paper focuses on the implementation strategy for the fourth element, the national market.

Building a national market

Unlike other commodities, agricultural products cannot be transferred freely throughout the country without being subject to state-specific restrictions. Markets in agricultural food products are governed by legal requirements or restrictions which were put in place with the intention of creating markets (such as APMCs) but have had the effect of keeping markets non-competitive, segregated and localised. For most other commodities, there are no restrictions on who can purchase or sell goods. Usually, a simple registration under the shops and establishment laws allows for trade in all consumer goods. The present provisions and rules of any APMC laws enact and enforce similar rules for agricultural products.

In recent years, state governments have made gradual progress towards removing some of these barriers. A number of states including Meghalaya, Uttarakhand, Haryana, Assam and Andhra Pradesh, recently issued notifications delisting fruits and vegetables from their respective APMC laws. Bihar, Kerala, Daman and Diu, Lakshwadeep, Andaman and Nicobar islands, Manipur and Dadra and Nagar Haveli have no APMC Acts. Bihar repealed its APMC Act in 2006 and privatised its agricultural marketing infrastructure.

These reforms are, however, incremental and do nothing to remove the legally mandated monopsonies in the food market. These reforms are narrowly targeted at removing food products out of the ambit of APMCs rather than enabling a competitive national market.

While most scholars agree that a national market in food is essential, it is generally felt that this will require an agreement between all or most state governments. This is considered a difficult challenge, as the GST negotiation shows.

Our analysis shows that the process of creating competitive local markets in food markets can be done by the Union Government using its powers under the Constitution of India. By doing so, the Union Government can create the legal infrastructure for an integrated national market for food. This would override the existing framework currently in place for most states. This policy strategy requires no coordination with state governments.

Legal analysis

Article 301 of the Constitution states that trade and commerce throughout India shall be free, while being subject to reasonable restrictions imposed in the public interest. At present, the following restrictions exist in the food market:

  1. Legal restrictions placed by states: APMC laws, storage limits, and other legal requirements that promote oligopsonies with cartels of buyers.
  2. Technical barriers to trade: checks placed on APMC borders, checks placed on state borders, etc.

Achieving a national market requires removing these constraints.

Article 301 of the Constitution of India, along with entries in the Seventh Schedule of the Constitution grant the Union Government the power to do both: (a) Regulate all inter-state trade and commerce, and (b) regulate intra-state trade and commerce in, and the production, supply and distribution of "foodstuffs including edible oilseeds and oils." (List I Entry 42, List II Entries 26 and 27, and List III Entry 33) The Central Government can use these powers to create an integrated national market by removing limits and restrictions placed by APMC laws, and by creating institutional mechanisms to continuously identify and review administrative barriers to trade in the food market.

The creation of a national market in agriculture is thus something which is feasible for the Union government without requiring a complex negotiation with state governments.

The authors are researchers at NIPFP, Delhi.

Placing surveillance reforms in the data protection debate

by Rishab Bailey, Vrinda Bhandari, Smriti Parsheera and Faiza Rahman.


On July 27, 2018, the Committee of Experts constituted by the Government under the chairpersonship of (Retd.) Justice B.N. Srikrishna (Srikrishna Committee) released its report and the Personal Data Protection Bill, 2018. The Committee's recommendations make some headway in proposing legal reforms governing the use of personal data by intelligence and law enforcement agencies (LEAs), but fall short of offering a comprehensive solution (Bhandari, 2018).

Against this backdrop, our working paper on "Use of personal data by intelligence and law enforcement agencies" provides an overview of the existing framework on surveillance in India followed by an inquiry into how these laws and practices fare against the tests that were endorsed by the judges in Puttaswamy, the Supreme Court's right to privacy verdict. As we have previously noted on this blog, India currently does not have a comprehensive law regulating intelligence agencies/ LEAs, including on aspects such as the creation, composition, powers, functions and accountability of such bodies. What we have instead are separate provisions contained in the Telegraph Act, the Information Technology Act (IT Act), and the Criminal Procedure Code that enable government agencies to initiate lawful search and interception activities, based on the fulfilment of certain parameters. While assessing these laws and practices against the tests of legality, legitimate aim, proportionality and procedural safeguards identified in the Puttaswamy decision, we find the existing framework to be lacking in many respects.

The inadequacies of our current system become all the more evident when examined against the laws and practices of other jurisdictions that have worked harder to strike a balance between the civil liberties of individuals and the State's requirement to pursue legitimate surveillance activities. The general practice across jurisdictions is that privacy and data protection laws are also applicable to state intelligence and security agencies, albeit subject to certain exceptions (ICDPPC Census, 2017). It is important to keep in mind however, that exceptions are not all-encompassing or generic, and are usually to be applied in a proportionate manner.

In this post we highlight what can be regarded as legitimate and fair surveillance practices that are appropriate for the functioning of a democratic system. Based on a review of the current framework against the Puttaswamy tests and identified fair practices, we offer some recommendations on the next steps towards implementing holistic surveillance reforms in India. We also map these recommendations against the recommendations in the Srikrishna Committee report and the provisions of the draft law, and delineate how the draft law needs to be strengthened.

Principles of fair surveillance: International experience

International frameworks on surveillance have seen considerable development over the last decade. This has been due to changing technology and law enforcement needs, as well as instances such as the Snowden revelations that have led to greater global awareness about the need to adapt surveillance laws and practices to the modern communication era. Attempts have been made, at both the global and national level, to enhance the respect for privacy rights, through changes to statutes as well as through advocacy instruments such as the Necessary and Proportionate principles. Nevertheless, as observed by the UN Special Rapporteur on the right to privacy, no single surveillance related legislation perfectly complies with, and respects privacy rights (Joseph Cannataci, 2018).

The most commonly seen mechanisms used to ensure that LEAs/intelligence agencies act within their remit and with due respect to privacy rights include:

  1. Judicial oversight: As a general rule, countries such as the United States (US), the United Kingdom (UK), New Zealand, Australia, Germany and Canada require prior judicial authorisation for initiating surveillance activities. Often greater protections are put in place for the protection of rights of citizens as compared to foreign subjects, although both cases may require a certain level of judicial scrutiny. For instance, in the US designated courts under the Foreign Intelligence Surveillance Act have been created to authorise foreign surveillance activities. While this ensures a certain degree of oversight it should be kept in mind that these proceedings have been criticised for the lack of transparency and accountability.
  2. Oversight by legislature and independant bodies: Institutions such as Parliaments and Congress generally have extremely wide powers of supervision over the activities of LEAs/intelligence agencies, often through specific committees of panels charged with oversight. For instance, the US Congress has general powers of review over intelligence agencies. In Germany, the Parliament has a panel known as the Kontrollgremiumgesetz, while the UK has established an Intelligence and Security Committee. Both these countries have also established independant regulators to oversee the activities of LEAs/ intelligence agencies - the Office of the Investigatory Powers Commissioner and the G-10 Commission, respectively. Importantly, in addition to having access to the activities of agencies (which can extend to ex-ante reporting requirements), these bodies also publish regular public reports in pursuance of their oversight role. Further, the LEAs/ intelligence agencies themselves may also be subject to reporting requirements. In addition, transparency reports are often put out by intermediaries who receive information requests from these agencies.
  3. Implementation of redress mechanisms: While some countries such as Canada, Germany, Belgium and Austria, provide notice of surveillance to the subject in certain cases (thereby allowing processes to be challenged by the concerned individual), others create mechanisms to enable challenges to illegal surveillance through other means. For instance, the US, empowers electronic communications service providers to file petitions before the FISA Court to set aside directives issued by intelligence agencies under the FISA Act. In Europe however citizens may approach redress forums without concrete evidence of having been the subject of surveillance measures. (Klass v Germany, (1979-80) 2 EHRR 214).
  4. Implementation of organisational safeguards: The US, Germany and the UK have also implemented various administrative and technical safeguards to ensure adherence to privacy norms - ranging from embedding privacy/ethics officers within agencies, to implementing masking and other technical measures to ensure intrusions into privacy are minimised.

Key design principles for India

On mapping the legal framework and practices on surveillance in India against the Puttaswamy tests and globally recognised surveillance principles, we find our current framework to be lacking in many respects. The present set up is not well suited to meet the requirements of a system that guarantees the constitutional right to privacy or, for that matter, one that has limited state capacity in carrying out effective surveillance activities. We therefore need a system that is designed in a manner where the resources of the surveillance machinery can be optimally utilised without undue infringements into the right to privacy. Addressing these issues requires both a reassessment of the current legal framework as well as a re-evaluation of the philosophy that drives surveillance related activities by intelligence agencies and LEAs in India.

A risk-based approach to surveillance

The broad path towards safeguarding civil liberties in a system with limited state capacity lies in adopting a risk-based approach to surveillance. Countries such as the US and the UK have already moved in this direction by embedding certain risk management techniques within their surveillance architecture (Omand, 2010). This approach recognises that any country's resources are limited and therefore the surveillance architecture should focus on credible risks, whether they be reputational or operational. Apart from calibrating responses to the risk posed by different threats, this sort of an approach also takes into account broader risks such as the risks to privacy and other civil liberties, reduction of international trust in domestic firms and the impact of intelligence operations on relationships with other countries (Clarke et al., 2013).

We recommend that the Indian surveillance framework should also adopt systematic risk management as a key design principle to balance national security and privacy on one hand and limited state capacity issues on the other. The report of the Srikrishna Committee also endorses this recommendation, although the draft Bill, notably, is silent on this aspect.

Changes to the legal framework

India needs to build a robust legal framework governing the functioning of intelligence agencies. This requires the creation of a statutory framework governing intelligence agencies and LEAs, including their constitution, composition, powers and the accountability measures expected to be followed by them. The Srikrishna Committee's report recommends that the "Central Government carefully scrutinise the question of oversight of intelligence gathering and expeditiously bring in a law to this effect". It then goes on to state that although these recommendations are not directly made a part of the data protection law proposed by the Committee, they are important for the effective implementation of data protection principles and must be urgently considered.

While a data protection law may not be an appropriate site for pursuing a comprehensive reform of intelligence agencies and LEAs, there are several critical changes that can be adopted through the data protection law as well as amendments to existing laws that impact surveillance. We set out below specific recommendations that will help to ensure that any intrusion into an individual's right to privacy by state surveillance is in consonance with the principles in the Puttaswamy case.

  1. Prior judicial review: Present Indian laws confer wide powers on the executive in terms of deciding the scope and manner of surveillance. Intelligence agencies and LEAs initiate requests for surveillance, which are then authorised by another executive agency - the Home Secretary in the Central and State Governments). Oversight of authorisation is also done by an executive agency - the Review Committee established under the Telegraph Rules. The decision in Puttaswamy held that any intrusion by the state in an individual's privacy rights is permissible only if it is supported by a "fair, just and reasonable procedure established by law". A process that is driven solely by one arm of the state mitigates from the system of checks and balances that is necessary to satisfy this criteria. We therefore recommend that the current processes need to be amended to incorporate an element of prior judicial review (or post-facto judicial scrutiny in emergency cases). This review may be conducted through specialised courts designated for this purpose or by judicial members of an independent body, such as a Data Protection Authority. The role of this body would be to apply the principles of legality, lnecessity and proportionality in each and every case to ensure that the nature of surveillance, its duration and scope is in line with the purpose that is sought to be achieved. Further, a mechanism for filing an appeal against the decision of the judicial body must be provided. The adoption of the proposed structure would require corresponding amendments to the Telegraph Act, IT Act and the rules thereunder.
  2. Reporting and transparency by LEAs: Current laws need to be amended to ensure appropriate reporting and transparency requirements are implemented pertaining to all surveillance activities. These requirements may differ depending on the nature of information and the entity to which it is being provided (for instance, to the Parliament or the public). Reporting must be on both ex-ante and post facto basis, as may be relevant to the circumstances. Further, oversight bodies must also be required to publish periodic reports of their activities and that of LEAs/ intelligence agencies under their supervision, while service providers must be permitted to publish aggregated statistics detailing volume and nature of surveillance requests.
  3. Implementation of data retention norms, principles of fair processing: Principles of fair processing must be applicable even to data processed by intelligence bodies/LEAs. They must also ensure that as far as possible, personal data is up to date and accurate, while data retention norms need to be appropriately designed to ensure only relevant data is stored by the authorised agencies.
  4. Notice to the data subject: In order to achieve a balance between the objectives of surveillance and the rights of the data subject, the law should provide for an obligation to ensure that the affected data subjects are notified after completion of the surveillance. However, the agency may seek the approval of the judicial body to delay or avoid the requirement of notice under certain exceptional circumstances, for instance if it can be established that such a disclosure would defeat the purpose of surveillance.
  5. Right to seek redress: The requirement of notice to the data subject must be accompanied by a right to challenge and seek appropriate redress against surveillance activities. This right should extend to a person who is, or has reasonable apprehension of being, the subject of surveillance. In addition, intermediaries that are required by law to facilitate access to information by LEAs should also have the legal right to question the scope and purpose of the orders received by them.
  6. Privacy officers in LEAs: Independent officials must be appointed to the intelligence agencies and LEAs to scrutinise requests for surveillance (before they are placed before the sanctioning judicial body). Such scrutiny must be recorded in writing and available to relevant oversight bodies (if not the public).
  7. Technical measures to enhance privacy: Technical measures and privacy by design principles must be used to inform surveillance procedures and ensure proportionality and due process. This may imply for instance, the use of masking techniques to protect identities of citizens caught up in bulk surveillance of foreign intelligence, ensuring collected data is encrypted, acess controls, etc.
  8. Evidentiary value of information collected in breach of data protection law: Illegality in conducting search and surveillance activities does not lead to a bar on the admissibility of that evidence in subsequent proceedings under Indian law. Consequently, the incentives of LEAs are not fully aligned with the objective of ensuring that the legal processes governing surveillance are strictly followed. This will continue to pose a challenge even if privacy safeguards are introduced in the law. We therefore recommend that relevant laws should be amended to bar the admissibility of any information that is obtained by the agencies in breach of the proposed data protection law and other surveillance related laws.
  9. Revisiting telecom licenses: Telecom licenses contain specific provisions relating to the obligations of telecom service providers (TSPs) to facilitate lawful interception activities. We recommend that to the extent that any of the provisions contained in telecom licenses create additional restrictions on the privacy rights of individuals, these provisions need to adopted through legislative instruments. Further, we recommend that the terms of telecom licences also need to be revisited in so far as they contain restrictions on the encryption standards that can be adopted by TSPs, which in turn limits the privacy rights of their users. The Telecom Regulatory Authority of India's (TRAI) recent recommendations on data protection indicate a positive move in this direction. The regulator recommended that the Department of Telecommunication needs to reexamine the encryption standards laid down in the telecom license conditions. It noted the need for personal data of telecom consumers to be encrypted, both during storage and in motion. Further, TRAI recommended that decryption by authorised entities should be permitted on a needs basis, either with the consent of the consumer or in accordance with legal requirements.
  10. Transparency regarding standard operating procedures (SOPs): We recommend that any SOPs formulated by the Government to give effect to the provisions governing surveillance must be made publicly available and stakeholders should also be given an opportunity to contribute to their framing. To the extent that the SOPs might create any independent obligations on individuals or intermediaries, we recommend that the same should be supported by a legislative instrument.
  11. Amendments to other laws: Provisions of the Whistleblowers Protection Act, 2011 need to be revisited to ensure adequate protection is given to whistleblowers who expose mala fides or illegalities in surveillance procedures. In particular, the general exemptions granted under the statute (to matters impinging on sovereignty or strategic interests of the state, disclosures under the Official Secrets Act, 1923, etc) may need to be revisited. Similarly, revisions may be required to the generic exemptions granted under the Right to Information Act, 2005, to various LEAs.

Reviewing the Srikrishna Committee's proposals

The Srikrishna Committee's draft law proposes protections relating to the collection, processing and use of personal data of individuals (referred to as data principals) and offers remedies from related harms. The draft law defines "harms" to include (i) any restriction placed or suffered directly or indirectly on speech, movement or any other action arising out of a fear of being observed or surveilled; and (ii) any observation or surveillance that is not reasonably expected by the data principal.

Sections 42 and 43 of the draft law deal with the processing of personal data in the (i) interests of the security of the state; and (ii) for prevention, detection, investigation and prosecution of any offence or any other contravention of law, respectively. In both these cases the identified activities are exempted from the requirements under the draft law if they satisfy the requirements of legality, necessity and proportionality. The exemption, however, does not include the requirement to ensure that any personal data is processed in a fair and reasonable manner (Section 4) and in accordance with reasonable security standards, including methods such as de-identification and encryption of the data and prevention of misuse and unauthorised access (Section 31).

In drafting these provision, the Committee has reiterated the position laid down by the judges in Puttaswamy, but without addressing the related structural and procedural elements required to make these principles work. For instance, the requirement of legality is incomplete without a description on what constitutes legality in case of access by intelligence agencies/ LEAs. Should it include only legality of the means of access or also require the need for a legislative basis for the agencies to whom such access is provided? Similarly, what factors should be taken into account to judge whether a proposed intervention is "necessary and proportionate" in the facts of the case? Who should be making this determination?

In the context of discussing the exemption of measures taken to ensure "security of the state", the Committee proposes that the law should provide for ex-ante access controls by designating a district judge to hear requests for processing of personal information by intelligence agencies in closed door proceedings. It also proposes that such approvals should be time-bound and require periodic renewal, subject to the judge being satisfied that the purpose for processing remains relevant. Further, the report talks about ensuring accountability through ex-post periodic reporting and review by a parliamentary committee.

The recommendations of the Committee point in the right direction, but their effectiveness is marred by the suggestion that such measures be adopted if and when the Government decides to pursue a comprehensive law governing intelligence agencies. Given that surveillance activities are already taking place, the immediate requirement would be to make amendments to the laws that enable such access to personal information by intelligence agencies and LEAs, namely the Telegraph and IT Act and the rules thereunder. The draft law proposed by the Committee already suggests some amendments to provisions contained in the IT Act and the Right to Information Act, 2005. The logical step would have been to at least incorporate similar suggestions on amendments to existing surveillance related laws to build in the safeguards suggested in its report regarding ex-ante analysis and ex-post accountability for surveillance related activities.

In terms of our other suggestions, the draft law includes an obligation of fair and reasonable processing and ensuring security of data even when such processing takes place under the given exemptions. It, however, fails to recognise other important requirements like having data protection officers inside intelligence agencies and LEAs; (deferred) notice to the concerned individual, and the right to seek appropriate redress. Further, the draft law also fails to address the issue of the evidentiary value of information collected in breach of the proposed data protection law.


The draft law proposed by the Srikrishna Committee has tremendous scope for improvement, both in terms of strengthening the protections available to individuals who are subjected to surveillance activities as well as the structural and procedural safeguards governing such access. Having said that, we also believe that the recommendations contained in the report, particularly on ex-ante and ex-post safeguards against surveillance, are an important starting point for this discussion. To take these suggestions to their logical conclusion, it is important that corresponding amendments should be made to the draft before it shapes into a bill that can be placed before the Parliament.


Committee of Experts under the Chairmanship of Justice B.N. Srikrishna, A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians, 2018.

Committee of Experts under the Chairmanship of Justice B.N. Srikrishna, Personal Data Protection Bill, 2018.

David Omand, Securing the State: A Question of Balance, Chatham House, 8 June, 2010.

International Conference of Data Protection Privacy Commissioners (ICDPPC), Counting on Commissioners: High level results of the ICDPPC Census 2017, September, 2017.

Joseph Cannataci, Working Draft Legal Instrument on Government-led Surveillance and Privacy, 2018.

Richard A. Clarke, Michael J. Morell, Geoffrey R. Stone, Cass R. Sunstein and Peter Swire, Report and Recommendations of The President's Review Group on Intelligence and Communications Technologies, Obama White House, 12 December, 2013.

TRAI, Recommendations on Privacy, Security and Ownership of the Data in the Telecom Sector, 16 July, 2018.

Vrinda Bhandari, Data Protection Bill: Missed Opportunity for Surveillance Reform, The Quint, 28 July, 2018.


Vrinda Bhandari is a practicing advocate in Delhi. Rishab Bailey, Smriti Parsheera and Faiza Rahman are researchers in the technology policy team at the National Institute of Public Finance & Policy.