Expressing grave concerns at the impact of the recently enacted law on journalistic activities, the EGI, established post-Emergency in 1978[1], The detailed representation explains how this law, ostensibly brought in to “protect data privacy” will, in fact bring journalistic activity to a standstill.

The representation points out that while the DPDPA does not address journalists or their activities, it regulates the underlying processing (e.g., collection, use, storage) of personal data that is inevitable in almost every instance of journalism.

The EGI statement states, “ The enactment of the Digital Personal Data Protection Act, 2023 inadvertently endangers the freedom of the press 1.1 The DPDPA, while a laudable initiative towards protecting the personal data of individuals, if applied indiscriminately to the processing of personal data in a journalistic context, will bring journalism in the country to a standstill. This will have a long-standing impact on the freedom of the press, and the dissemination of information not just in reporting in print, TV, and the internet, but also the mere issuance of press releases by all parties including political parties. 1.2 The continued existence of the press – the fourth pillar of democracy – enables the dissemination of news, thoughts, and opinions and ensures a free and fair democracy. It informs public opinion, promotes civic engagement, and empowers individuals to make informed decisions including political choices. Its centrality is recognised by the Constitution of India (Constitution), which only permits reasonable restrictions on the exercise of the right to freedom of speech and expression.

As the statement points out, the Srikrishna Committee Report also recognised these consequences in noting that the untrammelled dissemination of news, current affairs, and documentaries, especially when they inform, criticise, and analyse issues of public importance, is in the public interest.

Journalistic Conduct regulated by Press Council of India (PCI) norms

The protection of personal data in the course of journalistic activities is built into journalistic conduct, such as those issued by the Press Council of India (PCI), established under the Press Council Act, 1978, Code of Ethics and Broadcasting Standards released by the News Broadcasters and Digital Association. 6.2 Notably, the PCI prescribes safeguards in the context of communalism in the press and cautions against defamatory writings and objectionable investigative reporting, obscenity, and vulgarity in, for example, news stories, or feature reports.

Through this, journalists are barred from (i) intruding upon or invading the privacy of an individual unless outweighed by the genuine overriding public interest; (ii) tape-recording a conversation without that person’s knowledge or consent, except where the recording is necessary to protect the journalist in a legal action, or for other compelling good reason. Journalists are also required to (i) obtain the prior consent of a minor’s parent, if “public interest” overrides the minor’s right to privacy; (iii) to apply due care by not disclosing the real names of persons involved in incidents affecting personal lives; and (iv) refrain from publishing inaccurate, baseless, graceless, misleading or distorted material. 6.3 Given that these codes of conduct, which apply to all journalists, achieve a balance between freedom of expression and the right to privacy applying a second framework to the same processing activities, concerning the same personal data will only create duplicate compliance requirements, impose an unwarranted burden on journalists, and more importantly, impair free speech and expression. This is particularly true since these applicable codes of conduct for journalism provide a more tailored compliance regime in balancing the competing rights at hand.

Concerns over DPDP Act

The newly enacted DPDP Act requires individuals or entities that determine the purpose and means of processing such personal data outside a personal or domestic context, i.e., data fiduciaries, to meet various requirements (e.g., provision of notice and obtaining consent, erasure, etc.). These requirements are undeniably onerous in the context of processing for journalistic purposes. Given the nature of the profession and the implications for fundamental rights involved processing personal data for journalistic purposes is an ideal case and must be an exemption from the provisions of the DPDPA. The DPDPA requires all processing of personal data to proceed on the basis of either consent or certain legitimate uses (e.g., for employment purposes or in the case of a medical emergency) under Section 7 of the DPDPA, which is narrow and specific in nature. Processing personal data for journalistic activities will invariably fall outside these narrow buckets.

While certain journalistic activities involving interviews, collecting responses to questionnaires, etc., may be covered under Section 7(a) of the DPDPA, which recognises voluntary provision of personal data by the data principal, most other forms of journalism, such as investigative journalism, general news reporting, opinion pieces, analyses, etc., are still largely dependent on private research and investigative study by journalists, which is remarkably absent in the current list of legitimate uses.

Explains the representation, given this, journalists will invariably have to rely upon consent to process any personal data in the course of their journalistic activities.

In fact, the onerous nature of this requirement was critiqued in the Report published by the Committee of Experts under the Chairmanship of Justice B.N. Srikrishna (Srikrishna Committee) titled ‘A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians’ (Srikrishna Committee Report)/ The Committee, which prepared the Personal Data Protection Bill, 2018, noted that mandating consent for processing such personal data would be unfavourable, as the data principal could simply refuse to consent forestalling all such publishing. The fundamental role of the press and its ability to ensure transparency and accountability would thus be severely undermined by the data principal’s ability to simply refuse consent to the processing of their data.

As the EGI’s representation to MEITY points out, the Srikrishna Committee Report that accompanied the 2018 Bill, too, recognised that exempting journalistic activity from compliance with the 2018 Bill was necessary for greater public interest. Accordingly, the Personal Data Protection Bill, 2018 (2018 Bill), prepared by the Srikrishna Committee, exempted processing for a ‘journalistic purpose’ from complying with all provisions of the 2018 Bill, except for the duty to process personal data in a fair and reasonable manner that respects the privacy of the data principal, and the obligation to implement reasonable security safeguards.³ The 2018 Bill defined ‘journalistic purpose’ as any activity intended towards the dissemination through print, electronic, or any other media of factual reports, analysis, opinions, views, or documentaries regarding:

• news, recent or current events; or
• any other information that the data fiduciary believes the public, or any significantly discernible class of the public, to have an interest in, which would be absolved from obtaining consent from data principals.⁴

 The Personal Data Protection Bill, 2019 (introduced in the Parliament) and the Data Protection Bill, 2021 (prepared by the Joint Parliamentary Committee on data protection), contained similar provisions to exempt processing for journalistic purposes.

This position is notably consistent with other jurisdictions with data protection regimes that provide for exemptions from processing for journalistic purposes. For instance, the European Union’s General Data Protection Regulation (GDPR) enables Member States to provide for exemptions or derogations from certain provisions (e.g., have a lawful reason or basis for using data, provide privacy information, comply with individual rights that people have about their data, etc.) of the GDPR for journalistic purposes and freedom of expression.⁵ Similarly, Singapore’s Personal Data Protection Act, 2012 provides an exception for news organisations to collect, use, and disclose personal data without consent solely for its news activity to collect, use, and disclose personal data without consent solely for its news activity.

Despite this, processing for journalistic purposes is not exempt from the obligations under the DPDPA.

It may be possible to argue that Section 17(1)(c) of the DPDPA, which permits processing in the interest of prevention, detection, investigation, or prosecution of any offence or contravention of any law, would exempt processing for a specific kind of journalism: investigative journalism. However, the lack of a broad exemption that applies to all journalistic activity (as envisaged under prior iterations of this law and international statutory frameworks) and the absence of any clear guidance for this exemption severely hampers the ability of journalists to investigate, report, and publish any articles or reports of journalistic import. It is, therefore, crucial that an exemption be made available to cover processing related to journalistic purposes.

Unfortunately, India will be the sole modern democracy without an exemption for journalistic activities, which could severely impair the fourth pillar of democracy. Moreover, India is currently ranked 161 out of 180 countries in the World Press Freedom Index maintained by Reporters Without Borders below other Asian countries like Pakistan, Afghanistan, Sri Lanka, and Cambodia, and risks falling further down in the ranking if the DPDPA is enacted in its present form states the representation.

The detailed representation may be read here:

[1] Editors Guild of India [“EGI”] is an organisation established in 1978 to protect freedom of the press and to raise the standards of editorial leadership of newspapers and magazines. Since it’s establishment, EGI have consistently defended the freedom of speech and expression of publishers and the right to information of the citizens of India.

Related:

Concerned over arrest of TV journalist working for Republic Bangla: Editor’s Guild

FIR against editors, Prabhat Khabar, Editor’s Guild voices concern

Press Club of India condemns FIR against Editor’s Guild of India (EGI), criminalising journalism

The post Grave concerns on DPDP Act, 2023 as journalistic activities threatened: Editor’s Guild to MEITY appeared first on SabrangIndia.

What does the law say with respect to Data Rights?

The law recognises a Data Principal —the individual to whom the personal data relates to i.e., whose personal data is being engaged with. In cases of children and person with disability, lawful guardians on their behalf will be the Data Principals.  For example, if someone is collecting your personal Data, you are the Data Principal.

The law also recognises the Data Fiduciary —the entity which determines the purpose and means of processing such data after being entrusted with this data by the Data Principal. Essentially, those who are collecting the data for a purpose and processing it, are the Data Fiduciaries. There are certain rights for the Data Principal and additionally, there are certain duties too.

The pillars of data protection legislation in countries worldwide revolve around consent, purpose limitation and storage limitation. Consent means the permission of the person who is giving the data; purpose limitation means the restriction on the person who is collecting the data to use the data only for the purpose for which the data is being collected. Storage limitation means that a limit on storage: the data will only be stored only until it serves that particular purpose for which it was collected in the first place.

Let us understand what the new act does with respect to these principal, non-negotiable, internationally recognised pillars.

Purpose Limitation and Consent:

Section 7 of the Act deals with processing of the data by the Data Fiduciary. Section 7(a) of the Act says that the Data Fiduciary can process the personal data of the Data Principal for a purpose for which the latter has voluntarily provided the data. The rest of the uses raise the question of whether, the Data Fiduciary can process the personal data of the Data Principal for the state or any of its instrumentalities to provide to the Data Principal such subsidy, benefit, service, certificate license or permit etc., if she has previously consented or if the data has been available with the government.

This processing could also be done in the interest of Sovereignty, Integrity of India, or Security of the State, for responding to a medical emergency involving a threat to the life or immediate threat to the health of the Data Principal, for taking measures to provide medical treatment or health services to any individual during an epidemic, outbreak of disease, or any other threat to public health, for taking measures to ensure safety of or provide assistance or services to any individual during any disaster, or any breakdown of public order and finally, for the purpose of employment.

This means that for all these purposes the Data Fiduciary can process the data without the consent of the data principal.

Apart from the all-encompassing power granted under processing for the security of the state, there is also the additional purpose granted under the Act, “for public order”. Another important use for which the data can be processed is for employment purposes. Many data legislations place processing of some data of employees, such as sensitive data like gender, and Social Media Data under restrictions and regulations.

The DPDP Act, 2023, however, gives a free hand for the processing of employee-related data, without any safeguards to the employer. If an employee’s personal data is allowed to be processed by the employer, without the consent of the former, it could lead to discrimination at the workplace and the new law has no safeguards.

For example, if a woman employee has stated that she is pregnant, and processing of the data could lead to the company firing her.  There have been study after study that reveal that the companies are already apprehensive about hiring women due to the potential maternity benefits that they might have to pay to her. Employee Monitoring restrictions are completely absent in the act.

Storage Limitation- Here too, there is a generic rule that the data should not be stored if the purpose for which it was collected has been served. However, under the (Indian) Act, the Union Government can notify such Data Fiduciaries or Class of Data Fiduciaries, to whom this generic rule will not apply. The central government can do this on consideration of volume and nature of the Personal Data processed. There are no directions as to whether this volume has to be high or low for the fiduciaries to be so exempted or what kinds of nature of data will allow an exemption. Essentially, this means that it is the Union Government who can choose who can store the data and who cannot, under some vague criteria which has not been specified or mentioned under the Act.

There are two more important features of this act. One is the exemptions the Act gives the Union Government and the Act’s de facto amendment to the Right to Information Act, 2005.

Exemptions to the Government

Section 17(2) of the act gives exemption to the government with respect to the processing of the data. The act does not apply to processing of personal data by such instrumentality of the state, in the interests of “sovereignty and integrity of India,” “Security of the State,” “Friendly relations with foreign states,” “maintenance of public order” or “preventing incitement to any cognisable offence” relating to any of these, and the processing by the Central Government of any Personal Data that such instrumentality may furnish to it.

This essentially means that, the government can process the data for the purposes or such data that an instrumentality of the state furnishes to the Union Government, without the consent of the Data Principal.

Section 17(2)(b) also exempts the Central Government and enables the government the processing of such data necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a Data Principal and such processing is carried on in accordance with such standards as may be prescribed.

The Amendment to RTI Act

The Right to Information Act, 2005 empowers Central Public Information Officer or the State Public Information Officer at the appellate authority to give information relating to personal information if such information is in the larger public interest.

Essentially the RTI act says that personal information cannot be disclosed until the Information Officer is satisfied that the larger public interest justifies the disclosure of such information. The pre-amended RTI act places check on the way Information Act could be used to invade the privacy of people but also creates a balance where the larger public interest overrides the right to privacy of people.

Section 44 of the DPDP Act 2023 amends the RTI act and states that there shall be no obligation to give any citizen information which relates to personal information. The DPDP Act removes the balance that was achieved by the RTI act thereby diluting the progressive nature of the RTI act.

Conclusion

The Act only has data protection in its title (!!!) whereas the provisions of the act seem like it is an empowering act for the government to use and process and collect data without any hassle or safeguards.

In essence, the act divides data protection into two different realities one where Data Fiduciaries and Data Principals are responsible for each other and another reality where government is not responsible for anything at all.

Additionally, the Act also creates some punitive duties on Data Principals upon whose breach the Data Principal will be required to pay a fine of Ten Thousand Rupees. This creates both an unnecessary and unjustified burden on the Data Principal while making the government act with impunity. In a way, much of the Act stands as an example of how not to draft and enact a Data Protection Act.

(The author is a legal researcher with the organisation)

Related:

In Garb of Data Protection Bill, Centre Attacking RTI, Allege Information Commissioners

A surveillance regime that violates both Privacy & Right to Life: Digital Personal Data Protection Bill, 2002

Digital Personal Data Protection Bill seeks to amend RTI Act to bar disclosure of personal information

The post Serious flaws in the Digital Personal Data Protection Act appeared first on SabrangIndia.

The Digital Personal Data Protection Bill 2023 includes surveillance clauses, which means surveillance of citizens including journalists and their sources. The lightning speed with which the bill was passed this week, casts severe doubts on whether the government is seeking to widen censorship powers.

The statements say that both bodies of journalists are equally concerned at certain clauses in the Press and Registration of Periodicals Bill, 2023 which gives enforcement authorities, over and above the Registrar, which adds draconian new provisions which are aimed at censorship of news media.

Further, they point out that these Bills coming soon after amendments to the IT Rules, 2021 which enable government departments to demand that social media companies take down posts that they object to, are ominous.

Other moves to enforce secrecy and encroach on citizens ‘rights are the recent amendments to the Right to Information Act that further restrict access to information from government departments, reducing the right to information act to a farce.

The organisations also note of the fact that the rights and privileges of journalists and freedom of association had been targeted in recent years not only through dubious labour codes but the way numerous favourable court judgements on the Majithia Wage board for journalists and co-workers are being reduced to nothingness through constant appeals by select newspaper barons. It is a fact that many cases are pending or shuttling between various courts and appeals while journalists and co-workers are starving and in some cases have also died. Fast track courts are indeed needed.

The signatories to the joint statement include  S.K.Pande, President NAJ, Sujata Madhok, President DUJ, N.Kondaiah, Secretary General NAJ, G.Anjaneyulu, General Secretary APWJF and Jigeesh A.M., General Secretary DUJ also stressed their continued demand for a Media Council of India to replace the out dated  Press Council of India for the entire wide spectrum media, a suggestion  that has been backed both by the BJP and the Congress governments in the past.

Such a council should have representatives from the entire Media- as it exists today including representatives from all including unions and associations, and the growing independent media networks. It should concentrate on questions of ethical reporting, dangerous patterns of communalism, spreading of fake news and connected matters, taking in view current realities. Such a media body is all the more necessary to prevent draconian censorship moves by governments both at the centre and some states.

They endorsed the views of the Press Club of India, the IWPC and the DUJ yesterday against the continued witch hunting of the news portal Newsclick, which they opined was specializing in a wide variety of issues affecting the common people and was being targeted, just because it was critical of the government. It seems the ghost of McCarthyism is being resurrected in India, they added. 

Related:

Press and Registration of Periodicals Bill, 2023 draconian & dangerous: Editor’s Guild (EGI)

Guess where India stands on the World Press Freedom Index?

SC for freedom of expression: Strikes down ban on Media One

Replace toothless Press Council with Media Council: NAJ, DUJ

Saharanpur: Who were the ‘media men’ whose questions created tension during Friday prayers?

A fair media can defang intolerance

Jahangirpuri: Navika Kumar, Anjana Om Kashyap demolish media credibility further

Social media platforms finally compel extremist groups to shun hate speech, fake news

Khargone: Why is the administration ignoring the proliferation of hate on social media?

The post NAJ, DUJ blasts Union Govt Bill(s) on Media appeared first on SabrangIndia.

Delhi: A latest report by Research firm Fairwork India made a shocking revelation on Tuesday that major platforms like Ola, Uber, Dunzo, PharmEasy and Amazon Flex scored zero in the assessment of fair working conditions for gig workers.

The research project, which is led by the Centre for IT and Public Policy in collaboration with partners at the University of Oxford, said the said firms did not provide fair pay, fair contracts, fair management, fair representation or fair working conditions to their gig workers. It underlined how the much-hyped flexibility in platform work plays out in practice, and the workers are not the ones who benefit from it.

The report said that other than Bigbasket, Flipkart, and Urban Company, no other platform publicly committed or provided sufficient evidence to ensure workers’ earnings that commensurate with the hourly local minimum wage after work-related costs. Another key finding was that while workers have engaged in various forms of collective action to voice their concerns in the platform economy, the platforms have been unwilling to acknowledge or bargain with any such collective body of workers.

“Even with workers and worker groups repeatedly emphasising the importance of a stable income for platform workers, platforms have been reluctant to publicly commit to, and operationalise, a minimum wage policy,” the report said.

The firm studied 12 firms and granted Urban Company a score of seven out of 10, which is the highest, six to online grocer BigBasket, and five each to Flipkart and Swiggy, four to Zomato, and two to grocery delivery platform Zepto and one to Tiger Global-backed delivery firm Porter.

“This year, only Bigbasket, Flipkart and Urban Company were awarded the first point (on providing minimum wage) because of the public commitments they have made to paying workers at least the hourly local minimum wage after factoring in work-related costs,” Fairwork India said in its fourth annual report.

“Bigbasket and Urban Company have operationalised this by committing to reimburse the difference between worker’s earnings per hour and the hourly local minimum wage after costs. Flipkart and Urban Company have committed to basing their pricing structure for workers on the hourly local minimum wage after costs. Flipkart has also undertaken steps to hold its third-party service providers to the same commitment,” the report added. However, it pointed out that none of the platforms scored on the second point of fair pay, which is based on the workers earning a living wage, as opposed to the minimum wage.

Fairwork India Scores 2022

The Fairwork report came down heavy on a NITI Aayog report on the gig and platform economy. It criticised the NITI Aayog report by saying that “any claims that workers enjoy increased earning potential on platforms is neither supported by evidence, nor does the report contain an estimate of the share of platforms’ earnings paid to workers

Gig economy workers, who are making up an increasing portion of the Indian workforce, are not extended crucial employee benefits such as health insurance, financial security in case of health emergencies etc. Firms using the service of gig workers have been accused of exploiting them and limiting corporate liabilities. However, the State is yet to provide any safety against such worker exploitation.

“Even as instances of abuse and discrimination against platform workers have surfaced this year, the legal landscape of the platform economy in India remains largely unchanged. Members of Parliament have directed attention to the need for reform, yet the Code on Social Security and the Motor Vehicle Aggregator guidelines, 2020, both of which regulate the conditions of platform workers, await enforcement,” the Fairwork report said.

It further added that the Digital Personal Data Protection Bill, 2022, which is likely to have repercussions for the data collected from platform workers, has not yet been passed by the Parliament. A Public Interest Litigation (PIL) filed before the Hon‘ble Supreme Court by the Indian Federation of App-based Transport workers (IFAT) to reclassify platform workers as unorganised workers or employees, also awaits a decision.

Courtesy: Newsclick

The post Report Highlights Poor Working Conditions for Gig Workers; Uber, Ola, Amazon Score Zero appeared first on SabrangIndia.