Outlining the impact of data protection law

The new act provides a framework for the protection of users’ personal data and the privacy of individuals.

In August, India’s parliament passed a landmark piece of legislation, known as the Digital Personal Data Protection Act. The new act provides a framework for the protection of users’ personal data and the privacy of individuals. The passage of this bill marks the culmination of a decade-long effort to frame a data privacy law—an effort that has had many twists and turns.

The passage of the bill marks the culmination of a decade-long effort to frame a data privacy law—an effort that has had many twists and turns.

One person intimately involved in this long and winding road is lawyer and author Rahul Matthan. He talked about his personal journey and the broader impacts this law will have on last week’s episode of “Grand Tamasha,” a weekly podcast on Indian politics and policy co-produced by HT and the Carnegie Endowment for International Peace.

We are on WhatsApp now. Click to join.

On the show, Matthan recounted an early conversation with Nandan Nilekani, the father of the Aadhaar project—the very first element of India’s digital public infrastructure — about the need for a privacy law. After Aadhaar was launched, Matthan said that he told Nilekani, “This is wonderful. But you should put into place privacy regulations, because that is the flipside of what could happen as a sort of malevolent side effect of what it is you’re doing.” According to Matthan, Nilekani immediately agreed but “for all sorts of reasons, it has taken us over a decade to have a law in place.”

Matthan argued that given the way in which India has, over the last decade and a half, “digitised all aspects of its functioning in such a remarkable way, it is almost inconceivable that—having invested so heavily in population-scale systems that collect data for the benefit of people—we haven’t at the same time put in place regulations that protect the misuse of that data.”

Matthan, a partner in the Bengaluru office of the law firm Trilegal and the author of the forthcoming book, The Third Way: India’s Revolutionary Approach to Data Governance, describes the law as a framework that “protects personal data and offers individuals certain rights over their data and prescribes the manner in which people who collect, process, store, or use that data have to deal with that data.”

Asked about criticisms of the bill, including provisions which exempt the government from its ambit, Matthan admits that there are several valid concerns about the law as it stands. At the same time, however, he cautions that the messiness and compromise of policymaking mean that a perfect bill is unlikely to exist.

“As we go through the policymaking process, I think it is incumbent on us to do our very best to present the point of view that we think is the most appropriate,” he explained. “But at the same time, [we must] recognize that there are many people like us who are similarly making their case. And it is impossible…to find a path that meets the requirements of every single person that has a demand.”

In other words, said Matthan, it is time to stop looking backward. “Once the law is passed, we’ve got to now shift focus to how to work with what we have. That is the reality of where we are right now.”