India’s Push for Privacy

by BEN SILVIAN, ’20

In March, the Indian government’s relatively new ID database, Aadhaar, suffered a major data breach.¹ Aadhaar stores a plethora of identity and biometric data on 1.1 billion of India’s just over 1.3 billion citizens, including their fingerprints and iris scans, making this breach a major concern.² The data is accessible with a 12-digit ID number, which is assigned to each registered citizen and is essential for many daily activities: citizens must present their ID number to open a bank account,³ receive food rations,⁴ or be accepted into a hospital. It is thus no surprise that so many citizens have opted in to this technically optional program, even though these citizens will find themselves very vulnerable if someone gets a hold of their ID number. Stealing an Aadhaar number or card could grant a hacker access to all of the target’s personal information, from their bank information, to their recent train trips, to what they ate at a restaurant 5 months ago.⁵ It would effectively allow the hacker to impersonate them.

Of course, this revolutionary database serves an important purpose: to increase efficiency and reduce corruption.⁶ For example, corrupt officials often can no longer add fake names to welfare databases to steal money from the poor. Unfortunately, the March breach was Aadhaar’s second major data breach this year. The first one happened in January.⁷

Privacy has recently become a hot-button issue in India, a country which has passed very little online privacy legislation, despite its powerful centralized ID database and reputation for technological prowess. Within the last year, India has been trying to catch up with the international surge of stronger privacy laws.

The Global Drive for Privacy

The most significant global privacy development in the last year was the EU’s new General Data Protection Regulation (GDPR), which requires companies to eliminate fine-print loopholes, and instead provide privacy policies with clear, concise explanations of what users are signing up for.⁸ Furthermore, consumers now have the right to access data that companies store about them and correct that information if it’s inaccurate.

Most importantly, these laws apply to any corporation with users in the EU. Even if the corporation is based in the US or India, as long as it has clients in the EU, it will face a severe fine it if does not comply with these regulations. Publishers, banks, and tech giants have already started working to adapt their policies to meet the expectations of GDPR.

China also recently released a new data privacy law, partially modelled on the GDPR, which will shift power from companies to consumers. One Chinese businessman summed up the gist of the law well, reportedly asking “wait, do we now need to get consent from all of our users on our privacy policies?”⁹ Now, despite China’s extensive censorship, Chinese citizens’ data is likely better protected from corporate loopholes than that of Americans.

A number of other South and Southeast Asian countries have also been working toward improved data protection and regulation. A new Vietnamese law requires foreign internet companies like Google and Facebook to keep data on Vietnamese citizens in open local offices and hand the data over to the Vietnamese government if suspected of “anti-state activity.”¹⁰ Australia just introduced mandatory data breach reporting, and Canada will do the same in November.¹¹

Data Protection in India

Indian companies that operate in the international arena have been forced to reform their privacy policies and data protection measures so that they align with the GDPR.¹² But the Indian government has also been taking actions to secure the privacy of all Indian citizens, actions that many advocates say are long overdue.

In March 2017, India increased security of personal information stored by Prepaid Payment Instruments, which are online cash transfer services like PayPal.¹³ This was one of the first direct actions India has taken to protect privacy online. Soon after, in August 2017, the Indian Supreme Court declared that privacy was a fundamental right (although it did note that, like other fundamental rights, privacy could be denied if it was competing with compelling state interests). Additionally, the Ministry of Health drafted a law in March to secure personal digital health data, and the Reserve Bank of India (RBI) issued a notification in April requiring payment system operators to store data within India so it would be subject to RBI supervision.

Last November, India created the Srikrishna Committee, a committee of experts asked to develop a national framework for comprehensive data protection. The committee released a draft later that month focusing on 7 key principles, including Informed Consent (consumer consent must be expressed in an “informed and meaningful manner”) and Data Minimization (only necessary and required data should be collected).¹⁴ The committee submitted its full recommendations for a bill a few days ago.

Private Pushback

Although national sentiment is in support of greater privacy laws, the private sector is concerned about a boom in individual privacy legislation. Of course one of the events that triggered the drive to update privacy laws was the Facebook breach, which exposed personal information of as many as 87 million people worldwide, including more than half a million Indians.¹⁵ The laws developed based on the Srikrishna Committee’s recommendations will likely serve as a barrier to international internet companies like Facebook, as well as Google and Amazon.¹⁶ For example, India’s Google-backed delivery app Dunzo requires access to customers’ contacts, location, messages, and more “to improve the user’s experience.” This likely will not fly once India imposes stricter privacy laws.

Although data privacy laws could reduce efficiency among large companies in India, they are necessary to keep citizens safe from corporate overstretch and malicious hackers. It will be interesting to see what precise regulations are created in the wake of the Srikrishna Committee’s report, and how they affect both multinationals and the Aadhaar system. Regardless, such laws are certainly in the best interest of Indian citizens and cannot come soon enough.

Works Cited

1. Susan Heavey and David Brunnstrom, “Trump Suggests China Might Be Interfering in U.S.-North Korea Talks,” Reuters, July 10, 2018, https://www.reuters.com/article/us-northkorea-usa/trump-eyeing-china-says-confident-of-u-s-north-korea-deal-idUSKBN1JZ1TS.
2. Zack Whittaker, “A New Data Leak Hits Aadhaar, India’s National ID Database,” ZDNet, March 23, 2018, https://www.zdnet.com/article/another-data-leak-hits-india-aadhaar-biometric-database/.
3. Ibid.
4. Vidhi Doshi, “A Security Breach in India Has Left a Billion People at Risk of Identity Theft,” Washington Post, January 4, 2018, https://www.washingtonpost.com/news/worldviews/wp/2018/01/04/a-security-breach-in-india-has-left-a-billion-people-at-risk-of-identity-theft/.
5. “Vulnerability of Biometric Data for Aadhaar Is Violation of Rights: SC Told,” Business Standard India, February 7, 2018, https://www.business-standard.com/article/economy-policy/vulnerability-of-biometric-data-for-aadhaar-is-violation-of-rights-sc-told-118020701441_1.html.
6. Doshi, 2018
7. Ibid.
8. Nitasha Tiku, “How Europe’s New Privacy Law Will Change the Web, and More,” Wired, March 19, 2018, https://www.wired.com/story/europes-new-privacy-law-will-change-the-web-and-more/.
9. Tamlin Magee, “China’s Data Privacy Standard Came into Effect This May – Inspired by GDPR,” Computer World UK, June 15, 2018, https://www.computerworlduk.com/data/how-chinas-data-privacy-law-was-inspired-by-gdpr-3678918/.
10. “Vietnam Forces Facebook and Google to Pick Privacy or Growth,” Text, The Straits Times, June 28, 2018, https://www.straitstimes.com/asia/se-asia/vietnam-forces-facebook-and-google-to-pick-privacy-or-growth.
11. Nick Abrahams and Jim Lennon, “Privacy Makes the World Go Round as New Laws Abound,” Australian Financial Review, June 27, 2018, https://www.afr.com/news/special-reports/cyber-security/privacy-makes-the-world-go-round-as-new-laws-abound-20180626-h11v86.
12. Dhir & Dhir Associates, “Watershed Year For Data Privacy Laws In India,” Mondaq, June 20, 2018, http://www.mondaq.com/india/x/711346/Data+Protection+Privacy/Watershed+Year+For+Data+Privacy+Laws+In+India.
13. Ibid.
14. Ibid.
15. “Over Half a Million Indian Facebook Users May Have Been Affected in Data Breach,” The Times of India, April 5, 2018, https://timesofindia.indiatimes.com/india/over-half-a-million-indian-facebook-users-may-have-been-affected-in-data-breach/articleshow/63625675.cms.
16. Saritha Rai, “This Indian Judge Is Making Google and Amazon Nervous,” Bloomberg.com, June 10, 2018, https://www.bloomberg.com/news/articles/2018-06-10/tech-giants-nervous-as-judge-drafts-first-data-rules-in-india.