New Delhi: On Independence Day, for the third straight year, millions of Indians will upload their selfies with the national flag on the government’s ‘Har Ghar Tiranga’ website. But, according to experts, the collective act of digital reverence to the Tricolour may trigger concerns over data privacy.
The users, once they share photos, will allow the ministry of culture to collect a wide array of their personal data, according to the privacy policy of the Har Ghar Tiranga website. This includes: “User & username, password, email address, name, address, service address, destination, age, date of birth, sex, nationality, browsing history, etc., as well as any images or other information uploaded/submitted by the user on the website.”
The government will also be able to track users’ internet protocol (IP) addresses, the website the user came from, and the website the user went to after using the platform, reads the privacy policy. Users automatically consent to sharing all such data when they visit the website, it said.
Such data collection is not illegal under the existing Information Technology Act. But experts say it may violate the new Digital Personal Data Protection Act, whenever it is notified—especially a provision that mandates collection of minimum possible personal information for a specific purpose.
Stock Market Holiday: Is Indian stock market closed for Independence Day 2024?
The government should clarify the purpose for which it will use the data collected from the campaign, said Justice Sanjay Kishan Kaul, former Supreme Court judge. “There may be people who want to fly the national flag but not share pictures of that. There should be a disclosure as to what this information will be used for, for a ‘considered’ decision to be made by people who upload their pictures.”
The privacy debate becomes relevant given the number of people who participate in the Har Ghar Tiranga campaign, endorsed by Prime Minister Narendra Modi. Last year, 100 million Indians uploaded selfies on the website, up 66% from the 60 million in the preceding year, according to the ministry’s 8 August statement.
The data collection under the Har Ghar Tiranga privacy policy appears “excessive”, said Rishabh Gandhi, managing partner, Rishabh Gandhi and Advocates, a Pune-based law firm. “A layperson might not want their images or browsing history to be collected and shared if it is not necessary for the campaign.”
To be sure, the government gathers citizen data for everything from surveillance to policy-making. For instance, minister of information and broadcasting Ashwini Vaishnaw, in a recent press conference, explained how the authorities use data from e-way bills and FASTag receipts to understand and resolve traffic congestion.
Queries emailed to the ministry of culture and the prime minister’s office (PMO) on Friday, 9 August, remained unanswered till press time.
Data gathering will not be considered a violation
Data gathering under the ministry’s campaign will not be considered a violation under the Information Technology Act read with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules also known as SPDI Rules, provided that the privacy policy is in line with the legal requirements, said Shreya Suri, partner, INDUSLAW.
But it will not be valid under the DPDP Act as and when it comes into force, unless the campaign “is exempted under Section 17(2) of the DPDP Act in the interests of sovereignty and integrity of India, security of the state, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these,” said Suri, who specializes in technology law.
The DPDP Act received the president’s assent a year ago, but the government has not notified the rules yet.
The Har Ghar Tiranga campaign may potentially violate this principle of data minimization under the new law, said Gandhi of Rishabh Gandhi and Advocates.
According to Deepak Maheshwari, a Delhi-based technology public policy consultant, the government needs to specify the purpose of every data point that it collects under the DPDP Act. “For instance, the government needs to explain what it means by collecting ‘destination’ data. Additionally, we need to look at what data the government will collect mandatorily and what data is optional.”
Since data collection will be an issue under the DPDP Act, it should specify a roadmap for the rules under the law, Maheshwari said. “When the GDPR (European Union’s data privacy law) came into existence, people knew exactly when they would have to start following it.”
Data gathering under the Har Ghar Tiranga campaign may also go beyond the ambit of the landmark Supreme Court verdict in Justice K.S. Puttaswamy v. Union of India in 2017, which declared the right to privacy as a fundamental right, constitutional law experts said.
“If the Har Ghar Tiranga website is collecting data points like nationality, age, sex etc, it may amount to profiling, which is a violation of the Puttaswamy judgment,” said Nitish Nawsagaray, assistant professor, ILS Law College, Pune. “Even if I am giving my data voluntarily, and my data with the state is used for any purpose which is not informed to me, then, the consent you are taking from me is not informed consent.”
Former additional solicitor general Sanjay Jain, however, does not see such data gathering violating the DPDP Act as it allows the government to share the information collected with law enforcement agencies or if it believes the data relates to any legal process.
But even Jain advises keeping data gathering to a minimum. “It cannot be ignored that it is imperative for the ministry to minimize the collection of citizen data and establish adequate safeguards before launching such a campaign,” he said. “It is the obligation of the ministry and the official portal of the campaign to erase the personal data of the users once the campaign is over.”
