Telcos, e-tailers up against the privacy judgement wall

The recent judgement of the apex court declaring the right to privacy as a fundamental right has indeed made this 70th year of independence special for Indian citizens. It has not only reinforced the ‘dignity of the individual’ as enshrined in the Preamble of the Constitution of India, but has also provided much-needed relief from misuse of personal data by unscrupulous players. In the aftermath of this judgement, the state can put reasonable restrictions in public interest and in the interest of the security of the state, while non-state actors have to seriously rethink the manner in which they will be dealing with the personal data of individuals.

Among the non-state players, biggest to be affected are the social media networks, e-tailers, telecom companies and financial institutions. These organisations thrive on customer data. Details are stored and mined using big data analytics to target potential clients. Telecom service providers who, not long ago, were alleged to be in talks with major online retailers to sell consumer data of their subscribers, will most certainly have to drop these ideas. While they may try to cover themselves with usual online agreements of consent clicked by users, they will now be tested by affected individuals under writ jurisdictions before the High courts and the Supreme Court.

It was not long ago that the government had directed 21 telecom companies to disclose security measures to ensure that they are not stealing consumer data. While the state will continue to have the power to question the telecom companies, individuals can now invoke the intervention of the courts directly.  

Those who could still survive request for privacy will have to probably fathom how they will deal with the requests of ‘right to be forgotten’ by the consumers. This means that all the history of a person stored in their databases by these companies will have to be reasonably erased by them if the person so demands. This will directly affect organisations who store customer interactions, details of sites visited, as well as geographical locations of persons using their sites or social networks.

In addition to declaring the right to privacy as a fundamental right, the apex court has also indicated that there is a need for a data protection regime on the lines of General Data Protection Regulation (GDPR) soon to be adopted by the European Union. This is another very significant suggestion given by the apex court to protect personal data. In data privacy domains across the world, GDPR is known to be one of the most stringent regulations in recent times to protect private data of consumers.

GDPR requires that consent of consumers, if taken by companies, must be clear and distinguishable from other matters and provided in an intelligible and easily accessible form, using clear and plain language. It must be as easy to withdraw consent as it is to give it. Fines for violations, too, are daunting. Companies for violation of consumer privacy can get charged up to 4 per cent of their worldwide turnover or 20 million Euros, whichever is higher. Besides the right to be forgotten, it provides for a breach notification to be given within 72 hours of the breach and also mandates that individuals have the right to be informed by the data controller on when their data is being processed and for what purpose. It directs that systems have to be designed keeping the privacy of data as a prime requirement.

While the judgment, in conclusion, reposed faith in Justice BN Srikrishna committee for identifying key data protection issues, it has clearly indicated the type of regulations that the country requires. These regulations, as and when adopted, coupled with the new status of a fundamental right granted to citizens’ privacy will significantly enhance the dignity of Indians. It will most probably force non-state actors who were looking to harness consumer data, to immediately reinvent their businesses or face the scrutiny of courts in India.

The author is an IPS officer, currently ADG in Maharashtra, and is a Certified Information System Security Professional (CISSP)