Section 8 (1)(j) of the RTI Act to be amended by the Personal Data Protection Act, 2018
28 Jul, 2018The Srikrishna Committee has prepared a draft Data Protection Bill which has raised anxiety among the RTI activists as it seeks to amend the section 8(1)(j) Notwithstanding anything contained in this Act, there shall be no obligation to give any citizen, information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual unless the Central Public Information Officer or the State Public Information Officer or the appellate authority, as the case may be, is satisfied that the larger public interest justifies the disclosure of such information: Provided that the information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person. Notwithstanding anything contained in this Act, there shall be no obligation to give any citizen, information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual unless the Central Public Information Officer or the State Public Information Officer or the appellate authority, as the case may be, is satisfied that the larger public interest justifies the disclosure of such information: Provided that the information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person. Notwithstanding anything contained in this Act, there shall be no obligation to give any citizen, information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual unless the Central Public Information Officer or the State Public Information Officer or the appellate authority, as the case may be, is satisfied that the larger public interest justifies the disclosure of such information: Provided that the information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person. of the RTI Act, 2005. Let us take a look at the draft provisions and and the proposed amendments in the RTI Act, 2005.
1. The objective of the Personal Data Protection Act, 2018, as to why it is being enacted, is described in the preamble of the Act, is as under:-
Preamble
WHEREAS the right to privacy is a fundamental right and it is necessary to protect personal data as an essential facet of informational privacy;
WHEREAS the growth of the digital economy has meant the use of data as a critical means of communication between persons;
WHEREAS it is necessary to create a collective culture that fosters a free and fair digital economy, respecting the informational privacy of individuals, and ensuring empowerment, progress and innovation;
AND WHEREAS it is expedient to make provision: to protect the autonomy of individuals in relation with their personal data, to specify where the flow and usage of personal data is appropriate, to create a relationship of trust between persons and entities processing their personal data, to specify the rights of individuals whose personal data are processed, to create a framework for implementing organisational and technical measures in processing personal data, to lay down norms for cross-border transfer of personal data, to ensure the accountability of entities processing personal data, to provide remedies for unauthorised and harmful processing, and to establish a Data Protection Authority for overseeing processing activities;
2. The proposed definition of Personal Data given in the Bill on Personal Data Protection Act, 2018, is as follows:-
Section 2(29) “Personal data” means data about or relating to a natural person who is directly or indirectly identifiable, having regard to any characteristic, trait, attribute or any other feature of the identity of such natural person, or any combination of such features, or any combination of such features with any other information;
3. Some of the comparative definitions used by other countries on the subject are as follows:
- European General Data Protection Regulation applicable from 25th of May, 2018 across all its member states:
Article 4(1) ‘personal data’ means
any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
- USA – As per the Privacy Act of 1974:
Definition D. Record
“any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph.”
4. The definitions of the Data Protection Bill appears to be more relevant and important when read with section 8(1)(e) Notwithstanding anything contained in this Act, there shall be no obligation to give any citizen, information available to a person in his fiduciary relationship, unless the competent authority is satisfied that the larger public interest warrants the disclosure of such information; of the RTI Act [rather than section 8(1)(j) Notwithstanding anything contained in this Act, there shall be no obligation to give any citizen, information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual unless the Central Public Information Officer or the State Public Information Officer or the appellate authority, as the case may be, is satisfied that the larger public interest justifies the disclosure of such information: Provided that the information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person. Notwithstanding anything contained in this Act, there shall be no obligation to give any citizen, information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual unless the Central Public Information Officer or the State Public Information Officer or the appellate authority, as the case may be, is satisfied that the larger public interest justifies the disclosure of such information: Provided that the information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person. Notwithstanding anything contained in this Act, there shall be no obligation to give any citizen, information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual unless the Central Public Information Officer or the State Public Information Officer or the appellate authority, as the case may be, is satisfied that the larger public interest justifies the disclosure of such information: Provided that the information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person. of the RTI Act] which is as under:
- Data Protection Bill: Section 2
“Data fiduciary” means any person, including the State, a company, any juristic entity or any individual who alone or in conjunction with others determines the purpose and means of processing of personal data;
“Data principal” means the natural person to whom the personal data referred to in subclause (28) relates;
Notwithstanding anything contained in this Act, there shall be no obligation to give any citizen, information available to a person in his fiduciary relationship, unless the competent authority is satisfied that the larger public interest warrants the disclosure of such information;
Hence, it seems that the entire Data Protection Bill relates to personal data collected by a Data Principal from a Data Fiduciary, in a fiduciary capacity.
5. The section 112 of Data Protection Bill read with its Second Schedule, provides as follows:
- Section 112. - Amendment of Act 22 The provisions of this Act shall have effect notwithstanding anything inconsistent therewith contained in the Official Secrets Act, 1923 (19 of 1923), and any other law for the time being in force or in any instrument having effect by virtue of any law other than this Act. The provisions of this Act shall have effect notwithstanding anything inconsistent therewith contained in the Official Secrets Act, 1923 (19 of 1923), and any other law for the time being in force or in any instrument having effect by virtue of any law other than this Act. of 2005. — The Right to Information Act, 2005 ( 22 The provisions of this Act shall have effect notwithstanding anything inconsistent therewith contained in the Official Secrets Act, 1923 (19 of 1923), and any other law for the time being in force or in any instrument having effect by virtue of any law other than this Act. The provisions of this Act shall have effect notwithstanding anything inconsistent therewith contained in the Official Secrets Act, 1923 (19 of 1923), and any other law for the time being in force or in any instrument having effect by virtue of any law other than this Act. of 2005) shall be in the manner set out in the Second Schedule to this Act.
THE SECOND SCHEDULE:
1. Amendment of section 8. — In place of the current clause (j) of sub-section (1) of section 8 of the Right to Information Act, 2005 the following clause (j) of sub-section (1) of section 8 shall be substituted, namely:—
“(j) information which relates to personal data which is likely to cause harm to a data principal, where such harm outweighs the public interest in accessing such information having due regard to the common good of promoting transparency and accountability in the functioning of the public authority;
Provided, disclosure of information under this clause shall be notwithstanding anything contained in the Personal Data Protection Act, 2018;
Provided further, that the information, which cannot be denied to the Parliament or a State Legislature shall not be denied to any person.
Explanation - For the purpose of this section, the terms “personal data”, “data principal”, and “harm” shall have the meaning assigned to these terms in the Personal Data Protection Act, 2018.”
Impact of the changes
It is not known how the Information Commissions will decide cases involving personal and fiduciary information when the bill acquires the status of a law.
1. The impact of the proposed changes needs a detailed examination. The Proviso to the second schedule has given rise to a view amongst a section of the activists that there is no damage done to the RTI Act. Does the proviso to Second Schedule of Data Protection Bill saves the section 8(1)(j) Notwithstanding anything contained in this Act, there shall be no obligation to give any citizen, information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual unless the Central Public Information Officer or the State Public Information Officer or the appellate authority, as the case may be, is satisfied that the larger public interest justifies the disclosure of such information: Provided that the information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person. Notwithstanding anything contained in this Act, there shall be no obligation to give any citizen, information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual unless the Central Public Information Officer or the State Public Information Officer or the appellate authority, as the case may be, is satisfied that the larger public interest justifies the disclosure of such information: Provided that the information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person. Notwithstanding anything contained in this Act, there shall be no obligation to give any citizen, information which relates to personal information the disclosure of which has no relationship to any public activity or interest, or which would cause unwarranted invasion of the privacy of the individual unless the Central Public Information Officer or the State Public Information Officer or the appellate authority, as the case may be, is satisfied that the larger public interest justifies the disclosure of such information: Provided that the information which cannot be denied to the Parliament or a State Legislature shall not be denied to any person. of the RTI Act from any amendment remains a topic for discussion among the enlightened citizens, specially in the light of the Supreme Court decision in the Girish Deshpande judgment. Further, the impact of the draft changes on the data collected by various government agencies as a part of their duty, would need to be examined.
2. Based on their interpretation of the amended section 8 (1) (j), a section is of the view that it would mean that all personal information will be barred, unless there is a larger public interest in disclosure.
3. The amendment under the Personal Data protection Act suggests an overriding effect of the law on previous laws which implies dilution of the Section 22 The provisions of this Act shall have effect notwithstanding anything inconsistent therewith contained in the Official Secrets Act, 1923 (19 of 1923), and any other law for the time being in force or in any instrument having effect by virtue of any law other than this Act. The provisions of this Act shall have effect notwithstanding anything inconsistent therewith contained in the Official Secrets Act, 1923 (19 of 1923), and any other law for the time being in force or in any instrument having effect by virtue of any law other than this Act. of the RTI Act.
Certain links -
RTI amendment (last page): http://meity.gov.in/writ ereaddata/files/Personal_Data_ Protection_Bill%2C2018_0.pdf
Full report: http://meity.gov.in/wr itereaddata/files/Data_Protect ion_Committee_Report.pdf