India shouldn't be granted the status of "data secure nation" by Europe until it enacts a suitable privacy legislation, points out the Centre for Internet and Society in this open letter.
This research was undertaken as part of the 'SAFEGUARDS' project that CIS is undertaking with Privacy International and IDRC.
This letter is with regards to both the request from the Confederation of Indian Industry that the EU recognize India as a data secure nation made on April 29th 2013,1 and the threat from India to stall negotiations on the Free Trade Agreement with the EU unless recognized as data secure nation made on May 9th 2013.2
On behalf of the Centre for Internet and Society, we request that you urge the European Parliament and the EU ambassador to India to reject the request, and to not recognize India as a data secure nation until a privacy legislation has been enacted.
The Centre for Internet and Society believes that if Europe were to grant India status as a data secure nation based only on the protections found in the "Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011", not only will India be protected through inadequate standards, but the government will not have an incentive to enact a legislation that recognizes privacy as a comprehensive and fundamental human right. Since 2010 India has been in the process of realizing a privacy legislation. In 2011 the "Draft Privacy Bill 2011" was leaked.3 In 2012 the "Report of the Group of Experts on Privacy" was released. The Report recommends a comprehensive right to privacy for India, nine national privacy principles, and a privacy framework of co-regulation for India to adopt.4 In 2013 the need for a stand alone privacy legislation was highlighted by the Law Minister.5 The Centre for Internet and Society has recently drafted the "Privacy Protection Bill 2013" - a citizen's version of a possible privacy legislation for India.6 Currently, we are hosting a series of six "Privacy Roundtables" across India in collaboration with FICCI and DSCI from April 2013 - August 2013.7 The purpose of the roundtables is to gain public feedback to the text of the "Privacy Protection Bill 2013", and other possible frameworks for privacy in India. The discussions and recommendations from the meeting will be published into a compilation and presented at the Internet Governance meeting in October 2013.
The Center for Internet and Society will also be submitting the "Privacy Protection Bill 2013" and the public feedback to the Department of Personnel and Training (DoPT) with the hope of contributing to and informing a privacy legislation in India.
The Centre for Internet and Society has been researching privacy since 2010 and was a member of the committee which compiled the "Report of the Group of Experts on Privacy". We have also submitted comments on the "Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011" to the Committee on Subordinate Legislation of the 15th Lok Sabha.8
We hope that you will consider our request and urge the European Parliament and the EU ambassador to India to not recognize India as a data secure nation until a privacy legislation has been enacted.
Note: CIS sent the letters to Data Protection Commissioners across Europe.