Ravi Shankar Prasad’s Hollow Rhetoric

A couple of days after the Facebook-Cambridge Analytica data misuse scandal broke out globally, Indian IT minister Ravi Shankar Prasad held a press conference fulminating against both Facebook and the Congress Party. In characteristic north Indian Ram Lila style, Mr.Prasad lashed out at Mark Zuckerberg, the owner of Facebook, direly warning him that he (the IT minister of India) could summon him (Zuckerberg) to India, presumably to face the music.

"Mr Mark Zuckerberg you better note the observation of the IT Minister of India. We welcome the FB profile in India, but if any data theft of Indians is done through the collusion of FB system, it shall not be tolerated. We have got stringent power in the IT Act, we shall use it, including summoning you in India," Prasad thundered.

Specifically queried about whether the Govt. of India would launch any investigation against Facebook, Prasad again righteously fumed:

"We have got very robust mechanism available, we will look into it. But today, this very stern observation I gave that let my warning be heard across the Atlantic far away in California."

Prasad would come across as a virtuous warrior, and protector of Indian’s privacy taking on the likes of Zuckerberg – forgetting for a moment a picture on his own Facebook page of smugly shaking hands with Zuckerberg himself. But all this is hogwash, all sound and fury signifying nothing.

Prasad should know that even in the remote possibility of him wanting to summon Zuckerberg to India in connection with some criminal theft of data or collusion in doing so, there is no Indian law that will ensure that. In fact Indian laws regarding data protection are so weak and so laughably inadequate that it is small wonder that all kinds of data is so freely bandied about in the country. Yet Mr.Prasad is incandescent with anger and his voice rolls across the Atlantic.

Take the primary regulation concerned with protection of data, The Information Technology (Reasonable Security Practices and Sensitive Personal Data or Information) Rules, 2011 otherwise known as SPDI Rules. In the first place, these only deal with “Sensitive” personal data or information. This is defined in Rule 3 of the Rules to include: passwords; bank account, credit/debit or other payment instrument details; physical, physiological and mental health condition; sexual orientation; medical records and history; biometric information. Glaringly missing are such information as caste, religion, political affiliation or activity. So, if Cambridge Analytica in collusion with Facebook acquires a database of Indians including information on whether they support the Narendra Modi or not that’s not “sensitive” information and rules don’t apply.

But beyond that, the SPDI Rules are without any teeth. The Srikrishna Committee charged by the government to suggest data protection laws in India released a White Paper in November 2017, where it said “The absence of an effective enforcement machinery therefore raises concerns about the implementation of the SPDI Rules. It is thus necessary to make a comprehensive law to adequately protect personal data in all its dimensions and to ensure an effective enforcement machinery for the same”.

Besides this, there are various laws regulating the telecom sector: Indian Telegraph Act, 1885, the Indian Wireless Telegraphy Act, 1933, the Telecom Regulatory Authority of India Act, 1997 and various regulations issued thereunder. However, data protection norms in the telecom sector are primarily dictated by the Unified License Agreement (ULA) issued to Telecom Service Providers (TSP) by the Department of Telecommunications (DoT). Under clause 37 (2), customer information can be disclosed only if the individual has consented to such disclosure and the disclosure is in accordance with the terms of consent. In addition, the Telecom Service Provider has to make efforts to comply with the Telegraph Act which among other things, allows the govt. to intercept messages, an intrusion justified in the name of national security. 

Then there is the Aadhaar Act that too has some provisions for data protection but the rapidly – and illegally - expanded scope of Aadhaar based data collection has led to several reported leaks of Aadhaar data which has left the govt. floundering. In fact the whole Aadhaar project is under a cloud and is facing a severe judicial test in the cases currently being heard in the Supreme Court.

Indian laws leave out far too many areas of data privacy from their ambit, and compared to say European laws, are very anemic. The European Union General Data Protection Rules, 2016 (GPDR), for instance are considered the most stringent in the world. It recognizes a rights based approach towards data protection and puts the individual at the centre of the law, as the Srikrishna Commission White Paper put it. Collection of certain forms of personal data, known as sensitive personal data (such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and data concerning health and sex life) is prohibited subject to certain exceptions. Thus, for processing to be lawful and fair, the entity collecting personal data must comply with an extensive range of principles such as that of purpose specification, data minimisation, data quality, security safeguards, etc.

So, Mr.Prasad’s rhetoric is standing on rather thin ice. But that is not all.

Evidence is slowly emerging that Mr.Prasad’s party, the BJP, has perhaps itself been involved in using sensitive data harvested probably from social media. A series of reports in the media say that Cambridge Analytica worked with Indian companies who in turn worked for the BJP and its ally, the JD(U). Although this part of the story is far from fully unveiled, Mr.Prasad’s righteousness is surely becoming all the more hypocritical as days pass. Perhaps it was the brazen rhetoric of those with a guilty conscience.