(Continued from the previous article)
P.S: This series of articles is an attempt to place some issues before the Government of India which promises to bring a new Data Protection Law that is futuristic, comprehensive and Perfect.
We have discussed the definition of “Privacy” in some detail in the last few articles. In particular, the suggestion that “Sharing” of identifiable data for processing within an algorithm in such a manner that the identified data is not exposed to a human being has evoked a long debate and I have tried to provide clarifications as required.
One residual query was in respect of what would happen if the anonymised processed data is shared as “Non Personal Data” and the recipient later de-anonymizes the anonymized data. Obviously when data which was previously identifiable personal data but was anonymized by one processor and then released as “Non Personal Data”, the processor is expected to use an acceptable standard of anonymization which becomes the “Due Diligence” or “Reasonable Security Practice” on his part. When this is voluntarily shared by Processor A to a recipient B, Recipient B is not expected to de-anonymize the data. If Processor B does de-anonymize then Processor B would be guilty of a criminal offence (we shall discuss this later under penalties). At that time, Processor A would have to defend that it had followed “Due Diligence” and claim protection as an intermediary under Section 79.
I reiterate that the concept that the definition of “Sharing” for defining “Privacy” should be restricted to disclosure to a human being and not an algorithm is a concept which is different from the GDPR jurisprudence. It is however suggested because we feel that there is an opportunity for India to set new standards in designing a Data Protection Act which can be better than GDPR.
In order to recall all the discussions we had in this regard, we reproduce the definition of Privacy as suggested by us to be included in the NDPAI.
Privacy
Privacy is a fundamental right under the Constitution of India as an independent right under the Right to life and liberty that guarantees an individual that shall not be infringed except under due process of law as defined in this Act and includes the following.
(a) “Physical Privacy” means the choice of an individual to determine to what extent the individual may chose to share his physical space with others.
(b) “Mental Privacy” means the choice of an individual to determine to what extent the individual may chose to share his mind space with others
(c) “Neuro Privacy” means the choice of an individual to determine to what extent the individual may share his neuro space with others
(d) “Information Privacy” means the choice of an individual to determine to what extent the individual may share data about the individual with others.
Explanation:
“Sharing” in the context above means “making the information available to another human being in such form that it can be experienced by the receiver through any of the senses of seeing, hearing, touching, smelling or tasting of a human in such a manner that the identity of the individual to whom the data belongs may become recognizable to the receiver with ordinary efforts”.
We also re-iterate that it is the responsibility of the Government to define “Privacy” before going to place a responsibility on the industry to protect the Right to Privacy.
Definition of Data
Having defined that “Privacy” is related to protection of Personal data we need to now define
i) Data, Computer, Processing
ii) Personal Data
iii) Non Personal Data
iv) Sensitive Personal Data
v) Neuro data
vi) Harm to individuals
vii) Harm to Entities
viii) Critical Personal Data
ix) Sensitive non personal data
x) Critical Non Personal Data
xi) Significant Harm
xii) Joint Data
xiii) Corporate Data
xiv) Business Data
xv) Minor Data
xvi) Personal Data of non citizens
xvii) De-identified Personal Data
xviii) Pseudonymized Personal Data
xix) Anonymized Personal Data
xx) Encrypted Data
Let us first place before the audience the proposed definitions of these 16 different kinds of data and later debate whether all these categories of data are to be defined.
We have consciously decided that we are pursuing development of a “Privacy Code” that is a combination of present day PDPB 2019 and ITA 2000/8 and the proposed Non Personal Data Governance Act (NPDGA).
Though in the definition of Privacy we have included instruments of personal information contained in “Oral” and “Paper” form, most of our discussions will revolve around “Data” which is the electronic form of storage of information.
When PDPB 2019 was contemplated, we already had ITA 2000 which had defined Data, Personal data, Sensitive Personal data and the legal recognition to Data. Hence PDPB 2019 adopted the same definition of data and only made some changes to the definition of sensitive personal information. Presently there is an opportunity to find an improved definition and hence we are proceeding to suggest definitions which may be slightly at variance with the current ITA 2000/8.
i) Data, Computer, Processing
“Data” means information which is expressed or is capable of being expressed in a binary language and includes data in raw form where the binary elements are distributed in a chaotic state and data which is organized into bytes and sequence of bytes.
Correspondingly, “Computer” will be defined as any device that can generate, process, store or transmit data or delete data by destroying the organized form of binary distribution back to a chaotic form and includes all hardware devices and applications which provide the functionality of generation of an organized set of binary expressions, processing them or storing them or transmitting them or handle them in any other form.
Further, “Processing” will be defined as any alteration of a binary sequence of data elements and includes data aggregation, data modification, data deletion, data disclosure, data publishing etc.
ii) Personal data
Personal data means any data that can with reasonable assurance be associated by the receiver with an identifiable living natural person and includes combination of different elements of personal data which in combination create a reasonably assured identity though the different elements might have been acquired from different sources and at different points of time.
iii) Non Personal Data
Any data which is not “Personal data” is “Non Personal Data” and includes Raw data in a chaotic distribution of binary, Corporate Data, Business transaction data, environmental data etc., which donot contain the association with an identity of any specific living natural person.
iv) Sensitive Personal Data
Personal Data which contains such personal data, which may reasonably cause a significant harm to the individual in the hands of unauthorized person is classified as “Sensitive personal data” and includes
a) Credentials for accessing restricted data
b) Health data
c) Financial data
d) Sex related data
e) Biometric data
f) Genetic data
An associated definition with Sensitive Personal Information would be the definition of “Harm” and “Significant harm”.
v) Neuro data
Neuro data means the electromagnetic signals that are collected from or fed into the human brain by a Brain Computer Interface in binary form.
vi) Harm to Individuals
“Harm” means any wrongful and adverse impact on the body, mind or property of an individual and includes
a) Physical or Mental injury
b) Loss, distortion or theft of identity
c) financial loss or loss of property
d) Loss of reputation or humiliation
e) Loss of Employment or source of income
f) Threat to life and property including causing harassment or subjecting to extortion
g) Causing discriminatory treatment in the society.
h) Psychological or Neurological manipulation which alters the ability of an individual to take autonomous decisions
vii) Harm To Entities
“Harm” in the context of entities means any wrongful and adverse impact on the entity in terms of its property, reputation, business continuity, impairment or cost escalation.
viii) Critical Personal Data
Critical Personal Data means such personal data, deprivation, incapacitation or destruction of which would cause significant harm to an individual and includes biometric data or genetic data or unique official identifiers and personal data under the control of such entities or computer resources whose activities if incapacitated or impaired may have debilitating impact on national security, economy, public health or safety.
ix) Sensitive Non Personal Data
Sensitive Non Personal Data means such non personal data which the deprivation, modification, deletion or wrongful sharing of which may reasonably cause a significant harm to any organization including
a) Loss of Business
b) Loss of Money or Property
c) Loss of Reputation
d) Disruption of Business Continuity
e) Unreasonable increase in cost of operation
x) Critical Non Personal Data
Critical Non Personal Data means such non personal data, deprivation, incapacitation or destruction of which would cause significant harm to an entity and includes non personal data under the control of such entities or computer resources whose activities if incapacitated or impaired may have debilitating impact on national security, economy, public health or safety.
xi) Significant Harm
Significant Harm means such harm caused to an individual or any other entity, which is irreversible or is reasonably difficult to correct once caused.
xii) Joint Data
Joint Data whether personal or non personal means such data that is generated during a transaction involving more than one individual or entity
xiii) Corporate Data
Corporate Data means data that can with reasonable assurance be associated with an identifiable non living individual including Government agencies or Partnership firms, proprietary concerns or association of individuals, Not for profit entities, and further includes combination of different elements of data which in combination create a reasonably assured identity though the different elements might have been acquired from different sources and at different points of time.
xiv) Business Data
Business Data means any data related to a business or Governance transaction whether inclusive of elements of personal data or corporate data or not.
xv) Minor Data
Minor Data means any personal data associated with an individual who is of age less than 18 years.
xvi) Personal Data of Non Citizens
Personal Data of Non Citizens means any personal data of an individual who is not a Citizen of India as per the Citizenship Act of India.
xvi)i De-Identified Personal Data
De-Identified personal Data means such personal data from which all parameters of identity that may with reasonable assurance determine the association of the data with a living natural individual is removed and made inaccessible to the person to whom the data is disclosed.
xviii) Pseudonymized Personal Data
Pseudonymized personal Data means such personal data in which all parameters of identity that may with reasonable assurance determine the association of the data with a living natural individual are replaced with comparable but randomly altered data elements and made inaccessible to the person to whom the data is disclosed.
xix) Anonymized Personal Data
Anonymized personal Data means such personal data from which all parameters of identity that may with reasonable assurance determine the association of the data with a living natural individual are removed and irrevocably destroyed so that the identity of the individual is rendered indeterminate to any person who is in possession of the residual data including the entity or person who caused the anonymization.
xx) Encrypted Data
Encrypted Data means such data that has been converted into a different data and rendered unusable and unreadable by unauthorized persons .
The above definitions have been provided with some specific reasons that would be clearer as we go ahead and advocate the provisions of the Act.
However, definitions are very critical to the designing of the laws and hence I invite intense debate on the above definitions.
P.S: These discussions are presently for a debate and is a work in progress awaiting more inputs for further refinement. It is understood that the Government may already have a draft and may completely ignore all these recommendations. However, it is considered that these suggestions will assist in the development of “Jurisprudence” in the field of Data Governance in India and hence these discussions will continue until the Government releases its own version for further debate. Other professionals who are interested in participating in this exercise and particularly the Research and Academic organizations are invited to participate. Since this exercise is too complex to institutionalize, it is being presented at this stage as only the thoughts of Naavi. Views expressed here may be considered as personal views of Naavi and not that of FDPPI or any other organization that Naavi may be associated with.
Naavi
(This is not an exhaustive list of definitions. More will follow)
