International Data Privacy Day

Privacies Promised, Privacies Delayed: International Data Privacy Day and India’s Digital Conundrum

On 28th January 2006, the Council of Europe inaugurated International Data Privacy Day to commemorate the signing of Convention 108, the first legally binding treaty on data protection. Fast forward two decades, the Indian digital ecosystem, hailed as a marvel of inclusion with over 101.7 crore broadband subscribers, appears precariously poised between innovation and vulnerability. Despite the constitutional recognition of privacy as a fundamental right, India’s apparatus for actualising privacy remains, at best, embryonic.

The Institutional Architecture of India's Privacy Framework

India’s core legislative tool to protect its citizens' data is the Digital Personal Data Protection (DPDP) Act, 2023. While the Act intends to balance individual privacy with innovation, its practical foundations are shaky. It creates a Data Protection Board (DPB) to adjudicate grievances but controversially allows for its members to be appointed solely by the executive. High administrative control over an ostensibly independent body injects institutional opacity and risks undermining its autonomy.

Importantly, the Act legitimises broad state exemptions under the guise of “legitimate state interests” like national security or public order, leaving citizens' sensitive personal data vulnerable to profiling or surveillance. Moreover, private firms, which collect staggering volumes of user data via Aadhaar-seeded platforms or UPI-based financial services, are subjected to light-touch oversight under the law. The supposed safeguard—a consent-based model—lacks teeth if grievances are met with institutional delay or corporate non-compliance.

The development of Digital Public Infrastructure (DPI) — Aadhaar, DigiLocker, and CoWin among others — is central to government-led digital governance. However, privacy-by-design principles remain conspicuously absent in their architecture. Without decentralised data storage mechanisms and robust encryption standards, India’s digital expansion may be raising a construction whose integrity erodes as it grows taller.

Numbers That Tell a Disturbing Story

The potential scale of damage is staggering. According to CERT-In, over 13.9 lakh cybersecurity incidents were recorded in India in 2022 alone. Notably, personal data from 5 crore CoWin users allegedly leaked in May 2023, being traded in online black markets. The preemptive safeguards pledged under the DPDP Act cannot cover such breaches retroactively. The absence of a mandatory requirement for time-bound breach notifications compounds the public trust deficit.

The ₹3,000 crore earmarked in the 2024 Digital Infrastructure Budget appears outwardly generous but scant resources have been allocated toward improving institutional data hygiene practices within government departments. Awareness campaigns for citizens, another glaring gap, remain sporadic rather than systemic.

Compare this with the European Union's General Data Protection Regulation (GDPR), which requires mandatory breach notifications within 72 hours. GDPR also enforces strict penalties on public bodies and lays down explicit data minimisation principles. The difference is not just procedural but cultural. India struggles with a compliance-first model over a values-driven digital rights system. Here, breaches invite scrutiny only when political heat rises; in the EU, violations activate independent inquiries irrespective of political alignments.

Democratic Ambitions, Rights-Based Realities

Privacy in India has deeper democratic resonance post the K.S. Puttaswamy verdict (2017), which affirmed it as a fundamental right under Article 21. Yet, five years later, statutory privacy safeguards resemble occasional cosmetic brushstrokes rather than structural reform. For example, the DPDP Act allows digital platforms to process data without consent for "legitimate uses," a clause that remains both overbroad and vaguely defined.

On-ground risks are stark in welfare schemes. The seeding of Aadhaar with Public Distribution System (PDS) and health records has, in some cases, excluded entitlements for vulnerable populations due to mismatched biometric data. Such instances underscore the irony of a welfare state employing digitalisation to ‘include’ while eroding privacy and disrupting rights at the grassroots. The absence of enforceable purpose limitation, a recommendation made by legal experts, further exacerbates this vulnerability.

The government's decision to exempt itself from some of the Act’s provisions reveals an ambivalent commitment to privacy principles. The real-world implications of such exemptions were highlighted by the Pegasus spyware issue, which damaged India’s global reputation as a democracy while raising fundamental questions about unchecked state surveillance mechanisms.

The Global Context: Lessons from Germany

If one examines Germany’s model, the divergence from India’s trajectory is evident. Germany operates under the GDPR but supplements it with the Federal Data Protection Act (BDSG), ensuring additional regulatory specificity. Both public and private entities are subject to annual compliance audits through highly decentralised data protection authorities (one for each state). Unlike India’s centralised DPB, Germany’s governance avoids concentration, making oversight more balanced and locally accessible. Furthermore, their proactive upskilling of governmental departments and citizens ensures a privacy-conscious society, not merely a privacy-anxious one.

Unresolved Questions and the Road Ahead

What, then, would success in India’s privacy framework look like? At minimum, it requires three concrete shifts:

• An autonomous and well-resourced Data Protection Board with transparent performance metrics.
• Mandatory timelines for breach notifications, coupled with penalties that bite, even against governmental bodies.
• A robust grievance redress system where citizens can intuitively navigate their legal rights without onerous procedural barriers.

More fundamentally, privacy must transcend cyber jargon and be institutionalised across Indian digital architecture. Parliament must re-assess the balance between “national interest” exemptions and enshrined constitutional values. A genuinely decentralised data governance model—complementing India’s federal structure—must prioritise sovereignty over personal data at the local, not just a national, level.

International Data Privacy Day may be a symbolic nod. But for a nation whose digital economy is set to contribute 20% of GDP by the end of this decade, symbols alone are not enough. Real legitimacy comes from building systems that citizens trust, and for that, rhetoric must finally translate to reform.

UPSC Practice Questions

Prelims MCQs:

1. Which of the following is true about the Digital Personal Data Protection (DPDP) Act, 2023?

   • (a) It mandates a federal structure for the Data Protection Board.
   • (b) It provides exemptions for the state under specific statutory purposes.
   • (c) It mandates data breach notifications within 24 hours of discovery.
   • (d) It is applicable only to private digital entities.

   Answer: (b)

2. Convention 108, often referred to in the context of data privacy, was signed by:

   • (a) OECD
   • (b) G20
   • (c) Council of Europe
   • (d) UNCTAD

   Answer: (c)

Mains Question: "To what extent does the Digital Personal Data Protection (DPDP) Act, 2023 address the structural tensions between privacy rights and state exemptions in India? Critically evaluate with reference to the Puttaswamy judgement."

Practice Questions for UPSC

Prelims Practice Questions

Frequently Asked Questions