We need strict laws that fix accountability for data leaks

Expressing his concerns about the aggregation of personal data given by individuals for commercial purposes, Justice D Y Chandrachud said on Thursday: “The 1.3 billion Indians may be poor, but we are a goldmine of commercial information.”

Breach of privacy and misuse of data is a growing concern across the world today. The Facebook-Cambridge Analytica controversy has taken the debate beyond the misuse of large databases for individual surveillance. As allegations of data stolen from Facebook being used to influence elections have surfaced, democracy itself is seemingly coming under threat in the digital age.

While these are extreme events, lack of a well-defined institutional framework regarding use and collection of data has created important concerns in other areas as well. The biggest issue in this regard probably is extreme concentration of economic power which access to data is creating. Internet giants such as Facebook and Google are extremely difficult to compete with in today’s world. While they do not charge their consumers directly and could even offer to subsidise them, as was the case during the net neutrality debate involving Facebook’s free basic services, they stand to earn a lot through advertising on their platforms. The data they possess also lends itself to commercial use by third parties who can access it illegally as well. Once compromised, there is no limit to commercial exploitation of such databases.

Unless there are strict laws that fix accountability for leaks with the companies which possess such data, they are unlikely to take efforts to protect it. It takes money to secure such data and companies are always trying to maximise profits and minimise costs. There is a flip side to this argument as well. If all companies are obligated to follow similar protection standards, the new entrants might die even before they are born because they would not have the resources to afford such technology.

An even bigger problem is the fact that people whose information is stored in these databases and those who use them might not be aware of the consequences of their actions. This is more likely to be the case in a country like India, where education levels let alone awareness about digital technology are poor. Government departments and individuals have been found wanting in adhering to data privacy practices. It will take much more than a privacy law to take care of Justice Chandrachud’s concerns.