People’s rights with respect to their personal information

Over 53% of citizens indicated they have seen adverts on the web or app based on their conversations over the phone at least once in the past year. Among those who have had such an experience, 28% said it happens frequently, 19% said it has happened several times, and 6% said it has happened only a few times. Only 24% of people claimed that it never happened, while 23% were undecided.

The survey from LocalCircles reveals that, one in two Indians admitted to receiving advertisements based on their private voice talks. The results also indicated that the majority of Indians have given microphone access to their mobile phone for audio/video calls, social media, and audio recording third-party apps. A large number of people have been raising the issue of seeing contextual advertisements post their private phone conversations and this is very concerning. Such practices must be investigated and any apps requiring microphone access must be required to give clear declarations of where a user's information will be used and seek explicit consent.

Until now, the personal data of India’s population of 1.4 billion people has been protected by the IT Act 2000. Although the act has been amended repeatedly since, there is a consensus in both the public and private sectors that India now needs specific personal data privacy legislation. The Personal Data Protection Bill 2019, which aims to give legislative and statutory protection to users’ or citizens’ personal information, is yet to be approved by the government.

The PDP Bill was then introduced in the parliament on December 11, 2019 to ensure that personal data, belonging to people, is protected and it establishes a Data Protection Authority to do so. The Bill governs the processing of personal data by i) government, ii) companies incorporated in India, and iii) foreign firms dealing with the personal data of Indians.

It sets rules for how personal data should be processed and stored, and lists people’s rights with respect to their personal information. It also proposes to create an independent Indian regulatory authority called the Data Protection Authority (DPA), to carry out the law. It is more than two years, the government of India has been silent, it brings an opportunity for the tech and social media companies to collect data openly to improvise the service to make better commercialisation.

The new law is currently being considered by a joint committee in India’s parliament, with the full legislation set to be implemented in the next two years. Experts say, “If this is not done at the earliest, such access could easily lead to financial frauds and people’s personal information getting compromised with no accountability of how it happened.