New Delhi: In 2012, the Congress-led government assured Parliament that a right to privacy law was in the making. The eagerly awaited law was supposed to be a bulwark against surveillance on individuals, with rules spelling out when the government could snoop on citizens. While the bill was being made appealing to all stakeholders, including grumpy intelligence officials, the government changed.

The newly formed BJP-led Union government, too, assured Parliament in 2015 – three years after the initial assurance made by the Congress-led government – that the privacy bill was being written.

But what the new government finally delivered eight years later was a data protection law that focused on enabling a regulatory regime for companies and government to harvest people’s data while giving the boot to promises of a legal right to individual privacy and protection from illegal state surveillance.

The Reporters’ Collective investigation into the assurance reveals that a ministry for which Prime Minister Narendra Modi holds the portfolio scrapped the Right to Privacy Bill after India’s intelligence agencies sought “blanket exemptions” from the law. The government, following the intelligence agencies’ demands, quietly worked to kill the assurance to Parliament on bringing in the law.

While the assurance was still on the table, controversies emerged around allegations of government snooping on dissidents, and journalists using Pegasus, an Israeli military-grade spyware. Later, critics of the government using iPhones received warnings of "state-sponsored" attacks from Apple. As The Collective has previously shown, incriminating files were remotely placed on devices owned by anti-caste activists. These files, later ‘retrieved’ by security agencies, were part of the case against 16 activists associated with an event in Bhima Koregaon. The arrests subsequently led to the death of Stan Swamy, one of the jailed activists.

Part 4 of the Parliament Defied investigative series shows how the Modi government washed its hands off the assurances to Parliament to bring in a right to privacy law. It did so by telling Parliament that a separate act to protect citizens’ data was in the making, and bluffing in Parliament that the privacy law is in its various stages of draft.

THE ORIGIN

In 2011, the Manmohan Singh-led UPA government was working on a bill to guarantee citizens the right to privacy. The objectives of the proposed law — working drafts of which were leaked  — said it was being brought in to codify privacy as a legal right to citizens.

The draft bill identified several areas that constitute privacy: protection of communication, of honour and good name, confidentiality of private and family life, protection from search and detention, privacy from physical and electronic surveillance, confidentiality of financial and health information and, finally, protection of data related to the individual.

Official discussions on the draft bill, accessed by digital policy watchdogs, show that then Attorney General Goolam Vahanvati insisted on spelling out specific conditions under which the country’s agencies could intercept communication. The then Secretary to the Prime Minister had said that “provisions” should not hamper surveillance carried out by intelligence agencies for the security of the state.

In 2012, members of Parliament asked the Department of Personnel and Training if a Right to Privacy Bill was in the offing. One question was whether the proposed bill would protect “individuals and politicians” against “phone tapping and interception of communication”. The then Congress’ Minister of State for the Union Ministry of Personnel, Public Grievances and Pensions avoided giving specifics and said the bill was a work-in-progress.

The statement was recorded by the Committee on Government Assurances as an assurance that the government will bring in a law ensuring the right to privacy for citizens.

Just as the privacy law was being drafted into shape, the government changed, with the Narendra Modi government coming to power in 2014. 

Immediately after coming to power, in November 2014, the government requested Parliament to drop the assurance on privacy, meaning don’t ask for the status of the Right to Privacy Bill again. 

To get Parliament off its back, the government detailed how much discussion was taking place on the proposed law. The Union Ministry of Personnel, Public Grievances and Pensions, which is directly under the Prime Minister, detailed how the bill had gone through revisions during the previous UPA government. It added that by 2014 another draft had been readied. 

In August 2014, with the BJP-led government in saddle, the Union minister of state Jitendra Singh held another meeting on the draft law. Intelligence agencies and the Union Ministry of Home Affairs should be consulted yet again, it was decided. 

The government did not lay out any timeframe by which the bill would be tabled in Parliament. The government instead requested the parliamentary committee to stop asking about the bill.

The committee rejected the government’s request and in December 2015 asked the government to take the bill to its logical conclusion - table it in Parliament.

The same month, the question on the proposed law came up once again in Parliament.

AIADMK parliamentarian RP Marutharajaa on 9 December 2015 asked the Prime Minister if the government had “turned down the demand of intelligence agencies for a blanket exemption from the purview of Right to Privacy Bill”. 

This time, once again, the Minister of State for the Union Ministry of Personnel, Public Grievances and Pensions said the bill was still at a “preliminary stage” of drafting and “details are yet to be finalised” – officialese for it will take a lot more time.

But, it was still reassuring because this was the first official confirmation by the Modi government that it too was committed to a right to privacy law. 

This reply was once again treated as an assurance by the committee. By this point, there were five assurances on proposed right to privacy law between 2012 and 2015. All five of them, over a span of four years, said the government was finalising the bill, which was still in its “preliminary stages”.

Two years passed but the bill was nowhere in sight. 

In March 2018, the Union government again wrote to the committee to drop the assurance. This time it gave a reason. 

The government admitted to the parliamentary committee that intelligence agencies were “apprehensive” of the proposed law and wanted a “blanket exemption”. 

Simply put, intelligence agencies wanted the status quo to continue, without the headache of a privacy law. Multiple Indian laws, like the erstwhile Telegraph Act (currently Telecommunications Act), allowed government agencies to intercept communication at will. A right to privacy law could override provisions of these laws, potentially making it legally tough to surveil citizens.

Eventually, it said, the “Right to Privacy Bill could not achieve any breakthrough.” In plainspeak: the Right to Privacy Bill was dead.

To assuage the committee, the government added that the Union Ministry of Electronics and Information Technology was now working on a Data Protection Law, which would include “substantial policies that were part of the Right to Privacy Bill”.

The government told the Committee on Government Assurances it would wait for the Data Protection Law to assess if a right to privacy law was still needed.

Nearly two years later, on 20 January 2020, Parliament rejected the government's request for the second time. “The reasons given by the Ministry do not bring the assurances to a logical conclusion and the Data Protection Law being prepared by the MEITY (Ministry of Electronics and Information Technology) was more on a different perspective,” the committee replied. It also asked the ministry to “pursue the matter vigorously and implement the assurance at the earliest.”

A year later, in February 2021, the government made another attempt to get the assurance dropped. This time, they had something to show the committee.

The Data Protection Bill 2019 had been tabled in the Lok Sabha and had been referred to a joint parliamentary committee for a discussion. The government added that once the Data Protection Law comes in, the ministry would assess if a separate privacy act was needed to “address other privacy related concerns”.

This time the government was successful. The parliamentary committee summarily dropped all five pending assurances, nearly a decade after they were first made.

In August 2023, Parliament passed the Digital Personal Data Protection Act after multiple iterations of the bill. The data protection law deals with how citizens’ data is used, monetized and accessed by private firms and governments. While the proposed right to privacy law was supposed to guarantee citizens a legal right to privacy, the new data protection law does not mention the word “privacy” anywhere and grants blanket exemptions to the government to access and process individual’s personal data.

The government’s instincts were becoming apparent. After having once argued before the Supreme Court that citizens do not have a fundamental right to privacy, in 2023 it dealt a death blow to the idea. It passed the Telecommunications Act, 2023. The law gave the Union and state governments sweeping powers to intercept phone communications and even take over network towers for national security.

This was exactly the kind of powers the Right to Privacy Bill sought to protect Indian citizens from. 

A version of the Right to Privacy Bill introduced by the Congress-led government, too, empowered the government to intercept communication but the proposed law clearly stated such surveillance can be carried out only with a written order. Further the surveillance will be “in accordance with the law”, “for a legitimate purpose”, “proportionate” while also conforming to the “principles of privacy” as stated in the bill.

For now, privacy, at least for those in public life, is,...“sshh wait, not here, let’s talk when we meet.” 

THE OTHER ^BROKEN PROMISES