Stakeholders’ responses to the TRAI privacy consultation paper (Part VI of XII): Legitimate exceptions, exemptions and lawful surveillance

This is the sixth post, in a twelve (12) part series of posts, to map the opinions of all the stakeholders on the basis of their responses to the consultation paper on Privacy, Security, and Ownership of the Data in the Telecom Sector (Consultation Paper) published by the Telecom Regulatory Authority of India (TRAI) on 9^th August 2017.

In order to address key data privacy and security issues, the TRAI framed twelve (12) questions and invited comments to these questions. In total, fifty-three (53) stakeholders submitted detailed responses. Comments of all stakeholders are available here. Our comments to the Consultation Paper are available here.

The mapping of stakeholders’ opinion, and the analysis of such mapping, is based on the interpretation of all the responses to the Consultation Paper. A few details may have been lost during the interpretation of the responses. All suggestions, requests, and comments, to rectify any such omission(s) or error(s) in this exercise, are duly invited.

“Q.11 What should be the legitimate exceptions to the data protection requirements imposed on TSPs and other providers in the digital ecosystem and how should these be designed? In particular, what are the checks and balances that need to be considered in the context of lawful surveillance and law enforcement requirements?”

The concerns in relation to the legitimate exceptions to data protection requirements, raised by stakeholders in their responses to the abovementioned question 11 of the Consultation Paper, broadly relate to some of the issues discussed in the White Paper of the Committee of Experts on a Data Protection Framework for India (White Paper), namely, legitimate exceptions for national security and lawful surveillance purposes, exemption of de-identified data from the purview of data protection framework, and checks and balances in context of lawful surveillance and law enforcement requirements.

The following table projects the stance of the stakeholders on the grounds of legitimate exceptions to data protection requirements.

*Industry Associations: IAMAI – Internet & Mobile Association of India, ACTO – Association Of Competitive Telecom Operators, ACT – Association for Competitive Technology, ASSOCHAM – Associated Chambers of Commerce and Industry of India, COAI – Cellular Operators Association of India, GSMA – Groupe Speciale Mobile Association, ISPAI – Internet Service Providers Association of India, NASSCOM-DSCI – National Association of Software and Services Companies – Data Security Council of India, USISPF – U.S. India Strategic Partnership Forum, ITI – Information Technology Industry Council, USIBC – US India Business Council, BSA – Business Software Alliance, EBG – European Business Group Federation, BIF – Broadband India Forum, ISACA – Information Systems Audit and Control Association, iSPIRIT – Indian Software Product Industry Round Table.

**Telecom Service Providers: AT&T Global Network Services India Pvt. Ltd., RJIL – Reliance Jio Infocomm Limited, MTNL – Mahanagar Telephone Nigam Limited, TTL – Tata Teleservices Limited, BSNL – Bharat Sanchar Nigam Limited, RCOM –  Reliance Communications Ltd.

***Civil Society Organisations/ Think Tanks: NLUD – National Law University, Delhi,  IDP – Internet Democracy Project, CIS – The Centre for Internet and Society, ITfC – IT for Change, SFLC – Software Freedom Law Centre, FCSO – Federation of Consumer and Service Organization, CUTS – Consumer Unity and Trust Society, CGS – Consumer Guidance Society, CPA – Consumer Protection Association, IFF – Internet Freedom Foundation.

 The following table projects the stance of the stakeholders on an exclusion of anonymized data from the purview of data protection requirements.

 The following table projects the stance of the stakeholders on judicial interventions and oversight for surveillance and lawful access to personal data.

INSIGHTS

Should the legitimate exceptions to data protection requirements be restricted to critical purposes such as national security or law enforcement requirements?

• 26.4% of the stakeholders, comprising 25% of the industry associations, 40% of TSPs, 16.7% of civil society organisations/think tanks, 33.3% of individuals and 25% of companies/firms, stated that the legitimate exceptions to data protection requirements should be restricted to critical purposes such as national security and law enforcement requirements.
• 9.4% of the stakeholders, comprising 10% of TSPs, 25% of civil society organisations/think tanks and 8.3% of companies/firms, stated that the legitimate exceptions to data protection requirements should not be restricted to critical purposes such as national security and law enforcement requirements.
• 13.2% of the stakeholders, comprising 25% of the industry associations, 20% of TSPs and 8.3% of companies/firms, did not provide a clear stance on whether the legitimate exceptions to data protection requirements should be restricted to critical purposes such as national security and law enforcement requirements.
• 50.9% of the stakeholders, comprising 50% of the industry associations, 30% of TSPs, 58.3% of civil society organisations/think tanks, 66.7% of individuals and 58.3% of companies/firms, did not comment on whether the legitimate exceptions to data protection requirements should be restricted to critical purposes such as national security and law enforcement requirements.

Should anonymized data be excluded from the purview of data protection requirements?

• 15.1% of the stakeholders, comprising 18.8% of the industry associations, 30% of TSPs, 8.3% of civil society organisations/think tanks and 8.3% of companies/firms, stated that anonymized data should be excluded from the purview of data protection requirements.
• 1.9% of the stakeholders, comprising 6.3% of the industry associations, stated that anonymized data should not be excluded from the purview of data protection requirements.
• 1.9% of the stakeholders, comprising 8.3% of companies/firms, did not provide a clear stance on whether anonymized data should be excluded from the purview of data protection requirements.
• 81.1% of the stakeholders, comprising 75% of the industry associations, 70% of TSPs, 91.7% of civil society organisations/think tanks, 100% of individuals and 83.3% of companies/firms, did not comment on whether anonymized data should be excluded from the purview of data protection requirements.

Should there be provisions for judicial interventions and oversight for surveillance and lawful access to data?

• 22.6% of the stakeholders, comprising 37.5% of the industry associations, 20% of TSPs, 25% of civil society organisations/think tanks and 33.3% of individuals, stated that there should be provisions for judicial interventions and oversight for surveillance and lawful access to data.
• 1.9% of the stakeholders, comprising 6.3% of the industry associations, did not provide a clear stance on whether there should be provisions for judicial interventions and oversight for surveillance and lawful access to data.
• 75.5% of the stakeholders, comprising 56.3% of the industry associations, 80% of TSPs, 75% of civil society organisations/think tanks, 66.7% of individuals and 100% of companies/firms, did not comment on whether there should be provisions for judicial interventions and oversight for surveillance and lawful access to data.

Detailed Mapping of Responses

A detailed mapping of the responses of all the fifty-three (53) stakeholders, including the stances of the stakeholders, their response to question eleven (11) of the Consultation Paper and the suggestions they have made to the TRAI in view of the question, is available here.

[This post is authored by Varsha Rao, a fifth-year undergraduate student of NLU, Delhi under the supervision of Pushan Dwivedi (Associate, TRA) during her internship with TRA].