THE UNIVERSITY OF JAMMU

TOPIC OF ASSIGNMENT:
DATA PROTECTION : THE RIGHT
TO PRIVACY

SUBJECT:
IT APPLICATIONS IN
MANAGEMENT

SUBMITTED BY: HARSHIT MAHAJAN

ROLL NO. : 15
MRIDUL PAKHETRA
ROLL NO. : 25
Data Protection is the relationship between the collection and
dissemination of data, technology, the public expectation of privacy, and
the legal and political issues surrounding them.
Privacy concerns exist wherever personally identifiable information or
other sensitive information is collected, stored, used, and finally
destroyed or deleted – in digital form or otherwise. Improper or non-
existent disclosure control can be the root cause for privacy issues. Data
privacy issues may arise in response to information from a wide range of
sources, such as:

 Healthcare records
 Criminal justice investigations and proceedings
 Financial institutions and transactions
 Biological traits, such as genetic material
 Residence and Geographic records
 Privacy breach
 Location-based service and Geolocation
 Web surfing behavior or user preferences using persistent cookies
 Academic research
The challenge of data privacy is to utilize data while protecting an
individual's privacy preferences and their personally identifiable
information. The fields of computer security, data security,
and information security design and utilize software, hardware, and
human resources to address this issue. Since the laws and regulations
related to Privacy and Data Protection are constantly changing, it is
important to keep abreast of any changes in the law and to continually
reassess compliance with data privacy and security regulations.Within
academia, Institutional Review Boards function to assure that adequate
measures are taken to insure both the privacy and confidentiality of
human subjects in res

INFORMATION TYPES
Various types of personal information often come under privacy
concerns.
Internet
The ability to control the information one reveals about oneself over the
internet, and who can access that information, has become a growing
concern. These concerns include whether email can be stored or read by
third parties without consent, or whether third parties can continue to
track the websites that someone has visited. Another concern is if the
websites that are visited can collect, store, and possibly share personally
identifiable information about users.
The advent of various search engines and the use of data mining created
a capability for data about individuals to be collected and combined
from a wide variety of sources very easily. The FTC has provided a set
of guidelines that represent widely accepted concepts concerning fair
information practices in an electronic marketplace called the Fair
Information Practice Principles.
In order not to give away too much personal information, emails should
be encrypted. Browsing of web pages as well as other online activities
should be done trace-less via anonymizers, in case those are not trusted,
by open-source distributed anonymizers, so called mix nets, such
as I2P or Tor – The Onion Router.
Email isn't the only internet content with privacy concerns. In an age
where increasing amounts of information are going online, social
networking sites pose additional privacy challenges. People may be
tagged in photos or have valuable information exposed about themselves
either by choice or unexpectedly by others. Caution should be exercised
with what information is being posted, as social networks vary in what
they allow users to make private and what remains publicly
accessible. Without strong security settings in place and careful attention
to what remains public, a person can be profiled by searching for and
collecting disparate pieces of information, worst case leading to cases
of cyberstalking or reputational damage.
Cable television
This describes the ability to control what information one reveals about
oneself over cable television, and who can access that information. For
example, third parties can track IP TV programs someone has watched
at any given time. "The addition of any information in a broadcasting
stream is not required for an audience rating survey, additional devices
are not requested to be installed in the houses of viewers or listeners, and
without the necessity of their cooperations, audience ratings can be
automatically performed in real-time.”
Medical
People may not wish for their medical records to be revealed to others.
This may be because they have concern that it might affect their
insurance coverages or employment. Or, it may be because they would
not wish for others to know about any medical or psychological
conditions or treatments that would bring embarrassment upon
themselves. Revealing medical data could also reveal other details about
one's personal life. There are three major categories of medical privacy:
informational (the degree of control over personal information), physical
(the degree of physical inaccessibility to others), and psychological (the
extent to which the doctor respects patients’ cultural beliefs, inner
thoughts, values, feelings, and religious practices and allows them to
make personal decisions). Physicians and psychiatrists in many cultures
and countries have standards for doctor-patient relationships, which
include maintaining confidentiality. In some cases, the physician-patient
privilege is legally protected. These practices are in place to protect the
dignity of patients, and to ensure that patients will feel free to reveal
complete and accurate information required for them to receive the
correct treatment. To view the United States' laws on governing privacy
of private health information, see HIPAA and the HITECH Act.
Financial
Information about a person's financial transactions, including the amount
of assets, positions held in stocks or funds, outstanding debts, and
purchases can be sensitive. If criminals gain access to information such
as a person's accounts or credit card numbers, that person could become
the victim of fraud or identity theft. Information about a person's
purchases can reveal a great deal about that person's history, such as
places he/she has visited, whom he/she has contacted with, products
he/she has used, his/her activities and habits, or medications he/she has
used. In some cases, corporations may use this information to target
individuals with marketing customized towards those individual's
personal preferences, which that person may or may not approve.
Locational
As location tracking capabilities of mobile devices are advancing
(location-based services), problems related to user privacy arise.
Location data is among the most sensitive data currently being
collected.A list of potentially sensitive professional and personal
information that could be inferred about an individual knowing only his
mobility trace was published recently by the Electronic Frontier
Foundation. These include the movements of a competitor sales force,
attendance of a particular church or an individual's presence in a motel,
or at an abortion clinic. A recent MIT study by de Montjoye et al.
showed that four spatio-temporal points, approximate places and times,
are enough to uniquely identify 95% of 1.5 million people in a mobility
database. The study further shows that these constraints hold even when
the resolution of the dataset is low. Therefore, even coarse or blurred
datasets provide little anonymity.
Political
Political privacy has been a concern since voting systems emerged in
ancient times. The secret ballot is the simplest and most widespread
measure to ensure that political views are not known to anyone other
than the voters themselves—it is nearly universal in modern democracy,
and considered to be a basic right of citizenship. In fact, even where
other rights of privacy do not exist, this type of privacy very often does.
Educational
In the United Kingdom in 2012, the Education Secretary Michael
Gove described the National Pupil Database as a "rich dataset" whose
value could be "maximised" by making it more openly accessible,
including to private companies. Kelly Fiveash of The Register said that
this could mean "a child's school life including exam results, attendance,
teacher assessments and even characteristics" could be available, with
third-party organizations being responsible for anonymizing any
publications themselves, rather than the data being anonymized by the
government before being handed over. An example of a data request that
Gove indicated had been rejected in the past, but might be possible
under an improved version of privacy regulations, was for "analysis on
sexual exploitation."
 Key Principles
Individual Rights Are At The Center Of Privacy And
Data Protection
The law on privacy must empower an individual and advance their right
to privacy, as an individual and her rights are primary. The Code
furthers this principle in the following ways:
 The Code builds on the basis that privacy is a fundamental right and
that personal data should be handled fairly and lawfully.
 It looks at innovation from the perspective of user trust where it will
grow in a sustainable manner by creating frameworks for data
collectors and processors to handle resident's data.
 The Code provides individuals with certain Rights with respect to their
Data. These are:
 Right to Access: An individual has the right to access information on
what data of theirs has been collected, and how it has been handled.
 Right to Rectification: Individuals can correct and change data
collected about them.
 Right to Erasure And Destruction of Personal Data: Individuals can
request their personal data to be erased at any time.
 Right to Restriction Of Processing: An individual can stop their data
from being processed further.
 Right to Object: Individuals can object to the processing of their data in
a particular way.
 Right to Portability of Personal Data: Individuals can ask to receive
their personal data or for it to be transferred to another data collector.
 Right to Seek Exemption from Automated Decision-Making:
Individuals can opt-out from machine made decisions taken based on
their data, like profiling.
If an individual’s privacy is compromised and if this Act, which protects
privacy is not adhered to, the offender is liable to face punitive action
taken by Privacy Commissions and Surveillance Tribunals created
through this Act. These penalties can go up to fines of Rs 10 crore and a
five year jail term - for committing a cognisable and non-bailable
offence.

A Data Privacy Law Must Be Based On Privacy

Principles
User rights as identified by the report of the Justice AP Shah Committee
of Experts are essential to a data protection law. To protect user rights
 and in keeping with global data protection best practices, the following
provisions have been made in the Code:
 No individual’s data can be collected without intelligible consent and
without providing free of cost information on:
1. When the data will be collected.
2. The purpose of collection.
3. Its use.
4. Who it will be shared with.
5. How long it will be stored for and the practices and privacy policies
that will protect it.
6. The procedure that will be used to destroy the data and the safeguards
available to the citizen.
 Only providers of emergency medical services can use an individual’s
data without consent, to provide this medical service. Exceptions to the
consent rule cannot become the rule.
 All data collected prior to this Code coming into force, will be
destroyed within two years if consent as mandated by this Code is not
obtained.
 An individual’s data can only be used to fulfill the purpose it has been
shared for. After fulfilling this purpose, an individual’s data must be
destroyed or anonymised.
 Sensitive data like biometric data, DNA data, sexual preferences,
medical history and health information, political affiliation,
financial/credit data and membership of political, cultural, social
organisations, can’t be collected or disclosed without consent or kept
for longer than necessary.

A Strong Privacy Commission Must Be Created To

Enforce The Privacy Principles
To ensure that the data protection rights provided are kept intact, the
Code provides for the formation of a Privacy Commission, which will
uphold the rights of users and make regulations, to keep this Code
 current and timely with the evolution of technology. The key provisions
of the Privacy Commission are:
 The Privacy Commission is an autonomous body that can protect an
individual’s privacy by delivering judgements and investigating data
and privacy breaches.
 Its powers will be the same as those conferred upon a Civil Court. The
Commission can levy fines and carry out punitive action, to ensure the
effective implementation of this Act.
 The Commission can create new rules and regulations for data
protection, after consulting with experts and the general public.
 There will be a Central Privacy Commission and a Privacy
Commission for each state.
 While the Central Privacy Commission will deal with disputes between
two State Privacy Commissions, and cross border data flows, the State
Privacy Commission will take action on complaints of misuse of data
within the state.

The Government Should Respect User Privacy

As the body with the most power and information on the people of India,
the Government must protect an individual’s privacy. To this extent, the
Code provides:
 Essential services like Public Distribution System entitlements,
provision of medical care, social security benefits, employment under
MNREGA or any other service provided by the Government, cannot be
denied if an individual does not consent to the use of their data for
identification, or to avail the service and the service provider will at all
times accept any alternate ID.
 Any individual who is denied a service is entitled to damages. If an
alternate means of identification is available, and services are still
denied - then an individual will receive exemplary damages.
 The Code calls for an absolute bar on mass surveillance by an
organisation or Government, since mass surveillance is not necessary
 to ensure the distribution of welfare schemes or the maintaining public
order and security of the state.

A Complete Privacy Code Comes With Surveillance

Reform
Indiscriminate surveillance and interception requires to obey the rule of
law. To prevent and regulate surveillance and interception, the Code
suggests:
 No private entity can engage in surveillance, beyond surveillance of
their own property.
 The Code provides for the creation of a Surveillance and Interception
Review Tribunal. This tribunal will comprise of two or more sitting
High Court Judges of each State. This Tribunal will also appoint a
public advocate to represent individuals who have been wrongfully
surveilled or intercepted.
 After this Code is enacted, irrespective of any other law in force, no
surveillance or interception can be conducted by an authority without
the written permission of the Surveillance and Interception Review
Tribunal.
 Any surveillance conducted without permission will not be considered
as evidence in a Court of law.
 No order for surveillance or interception will be valid for more than 60
days (but can be extended if circumstances require), all data collected
during surveillance must be deleted 180 days after the surveillance
expires, until and unless it is required to be used as evidence in a court
of law or presents a threat to the country.
 An individual will be informed of surveillance conducted against them,
if the authorities cannot prove to the Tribunal why this information
should not be shared after surveillance is completed.
 The Right To Information Needs To Be Strengthened
And Protected
The protection of an individual’s privacy is in no way a
conflict with the Right To Information Act, which brings
accountability in government functioning.
Privacy protections which already exist under the Right to Information
Act need to be preserved. The Code makes the following safeguards for
the Right to Information:
 The right to privacy shall not be used to restrain the provisions of the
Right to Information Act.
 The proceedings of selection committees for State and Central Privacy
Commissions will be disclosed widely under the mandate of proactive
disclosure of the Right to Information Act.
 Nothing in the Indian Privacy Code can override provisions of the
Right to Information Act.

International Protections And Harmonisation To

Protect The Open Internet Use Must Be Incorporated
This Code in no way seeks to prevent the usage of the internet by but
seeks to draw a balance to protect users in India, whose data is gathered
by many global platforms who target services in India.
While seeking to preserve the global character of the internet it also
looks to ensure data security for Indian users. To this effect, this Code
puts forth the following provisions:
Data can be transferred outside India, if the Central Government and
Central Privacy Commission decide that the outside country where data
is being collected or stored has adequate data protection norms to meet
Indian standards.
Data protection is a complicated subject of regulation with a full
spectrum of measures required for effective enforcement. For a country
the size and scale of India, there is the additional issue of drafting a law
that will have to work well across different contexts. Some key issues of
contention will be how to effectively enforce a notice and consent
regime, what kind of positive obligations on data controllers are required
to aid informed consent, and how to build effective enforcement
mechanisms. It will be important to strike a delicate balance between a
bottom-up approach involving industry stakeholders, and effective
accountability and enforcement.