Har Ghar Tiranga selfies may trigger privacy concerns

New Delhi: On Independence Day, for the third consecutive year, millions of Indians will upload their selfies with the national flag on the government website ‘Har Ghar Tiranga’. But, according to experts, the collective act of digitally bowing to the tricolour flag may raise concerns over data privacy.

Users, once they share their photos, will allow the Ministry of Culture to collect a wide range of their personal data, according to the privacy policy of the Har Ghar Tiranga website. This includes: “User and username, password, email address, name, address, service address, destination, age, date of birth, gender, nationality, browsing history, etc., as well as any images or other information uploaded/sent by the user to the website.”

The government will also be able to track users’ IP addresses, the website they came from and the website they accessed after using the platform, the privacy policy said. Users automatically consent to sharing all such data when they visit the website, it said.

This type of data collection is not illegal under the current Information Technology Act, but experts say it can violate the new Digital Personal Data Protection Act, provided it is notified, especially a provision requiring the collection of as little personal information as possible for a specific purpose.

Stock Market Holiday: Will Indian Stock Market be closed on Independence Day 2024?

The government should clarify the purpose for which it will use the data collected in the campaign, said Justice Sanjay Kishan Kaul, a former Supreme Court judge. “There may be people who want to wave the national flag but not share photos of it. There should be a statement on what this information will be used for, so that people uploading their photos take a ‘considered’ decision.”

The privacy debate is heightened by the number of people taking part in the Har Ghar Tiranga campaign backed by Prime Minister Narendra Modi. Last year, 100 million Indians uploaded selfies to the website, up 66% from 60 million the year before, according to the ministry’s statement on August 8.

“The collection of data under Har Ghar Tiranga’s privacy policy seems “excessive,” said Rishabh Gandhi, managing partner at Rishabh Gandhi and Advocates, a Pune-based law firm. “A layman may not want his or her images or browsing history collected and shared if it is not necessary for the campaign.”

To be sure, the government collects data from citizens for everything from surveillance to policymaking. For instance, Information and Broadcasting Minister Ashwini Vaishnaw explained at a recent press conference how authorities use data from e-invoices and FASTag receipts to understand and resolve traffic jams.

Queries sent via email to the Ministry of Culture and the Prime Minister’s Office (PMO) on Friday, August 9, remained unanswered as of the time of publication.

Data collection will not be considered a violation.

Data collection under the Ministry’s campaign will not be considered a violation of the Information Technology Act along with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, also known as SPDI Rules, provided the privacy policy is in line with legal requirements, said Shreya Suri, Partner, INDUSLAW.

But it will not be valid under the DPDP Act when it comes into force unless the campaign “is exempted under Section 17(2) of the DPDP Act in the interest of sovereignty and integrity of India, security of the state, friendly relations with foreign states, maintenance of public order or prevention of incitement to any cognizable offence relating to any of these,” said Suri, who specializes in technology law.

The DPDP Act received Presidential assent a year ago, but the government is yet to notify the rules.

The Har Ghar Tiranga campaign could potentially violate this principle of data minimisation under the new law, said Gandhi of Rishabh Gandhi and Advocates.

According to Deepak Maheshwari, a Delhi-based technology public policy consultant, the government needs to specify the purpose of each data point it collects under the DPDP Act. “For example, the government needs to explain what it means to collect ‘target’ data. Also, we need to look at what data the government will collect on a mandatory basis and what is optional.”

Maheshwari said that since data collection will be an issue under the GDPR Act, a roadmap for the rules to be enforced under the Act should be specified. “When GDPR (the European Union’s data privacy law) came into effect, people knew exactly when they would have to start complying with it.”

Data collection under the Har Ghar Tiranga campaign may also go beyond the ambit of the Supreme Court’s landmark verdict in Justice KS Puttaswamy v. Union of India in 2017, which declared the right to privacy as a fundamental right, constitutional law experts said.

“If the Har Ghar Tiranga website collects data like nationality, age, sex, etc., it can amount to profiling, which violates the Puttaswamy judgment,” said Nitish Nawsagaray, associate professor at ILS Law School, Pune. “Even if I give my data voluntarily and the data I have with the state is used for some purpose that I have not been informed about, then the consent they are asking me for is not informed consent.”

However, former Additional Solicitor General Sanjay Jain does not believe that such data collection violates the DPDP Act as it allows the government to share the collected information with law enforcement agencies or if it believes the data relates to any legal process.

But even Jain advises keeping data collection to a minimum. “It cannot be ignored that it is imperative for the ministry to minimise data collection of citizens and put in place adequate safeguards before launching such a campaign,” he said. “It is the duty of the ministry and the official campaign portal to delete personal data of users once the campaign is over.”