Women’s Day: Towards an Inclusive Personal Data Protection Bill

It is relevant to note that the discourse on data and privacy should be understood through the lens of gender.

Image used for representational purposes.

(Photo: iStock / Altered by The Quint)

There is global recognition that new technology and ever-evolving cyberspaces recreate societal problems which have historically affected women, children and people of marginalized groups.

United Nations bodies such as the Human Rights Council (UN HRC) and the General Assembly (UN GA) have emphasized the importance regarding the right to privacy in the digital age, and have called for preventive measures and remedies which protect against violation and abuse.

It is relevant to note that the discourse on data and privacy should be understood through a gendered lens — which is not restricted to cisgender/cissexual women, but includes people of different sexual orientations, gender and sexual identities, gender expressions and sex characteristics.

Similarly, the Yogyakarta Principles are a set of international principles adopted in 2006 which intersect international human rights law with violations suffered by people arising from sexual orientation and gender identity.

Right to Privacy in India

In India, a constitutional bench of nine Supreme Court judges in 2017 recognised the Right to Privacy as a fundamental right under Article 21, which guarantees right to life and liberty; part III of the Constitution which discusses fundamental rights.

While platforms for exercising privacy can be both online and offline, there is a need to deliberate on the ramifications of privacy violations which users of online spaces encounter.

Furthermore, citizens can find their private information involuntarily shared online, such as on websites of courts (the Karnataka High Court upheld the Right to Privacy in a father’s writ petition to remove digital records of his daughter’s case) and on search engines.

Although it is heartening to see high courts respect this fundamental right, it also is a matter of concern when women’s names are erased to uphold the notion of gendered expectations — where women and minorities have to hide their conduct from the public eye.

The Personal Data Protection Bill 2019

It is of significance that the Personal Data Protection Bill 2019 (PDP 2019) is more progressive in keeping transgender and intersex status separate (and even defines each uniquely) than the Transgender Persons (Protection of Rights) Act, 2019. The latter incorrectly conflates the two in clause 2 (k) of the Act where it provides the definition of a transgender person.

Regarding the PDP 2019, clause 3 (36) of the Bill lists the categories of sensitive personal data.

However, the language of the PDP 2019 omits transsexual people — the definition of intersex provided is “a data principal who is (i) a combination of male or female, (ii) neither wholly female nor wholly male or (iii) neither female or male”.

This wording misses the bus on transsexual people, some of whom might identify as either male or female. Hence, the PDP 2019 might not include a category of people because of its wording.

Difference Between Transsexual and Transgender

Though the definition of transgender people mentions surgery/medical procedures, it seems to make the same mistake as the Transgender Persons Act by circumscribing ‘transsexual’ within ‘transgender’ status. The nuance between gender and sexuality is often ignored by public policy, but it is at the stage before a bill becomes an act where civil society should intervene.

The distinction between transgender, transexual and intersex people must be clearly specified, especially on platforms which collect data around gender and sexuality. 

Explicit choices should be offered to people online, depending on their expression of gender and sexuality.

A transsexual person is one who physically decides to transition oneself, although there is a line of thought which suggests that trans-sexuality should not be restricted only to physical features.

Transgender identity is often used as an umbrella term, often marked by characteristics such as identity, expression and behaviour. West and Zimmerman summarise this by explaining that gender is performed, and sex is what we are born with.

Gendered expectations usually build upon the sex of the child, which is what the trans community seeks to challenge. In 2014, Facebook introduced 56 custom gender options (apart from male and female) which made users deliberate on the variation in gender/sexuality identity.

Steps Towards Inclusivity

In order to make the PDP 2019 a more accessible policy, another version of the Bill should explore gendered concerns around data collection, analysis, processing and storage at large.

This Bill concerns the rights regarding data of about 1.37 billion people — out of which it is estimated that digital literacy is improperly accessed by 90 percent, and suffice to say that women fare worse when it comes to accessing technology (given that there is clear gender disparity when it comes to internet usage in India — with the male and female break up at the all-India level at 67 percent and 33 percent, respectively).

India needs to adopt gender sensitisation programs for the envisaged Inquiry Officer under 53 (2) of the Bill, since they will have access to sensitive data and can ask another person to assist in performing duties of keeping books, registers, documents, records and any data in their custody.

Representation of women and minorities on the Data Protection Authority (DPA) would make a vast difference in checking biases whilst dealing with this data.

Exclusion of Women From Positions of Decision-Making

The fact that pronouns used across the Bill are masculine (‘his consent’, ‘his age, ‘his personal data’) is a reflection of the prejudice that non-male genders are not significant enough when discussing data rights.

The DPA could also set the tone for other regulators in India - it is worrying that as of February 2020, most of India’s major regulators (RBI, SEBI, NABARD, SIDBI, TRAI and IRDAI amongst others) are currently all men.

This speaks towards the larger pattern of exclusion of women from positions of decision-making, in a country where there are 3 sitting women judges out of a total of 33 (excluding the Chief Justice). Empathy towards gender bias and discrimination in the design of artificial intelligence is the need of the hour, which should not equate to token representation by simply placing women or minorities in the DPA.

In order to proceed towards a more equitable future, Indian society must reflect on the heavy social and economic price of digital exclusion which citizens pay, rippled across generations.

(Kazim Rizvi is Founder, The Dialogue, and Trisha Pande is Policy Manager, The Dialogue. This is an opinion piece and the views expressed above are the author’s own. The Quint neither endorses nor is responsible for the same.)