Personal data protection bill draft: Law enforcers won’t have to comply
The Information and Communication Technology Division has finalised the draft of the Personal Data Protection Bill and is preparing to place it before the cabinet for approval.
Although the draft formally recognises the average citizen's right to know what personal information is being collected about them and how the data will be used and stored, it exempts government agencies, including those enforcing laws, from having to comply.
"The ministry is gathering public opinion on the bill, following which there will be an inter-ministerial meeting, and then the bill will be placed before a cabinet meeting. We hope the bill will be placed in parliament for passage during the next session," Senior Secretary N M Zeaul Alam of the division told The Daily Star yesterday.
The ICT Division will be gathering public opinion on the draft until the end of next month, he said.
The draft carries fines of up to Tk 5 lakh for the illegal sale or transfer of personal data to third parties, as well as unauthorised collection or processing of the information.
It also states that if the personal data in question is "sensitive", like passwords, genetic information, biometric information, and information about sexual orientation, religious and political ideals, the fines can go up to Tk 10 lakh.
The director general of the Digital Security Agency is empowered by the draft to investigate violations, levy fines and ensure overall compliance with the proposed law. A Data Protection Office will also be set up to ensure the same.
The draft bill absolves certain agencies, including the law-enforcing ones, from compliance, ignoring critics who had been voicing concern over the matter ever since the draft was initiated.
The billgives all citizens the right to know when their data is being collected, how and for what purpose -- but it will not be applicable when agencies collect personal data for the prevention and detection of any offence, any investigation, or for "national security".
No definitions are provided in the draft explaining the context or when such an exception can be used.
This means, any person, being prosecuted under any law, no matter how minor the charges may be, will not have the right to data protection, according to critics.
Collecting personal data for any purpose other than these will require the consent of the individual in question, according to the draft bill.
Similarly, citizens will need to be notified before processing their data for any purpose – but no such notification will be necessary for the prevention or detection of any crime, for the purpose of investigations, or the apprehension or prosecution of offenders.
In addition, all citizens have a "right to be forgotten" or a right to have their data erased and destroyed, after use, to ensure that nobody holds such personal data for an indefinite period.
But this is not necessary for personal data that will be used for "public interest" or for compliance with legal obligations. Neither of these terms is defined in the draft.
Other than these grounds for exemptions, the draft also contains a provision that will allow the government to publish gazettes sparing certain actors from having to follow any provision of the law.
"The Data Protection Office can take any step or exercise any power over a data controller, data processor or representatives of them to provide necessary data for the purpose of this act," said Md Saimum Reza Talukder, an advocate who specialises in law, privacy and digital technologies.
A data controller is defined as the person responsible for collecting or processing (or supervising the processing) of personal data.
The draft also says that the DG and the staff of the data protection office cannot be prosecuted for misuses of the law, if the violations were done in "good faith".
"Section 66 provides broad immunity to the DG and the staff of the Data Protection Office from criminal and civil liability if they do something in good faith. Such provisions are against the spirit of Article 27 of our constitution which gives all citizens equality before the law," said Talukder.
"It can be said that all of these might create scopes to abuse this act by government officials if checks and balances are not maintained during the review process and oversight by the civil society," he added.