Digital ID Act Sparks Nationwide Privacy Fury, Federalism Concerns Mount

New Delhi, Delhi — A contentious proposal to centralise India's burgeoning digital identity ecosystem and streamline data governance has ignited a furious nationwide debate, with critics lambasting the potential for state surveillance, infringement on individual privacy, and a significant overreach into states' autonomy.

The recently unveiled draft of the National Digital ID and Data Governance Act, 2024, aims to consolidate various digital identity databases and mandate data sharing across government departments for public service delivery and security, but has immediately drawn sharp lines of opposition from civil liberties organisations, several state governments, and opposition parties who warn of an impending 'surveillance state'.

Key points

* The proposed National Digital ID and Data Governance Act, 2024, seeks to create a unified digital identity framework and mandate data sharing across government bodies.

* Civil society organisations and privacy advocates express grave concerns over the Act's potential for mass surveillance and the erosion of individual data privacy rights.

* Several non-NDA ruled state governments have voiced strong objections, citing infringements on state autonomy and principles of cooperative federalism.

* The Union government defends the Act as crucial for efficient public service delivery, national security, and combating fraud, asserting robust safeguards are built in.

* Calls are mounting for the bill to be referred to a joint parliamentary committee for comprehensive review and extensive stakeholder consultation before proceeding.

Reported details indicate that the draft Act, currently under public consultation for a truncated period, proposes a single 'National Digital ID' linked to all existing and future government-issued identities, including Aadhaar, PAN, and voter IDs.

It grants the Union government sweeping powers to access, share, and process citizen data across various ministries and state departments, ostensibly for 'public interest' and 'national security'.

A particularly contentious clause mandates the automatic sharing of data between central and state agencies without requiring explicit individual consent in specified circumstances, drawing parallels to global state surveillance frameworks.

Furthermore, it proposes the establishment of a 'National Data Management Authority' with significant powers, potentially overshadowing existing state-level data initiatives.

Legal experts point out that while the Act includes provisions for data protection, the broad exemptions for government agencies and the lack of robust independent oversight mechanisms are significant loopholes. “The proposed architecture creates an undeniable pathway for a comprehensive state-managed profile of every citizen, which, in the absence of stringent checks and balances, can be severely misused,” stated Mr.

Alok Rastogi, a Senior Advocate specialising in constitutional law, speaking from New Delhi. “The current draft offers insufficient protection against arbitrary data collection and a clear path for individuals to seek redress for privacy violations is conspicuously absent.”

Opposition parties have been quick to pounce on the government's proposal. “This isn't about Digital India; this is about a Digital Dictatorship,” charged Mr.

Ramesh Sharma, a prominent Member of Parliament from a leading opposition party, addressing a press conference in Mumbai. “The government is systematically dismantling every democratic safeguard, and now they want to own our data, our lives.

This is an assault on our fundamental rights and an affront to the federal structure of our nation.” He further added that his party would launch a nationwide campaign to oppose the bill in its current form.

From the southern states, a powerful voice of dissent emerged. “This Act is a blatant attempt by the Centre to encroach upon the powers of state governments and centralise control over citizen data, which rightfully falls under our jurisdiction in many spheres,” asserted Dr.

Priya Sunderajan, Minister for Information Technology in a non-NDA ruled state, during an exclusive interview with Toofan Express. “We have our own robust data management policies and systems.

This Act seeks to undermine them, creating a parallel system that compromises state autonomy and could lead to significant data security vulnerabilities if not managed locally.”

Industry bodies, while generally supportive of digitisation, have also expressed reservations. “While the intent to streamline digital services is commendable, the current draft lacks crucial clarity on data minimisation principles, anonymisation standards, and a transparent framework for cross-border data flows,” observed Ms.

Anjali Verma, President of the Indian Digital Industry Council (IDIC). “Unclear guidelines could create a significant compliance burden for businesses and stifle innovation, especially for startups operating with sensitive user data.

A more collaborative approach with industry stakeholders is essential to ensure the Act fosters, rather than hinders, the digital economy.”

The Union Minister for Electronics and Information Technology, Mr.

Rajeev Shukla, however, remained steadfast in his defence of the proposed legislation.

Addressing reporters in New Delhi, he stated, “The National Digital ID and Data Governance Act is a visionary piece of legislation designed to catapult India into a new era of transparent, efficient, and secure governance.

We are building a system that will deliver services to every citizen, combat fraud, and bolster national security.

Robust safeguards, including stringent data encryption protocols and multi-layered access controls, are embedded within the framework.

Concerns about surveillance are entirely misplaced and are being propagated by those who oppose progress.” He cited that over 1.3 billion Aadhaar numbers have been issued, demonstrating public acceptance of digital identity, and that the new Act aims to build upon this trust while addressing emerging challenges in data security and governance.

Official estimates project that by consolidating digital IDs, the government anticipates saving approximately ₹5,000 crores annually through reduced duplication and enhanced service delivery efficiency across various welfare schemes.

Background

India has been on an accelerated path of digital transformation for over a decade, epitomised by the Aadhaar programme, the world's largest biometric identity system.

This push for ‘Digital India’ has seen the proliferation of various digital public goods, from payment interfaces like UPI to various online government services.

However, this rapid digitisation has also brought to the forefront significant challenges related to data privacy, data security, and the lack of a comprehensive legal framework for data governance.

Previous attempts to introduce a robust data protection law have faced multiple revisions and delays.

The current Act is seen by some as an attempt to consolidate various data-related initiatives and provide a legal backbone for the sprawling digital ecosystem, particularly in the wake of the Supreme Court's landmark 2017 ruling affirming privacy as a fundamental right.

Critics argue that despite this ruling, subsequent legislative efforts have often fallen short of its spirit, particularly regarding state access to personal data.

What it means

The National Digital ID and Data Governance Act, if passed in its current form, could fundamentally reshape the relationship between the Indian state and its citizens.

For individuals, it could mean a more seamless, albeit potentially less private, interaction with government services, with personal data being more readily shared across departments.

The consolidation of digital identities carries the promise of reducing bureaucratic hurdles and improving last-mile delivery of welfare schemes, but it simultaneously magnifies the risks associated with data breaches and unauthorised access, potentially exposing citizens to identity theft and exploitation on an unprecedented scale.

For state governments, it signals a potential erosion of their authority over data management within their own jurisdictions, fostering a more centralised model of governance that could strain cooperative federalism.

For businesses, while it might standardise some data practices, the compliance burden and the lack of clear demarcation between public and private data usage could create an uncertain regulatory environment.

The Act also holds profound implications for India's geopolitical standing as a rising digital power, with its data governance framework being closely watched by international human rights organisations and trade partners.

Reactions

Reactions have been sharp and multifaceted.

Beyond parliamentary opposition, a coalition of over 150 civil society organisations, including the Internet Freedom Foundation and Article 19, has launched the 'SecureOurData' campaign, organising public forums, online petitions, and legal awareness workshops across major cities like Bengaluru, Chennai, and Kolkata.

Their petition, urging the government to withdraw the current draft and initiate a truly consultative process, has garnered over 200,000 signatures in less than a week.

Legal experts from various think tanks have also submitted detailed critiques to the Ministry of Electronics and Information Technology, highlighting constitutional infirmities and proposing specific amendments to strengthen privacy protections.

Meanwhile, industry associations, while engaging in closed-door consultations, have publicly called for extended deliberation periods and greater clarity on implementation challenges.

International bodies like the UN Special Rapporteur on the Right to Privacy have also issued a statement urging India to ensure its data governance framework aligns with international human rights standards.

What happens next

The immediate future of the National Digital ID and Data Governance Act hinges on the government's response to the widespread pushback.

Given the intensity of the opposition, it is highly probable that the bill will be referred to a Joint Parliamentary Committee for detailed scrutiny, a process that could see significant amendments proposed.

Public consultations, though initially brief, might be extended under pressure, allowing more time for stakeholders to provide feedback.

Civil society groups are gearing up for sustained advocacy and potential legal challenges, potentially leading to Supreme Court intervention if the final legislation is perceived to violate fundamental rights.

The government, keen to advance its digital agenda, will need to navigate a delicate balance between pushing its reforms and addressing legitimate concerns to avoid protracted legal battles and widespread public discontent, especially with upcoming state elections.

The coming months are expected to witness intense political maneuvering and public discourse surrounding the future of digital identity and data governance in India.