Understanding the Data Protection White Paper Part VIII: Ensuring data quality and the rights of access and rectification

Understanding the Data Protection White Paper Part VIII: Ensuring data quality and the rights of access and rectification

This article is Part 8 of a multi-part series explaining the recently issued white paper on data protection in India. The responses to the white paper will help in the formulation of India’s future data protection laws. You can read Part 1, Part 2, Part 3, Part 4, Part 5, Part 6 and Part 7.

For the protection of data, it isn’t enough to ensure that the data controller has collected data with the people’s consent, or that the use of the data is legitimate. It is equally important to ensure that the quality of the data in the possession of the controller is maintained. For this, a data protection law imposes obligations on entities in the form of privacy principles of storage limitation and data quality. Along with these, people can also play their part, in the form of rights to access and rectification.

Digital data storageDigital data storage

Storage limitation

The principle of storage limitation imposes restrictions on the amount of data that is stored with a data controller. This is also closely linked to the purpose specification principle, that was discussed previously in Part 6 of this series. This principle ensures a limit on the data collected, and therefore subsequently stored, for the purpose specified.

Another aspect of this principle is the limit on the time for which this data is stored. Most data protection laws impose such restrictions. The Indian IT laws also often contain such restrictions, such as the requirement under the IT (Safeguards for Interception and Monitoring) Rules, 2009, to destroy interception and monitoring records within 6 months. This is an important rule, given practices like widespread surveillance, databanks like the CIDR, data broking and data analytics.

Data quality

Along with limiting the amount of data stored by the data controller, it is also important to ensure that the data that is stored, is accurate. This data is, after all, used for making key decisions on the individual in future. For example, consider the practice of credit scoring, which uses the data on an individual in the possession of financial institutions to determine if they are eligible for facilities like loans, and the impact of an error in this data. Alternative credit scoring using data from new financial technology, such as mobile wallets, payment banks or small finance banks, has also become popular, demonstrating the importance of ensuring data quality with even smaller institutions.

Individual participation rights

Under data protection laws, individuals have been given a set of rights known as individual participation rights. These have been given to ensure greater participation of an individual with the decision-making process involving his or her data, beyond the basic granting of consent.

Together, these are considered to be among the most important safeguards for an individual, since they allow the processing of your data to be transparent to you, and allow you to influence the manner in which it is used. For data quality, the rights of access, confirmation and rectification play a crucial role.

Right to Access and Confirmation

This is the right of an individual to gain access to the data that an entity has on him, and the right to confirm whether his personal data is being processed by that entity. This includes the right to access information on the types of data being processed, the purpose for which it is being processed, who receives his data, etc. This right is crucial considering the myriad uses to which data is being put these days, as seen in Part 6 of this series on big data.

However, this right is also typically subject to certain restrictions, such as when granting access to the data is cost prohibitive for the entity or the disclosure can threaten the life or privacy of another. Data that is crucial to an organisation, such as trade secrets, will also be restricted. Care must be taken in framing these to ensure that the exercise of the right remains relevant despite the restrictions.

Right to Rectification

This is a right to rectify the data that the entity has on him. If the data is inaccurate, irrelevant, not up-to-date or excessive, the individual can approach the entity or the courts to have the data erased, modified or rectified. Another important aspect of this right is that it allows people to get data which an organisation is no longer authorised to hold, such as by exceeding the time limits for storage, removed.

Challenges with implementation

Apart from granting these rights, it is also important to take into account the practical challenges with implementation. The suitability of these rights, the extent to which they should be granted and the restrictions to them are factors that need to be taken into consideration.

Moreover, methods need to be devised to allow these rights to be exercised without overburdening the entities involved. Considering India’s huge start-up sector and small businesses, this is a factor that needs to be considered. At the same time, neither should people’s privacy be put at risk by allowing data collection yet reducing obligations.

One solution is to make the two proportional to each other, i.e., determining different levels of obligations for different levels of data collection. The extent of use by an entity would be determined by their ability to adhere to a certain level of obligations.

Some of the key challenges are as follows:

Cost: Cost is one of the key issues with implementation of these rights. While the fees charged for an access and rectification request is minimal, it could cost the data controller, for example in the UK, anywhere between £50-550, depending on the sector. This cost may be difficult for smaller enterprises to bear. Frivolous requests only add to the burden of the data controller.

Technical: Another challenge is the technical aspect of handling the volumes of data in the possession of the data controller. For example, consider data like e-mails, where a single organisation may have millions of e-mails containing data on individuals. The same issue applies to governmental organisations as well.

Automated decisions: A number of decisions based on data are being taken using automated decision making, which uses a logical algorithm, and involves no human intervention. Access to the logic behind these decisions is one of the rights provided in the EU, but it is being argued that this is not enough to protect individuals from the outcome of automated decisions. For example, while explaining why a credit card application was rejected, a person may be told that his credit history, age and postcode was taken into account. The actual reason for rejection, or the logic behind the automated decision, may go unspecified, since its revelation may be restricted due to reasons like protecting trade secrets.

Limited exercise of rights: A very limited exercise of rights has been found in other jurisdictions. This may be because people are unaware of their rights or because they are unaware of the consequences of handing their personal data over to an organisation.

Key questions raised in the White Paper

Provisionally, the White Paper is in support of the inclusion of these rights and obligations for ensuring data quality, subject to their streamlining in the Indian context. It has presently sought comments on the following key questions with respect to ensuring the quality of data and the rights to access and correction:

What are your views on the principles of data quality and storage limitation?

On whom should the primary onus of ensuring the accuracy of this data lie?

What time-limits should be prescribed for storing data? Thereafter should the data be erased or anonymised?

Should there be a one-size-fits-all kind of regulation?

What are your views on the individual participation rights to be granted?

What exceptions should be granted?

What restrictions should be imposed on the right to access information? What is the scope of the right to rectify? Should a fee be imposed?

Should access to the logic behind automated decisions be granted?

Should a time limit be fixed for responding to these requests?

Any other views?

Part I of the series explores the definitions of personal data and sensitive personal data, Part II of the series examines the jurisdiction and territorial scope of data protection laws, Part III of the series explores cross-border data flows and data localisation, Part IV deals with exemptions to data protection law, Part V deals with notice and consent, Part VI deals with the big data challenge to privacy principles, and Part VII deals with processing of sensitive personal data.

The author is a lawyer and author specialising in technology laws. She is also a certified information privacy professional.

General Electric to shed 12,000 jobs

General Electric to shed 12,000 jobs

General Electric is to cut 12,000 jobs in its power business, 18% of the division's global workforce.

The US industrial group expects the "painful but necessary" job losses to help save $1bn next year as demand for fossil fuel power plants wanes.

GE intends to cut 1,100 jobs from its UK power business, mainly in Stafford and Rugby.

Elsewhere, one-third of the firm's Swiss workforce and one-sixth of German workers are likely to be hit.

Firm's 1,100 job cuts are 'major blow'

The reduction in jobs is part of a restructuring by new GE chief executive John Flannery, who took over in August from his veteran predecessor Jeff Immelt.

"Traditional power markets including gas and coal have softened," the company said.

In October, GE slashed its profits guidance after posting a 5% fall in third-quarter earnings to $1.8bn, due to weak trading in its power and oil and gas businesses.

GE Power is the company's largest industrial business, employing more than 55,000 people worldwide.

It makes turbines, generators and other kinds of plant equipment.

German union leaders denounced the cuts and said they would fight to preserve jobs.

Klaus Stein, the representative of the IG Metall union at GE's plant in Mannheim, said the announcement was "neither strategically nor economically justifiable" and served only to maximise short-term profit for shareholders.

'Simpler and stronger'

Russell Stokes, president and chief executive of GE Power, said: "This decision was painful but necessary for GE Power to respond to the disruption in the power market, which is driving significantly lower volumes in products and services.

"This plan will make us simpler and stronger, so we can drive more value for our customers and investors."

The boss of GE's UK and Ireland operations, Mark Elborne, said the firm remained committed to the UK and would remain one of the country's top five industrial companies.

He said: "These are not proposals we ever make lightly and we understand that this news will be difficult for many people.

"Unfortunately, we believe that these changes are necessary to ensure that we can remain competitive and secure the future of GE Power in the UK.

"We have shared our proposals with employees' representatives today and will now begin a consultation period before any final decisions are made."

What's behind the N Korean 'ghost ships' washing up in Japan?

What's behind the N Korean 'ghost ships' washing up in Japan?

Mysterious "ghost ships" have been washing up on the western shores of Japan over the few past years, thought to be fishing vessels from North Korea.

Many of the ships have only dead bodies or skeletons on board but in recent months, several have been found with their desperate North Korean crew still alive.

What are these 'ghost ships'?

They are called ghost ships because they are usually found empty or with only corpses on board off Japan's western coast.

In 2017 though, a number of ships have washed ashore with the crew still alive.

In November, eight men were found alive on a boat at Yurihonjo marina. They said they were fishermen from North Korea who had gotten into trouble at sea.

Another ship picked up by the Japanese coast guard was found to have 10 men on board.

The boats are often rickety and very simple vessels with no modern engines or navigation instruments on board.

Where are they from?

With most of the boats washing up empty or only with dead bodies, it was initially not clear where they had come from but some observers speculated they were North Korean fishing boats that had been searching for king crab, squid and sandfish.

Markings on some of the vessels, in Korean, indicated that they belonged to the North's military which is heavily involved in the fishing industry.

In the recent cases where boats were found with the crew still alive, the sailors confirmed they were from North Korea. One of the boats rescued in November also had a plaque indicating it belonged to the military.

Unsurprisingly, there has been no mention of the missing vessels from North Korea.

How did those on board die?

When boats with corpses wash ashore, Japanese officials usually try to investigate the cause of death. But as they tend to be in an advanced state of decomposition it is often impossible to determine that.

During the winter months and with little food on board, exposure and starvation are the most likely explanations for their deaths.

The wooden boats washed up are old and heavy and have neither powerful modern engines nor GPS navigation systems.

If they ventured too far out or got blown off course, they would lose their bearings or find it hard to beat the currents even if they knew which way to go.

According to news agency AFP, 2017 has seen a record number of North Korean fishermen rescued alive with more than 40 arriving so far this year.

Are they defectors? Or spies?

It has been suggested the sailors could be defectors trying to make it across the Sea of Japan to escape the regime in Pyongyang.

But the crews found alive have asked to be sent back to North Korea.

Also, taking the route all the way to Japan is significantly further and more dangerous than trying to sail to South Korea.

The speculation they might be spies is also thought to be unlikely. Despite a few sailors rescued alive, most of the boats still wash up empty or with the men dead.

The crews found alive in November was thought to have looted a small shelter off the coast of Japan before they were picked up by the coast guard.

The shelter for Japanese boats in distress was found broken into with appliances missing, including a rice cooker and a television. When the North Koreans were later spotted by the coast guard they appeared to hastily dump these items off their vessel, local media reported.

According to Japanese media, the sailors later admitted they had been stealing the missing equipment from the refuge hut.

Why would fishermen take this risk?

With international sanctions tightening due to Pyongyang's nuclear and missile tests, the regime is under pressure to boost agriculture and food supplies.

One hypothesis posed by Japanese media is that the North Korean leadership is demanding bigger catches and sailors are being forced to take chances to meet those targets.

What might be making the situation worse is that North Korea sold the fishing rights in some of its territorial waters to China last year. That means a smaller area for local fishermen to fish in and hence they might be having to venture further out in search for fish.

Profit-seeking has been suggested as another possible incentive to take such risks

It is common in North Korea for workers to keep some of the surplus they generate past the targets set by the state. This quasi-capitalist system has been credited with improving production, analysts say.

But this promise of some private surplus is also thought to drive people to take greater risks to improve their situation - which could well include taking desperate chances at sea.

Vijay Mallya to return to UK Court tomorrow as extradition trial gets underway

London: Embattled liquor baron Vijay Mallya, out on a 6,50,000-pound bail bond following his arrest by Scotland Yard over fraud and money laundering charges earlier in 2017, will return to Westminster Magistrates' Court in London on Monday as his extradition trial begins.

The 61-year-old businessman, who has been in self-imposed exile in the UK since March 2016 when he left India, is wanted in India on charges relating to his defunct Kingfisher Airlines defaulting on loans from various Indian banks amounting to Rs 9,000 crore.

The former Rajya Sabha member has told PTI during his numerous court appearances in London over the last few months that he has "done nothing wrong" and described the allegations against him as "fabricated".

His defence team, led by barrister Clare Montgomery known as an expert in criminal and fraud law with the UK’s Matrix Chambers, will now present his case in court.

"We are keen to draw a line under all the material – evidential and non-evidential," she had said during the last case management hearing on 20 November, when Mallya's defence team presented a running order of expert witnesses to be deposed in the case.

The trial is set to open with opening arguments, followed by the witness statement of Dr B Humphreys, who is an aviation expert.

Others expected to give their statements for the defence include Margaret Sweeney, chief accountant at Force India Formula One racing team, Professor Lau as an expert on the Indian legal system, and Dr Alan Mitchell, a licensed medical practitioner and a former medical officer with the Scottish prison system.

It was Dr Mitchell’s testimony that had a major impact on another Indian extradition request in October, that of alleged bookie Sanjeev Chawla – a key accused in the cricket match -fixing scandal involving former South African captain Hanse Cronje in 2000.

That request was rejected after a trial at Westminster Magistrates' Court on the grounds that Chawla's human rights would be violated in Delhi's Tihar Jail under Section 87, Article 3 relating to "prohibition of torture, or inhuman or degrading treatment". The Indian government has sought permission to appeal against the decision in the UK High Court.

At a previous hearing in the Mallya case, Chief Magistrate Emma Louise Arbuthnot had also highlighted prison conditions as a concern that has been "raised in extraditions to India before".

The Crown Prosecution Service (CPS), arguing on behalf of the Indian government, had told her that the Indian authorities have foreseen this as an issue and have been "engaged on the matter".

The CPS team, led by barrister Mark Summers who specialises in extradition cases, highlighted "excellent cooperation with the Indian authorities", who had provided detailed assurances and photographs by email relating to prison conditions where Mallya is to be held if he were to be extradited to India.

The extradition trial itself, to be presided over by Judge Arbuthnot, is listed for hearings until 14 December, with 6 and 8 December so far marked as non-sitting days. A judgement in the case is not expected until early 2018.

If the judge rules in favour of extradition at the end of the trial, UK home secretary Amber Rudd must order Mallya's extradition within two months. However, the case can go through a series of court appeals before the actual extradition order can be issued.

"The Crown Prosecution Service, acting on behalf of the Indian authorities, will need to demonstrate a prima facie case, ie produce some evidence to show that the criminal charges against Mallya, for which his extradition is sought, are justified," explains Jasvinder Nakhwal, partner at Peters and Peters Solicitors LLP.

India and the UK have an Extradition Treaty dating back to 1992 but so far only one extradition has taken place from the UK to India under the arrangement — that of Samirbhai Vinubhai Patel wanted in connection with the post-Godhra riots of 2002. But, unlike Mallya, he had submitted to the extradition order without a legal challenge.

Mallya, who has been based at his Hertfordshire estate called Ladywalk in the village of Tewin, around 30 miles from London, had responded with a firm "no" on being formally asked in court if he consented to being extradited to India on the charges relating to his collapsed Kingfisher Airlines.

His extradition trial will now determine whether he can be legally forced to go back to face the Indian courts.