Comment by signal11 | Hacker News Reader

Comment by signal11 | Hacker News Reader

Parent Full thread

As background, to set the scene for what the state of privacy is in India: India has no privacy legislation, and selling datasets seems to be a popular informal activity[1]. (That article is worth a read in its entirety.)

It’s not unusual for shops to demand a telephone number during even small purchases, and your number will be spammed with SMS ads shortly thereafter. Also email spam if they somehow get your email.

Chat archives (possibly backups?) of people under investigation have been leaked to the media with no consequence to the leaker.

Essentially it’s an extreme “laissez-faire” environment, one almost out of a textbook example of what happens in the absence of any regulation whatsoever.

The above doesn’t have anything to do with Facebook or WhatsApp (except tangentially), it’s just to note that privacy legislation would be a very helpful quality of life improvement for many Indians.

Perhaps someone on HN who knows more about this can share why the efforts to have privacy legislation in India have so far been unsuccessful.

[1] https://restofworld.org/2020/all-the-data-fit-to-sell/

The Supreme Court of India declared the right to privacy a fundamental right under Article 21 - as the same level as right to life and personal liberty. https://www.eff.org/deeplinks/2017/08/indias-supreme-court-u...

This ruling was one the the landmark rulings in recent times, and a true David vs Goliath story - where a small group of privacy activists won against mandatory Aadhaar.

While it is true that right to privacy implementation remains patchy, there is growing awareness around privacy - both from government, and against large corporations. For example, half of my contact list is now on Signal and last week I had more chats on Signal than on WA.

Due to the lack of legislation, the data broker market operates freely without any repercussions. Deleting your data from a website which publicly displays your private information is a nightmare and often unsuccessful.

On that note, a pro tip for anyone incorporating a company in India. Give a separate email id, phone number when you incorporate because as soon as its available on the MCA(Ministry of Corporate Affairs) database the brokers buy it for (~ INR 100/ ~1.37 USD) legally and put it out for sale to the spammers/scammers often displaying the email id publicly.

It will feel intuitive to give your personal phone, email in the forms when starting a company but you'll regret it. I'm waiting for the Data-Privacy legislation to be passed, so I can sue the X out of these brokers; Until then I'm creating an account with these brokers to delete my own details and if not possible then updating it with fake data.

I came across this article yesterday: https://tigerfeathers.substack.com/p/the-internet-country

In section titled "Part 3: Becoming Data Rich" of the above article, they talk about the privacy protection legislations that are going to be implemented in India. Adding the part that caught my attention below:

___

Data Empowerment and Protection Architecture (DEPA) is a policy framework that defines how the economic primitive of data can be freed up so that individuals and businesses can choose how to best protect it and use it for their own gain. This innovation, which is presently being rolled out in the financial services industry, has its philosophical roots in a piece of impending legislation known as the Personal Data Protection Bill (PDP).

According to this bill, Indians will (for the first time) get a litany of new rights pertaining to their data. Specifically, they will get the following rights:

The right to data confirmation: The right to know what data is being stored about them, how it has been processed, and who else it might have been shared with

The right to data correction or erasure: The right to update their data stored with a service provider, in order to make corrections, edits, and omissions of data that is no longer relevant

The right to be forgotten: The right to have their data deleted from a service provider’s database should they withdraw their consent to its continued storage

The right to data portability: The right to obtain and share their data in a structured and machine-readable format

There is Personal Data Protection Bill in work: https://en.m.wikipedia.org/wiki/Personal_Data_Protection_Bil...

It exempts government and give them more power over data held by the private companies in later amendments.

Proper enforcement capacity is also needed otherwise it will be abused to selectively target companies and startups but make little difference in privacy.

Most Indians are not rich enough to afford paying for multiple software subscriptions monthly. They give away privacy as a substitute for that. Market forces at play.

That bill is seriously hard to comply with. It's like GDPR but more stringent and there are data import / export mandates on top.

Whenever that rule gets passed it's going to put a real squeeze on a lot of mid-large sized companies that have been playing fast and loose for a while. Facebook would definitely be violating many different parts of the law

Indian here There are some privacy laws, and some cyber-crime laws, but basically no one cares enough about those to implement them. I feel this is not an india only problem but with many developing nations as most people literally do not care... Also I have not been bombarded by spam except through SMS, but that's not a big problem either as no one uses SMS anymore

Ah india also has anti piracy laws but that's a story for another time

Incidentally, it's weird to me how we lack internet laws in a lot of aspects yet have strong IT laws when it comes to blocking and censoring websites when needed (eg. porn¹)

[1] https://internetfreedom.in/why-is-porn-being-blocked-in-indi...

Reply on news.ycombinator.com