Central Government invites suggestions on the manner of uploading RTI replies and FAA orders on website in a legal vacuum about personal data protection
04 April, 2016
By Venkatesh Nayak
In its OM dated 23/03/2016, the Department of Personnel & Training, Government of India has invited people to send their suggestions on the manner of disclosure of RTI applications and first appeals received and the responses of the Public Information Officers (PIOs) and First Appellate Authorities (FAAs), respectively on their official website. The deadline for submission of suggestions is 07/04/2016.
Before arriving at any opinion on the issue raised in the OM, it is important to look at the practice of Information Commissions regarding disclosure of the identity of the appellant and complainants who approach them.
The Practice across Information Commissions
A snapshot view of the practice in the Information Commissions established across the country is given below:
The practice is not uniform within the Central Information Commission (CIC). The orders issued by 6 members of the CIC disclose the name and the postal address of the RTI Appellants. In some cases even the name of the father of the RTI Appellant is mentioned. For example see:
1) http://www.rti.india.gov.
2) http://www.rti.india.gov.in/
In the case of the 7th IC at the CIC the orders disclose only the name, district and some times the State of the RTI Appellants. For example please see:
In the case of the 8th IC at the CIC the orders mention only the name of the RTI Appellant and the name of the public authority. For example please see:
This the latest pattern of recording the identity of the RTI Appellants of the members of the CIC who have been around for some time now. The orders of the 3 newly appointed ICs are not yet available on the CIC's website, if they have started hearing cases.
In the case of Jammu and Kashmir, the lone serving IC's orders disclose the name and postal address of the RTI Appellants along with the name of their fathers. For example see: http://jksic.co.in/pdf.php?id=
In the case of Himachal Pradesh, the name and address of the RTI Appellants are disclosed. In some cases the name of the Appellant's father is also disclosed. For example see:
In the case of Punjab, the name and postal address of the RTI Appellants are dislcosed. In some case the name of the RTI Appellant's father is also disclosed. For example see: http://infocommpunjab.
In the case of Haryana, the name and postal address of the RTI Appellants are disclosed in the orders. IN some cases the name of the RTI Appellant's father is also mentioned. For example see:
In the case of Uttarakhand, the orders disclose the name and postal address of the RTI Appellants. For example see:
In the case of Bihar, the orders of at least 1 serving IC disclose the name and postal address of the RTI Appellant. For example see:http://www.biharonline.gov.in/
In the case of Rajasthan, I could not find the orders of the IC for 2015-16 on the website. Until 2014 the practice was to disclose the name and postal address of the RTI
In the case of Chhattisgarh, I could find decisions of the ICs only up to January 2015. The practice varies from case to case. In some, only the name of the RTI Appellants and the district are disclosed in the order while in others the complete postal address is disclosed. For example see:
In the case of Maharashtra, the name and complete postal address of the RTI Appellants are disclosed in the orders. For example see the decisions from various Benches:
In the case of Karnataka, the name and complete postal address of the RTI Appellants are disclosed in the orders. In some cases the name of the Appellant's father is also disclosed. For example see:
In the case of Kerala, I could find decisions of the ICs only up to 2014. The orders disclose the name and postal address of the RTI Appellant. For example please see:http://keralasic.gov.in/
In the case of Tamil Nadu, the name and postal address of the RTI Appellants are disclosed in the orders. For example see:http://www.tnsic.gov.in/
In the case of Andhra Pradesh, the name and postal address of the RTI Appellants are disclosed in the orders. For example see:http://www.apic.gov.in/
In the case of Odisha, the name and the postal address of the RTI Appellant are disclosed. For example see: http://
In the case of Arunachal Pradesh, the name and postal address of the RTI Appellants are mentioned in the orders. Arunachal and Tripura (see below) are perhaps the only SICs which name the PIOs in their orders. I have not come across names of PIOs in the recent orders issued by any of the Information Commissions reviewed here. For example see: http://www.arnsic.nic.in/
In the case of Assam, only the names of the RTI Appellants are disclosed in the orders. For example see: http://www.sicassam.in/
In the case of Manipur, in some of the orders only the name of the RTI Appellants are mentioned while in others the postal address of the Appellant is also mentioned. For example see:
In the case of Meghalaya, only the names of the RTI Appellants and the area/town/city/village of residence and/or the district are disclosed. For example see:
In the case of Nagaland, the name and the postal address of the RTI Appellants are disclosed. For example see: http://nlsic.gov.in/
In the case of Mizoram, only the name and the area in which the RTI Appellant lives is disclosed in the SIC's order. For example see: https://mic.mizoram.gov.
In the case of Tripura, the name and postal address of the RTI Appellants are disclosed. In some case the name of the father of the RTI Appellant is also disclosed in the SIC's order. The names of the PIOs are also disclosed. For example see:
In the case of Sikkim, only the name of the RTI Appellants and the area and district where they live are disclosed in the order. For example see: http://www.cicsikkim.gov.
As for West Bengal, the SIC's website does not display a list of orders after 2009. Even this list does not open up the actual orders on any Internet browser. Similarly, the Gujarat SIC's website does not display any orders since 2009. However the Cause List for March 2016 discloses the name and postal address of the RTI Appellant.
In the case of Uttar Pradesh, recent decisions are not accessible on the SIC's website. However the orders from 2009-2011 disclose only the name of the RTI Appellant and the Respondent Public Authority. In the case of Madhya Pradesh, I could not find orders issued after 2006 on the SIC's website. In the few orders uploaded on their website, the name and postal address of the RTI Appellant are mentioned. I could not locate any of the decisions of the Jharkhand SIC on its website. In the case of Goa, although the cause titles of decided cases are mentioned, the text of the orders do not open up on any browser.
A large number of the Information Commissions disclose the name and postal address of the RTI Appellants and Complainants in their orders. So when one makes a recommendation to the DoPT the practice of the ICs should also be borne in mind as any decision applicable to the PIO/FAA stage of the RTI process will have a bearing on the practice adopted by the Information Commissions also, eventually.
What is "personal information", deserving protection from disclosure?
Further, there is no clarity on what constitutes 'personal information' in the context of RTI. Names are the most personal of information in relation to any individual. Should names not be disclosed when RTI applications and responses, first appeals and FAA orders are uploaded on the websites?
In countries like the United Kingdom, all names are deleted from the FOI requests and responses. Please see examples on the FOI logs accessible at: https://www.gov.uk/
In India there is no comprehensive data protection or privacy law. Last year the Hon'ble Attorney General of India succeeded in sowing doubts in the mind of the justices of the Hon'ble Supreme Court about whether the Constitution guaranteed the people a fundamental right to privacy. This issue has been referred to a Constitution Bench and awaits adjudication.
To the best of my knowledge, the only statutory regime for personal data protection in India is afforded by the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information), Rules 2011 notified under the Information Technology Act, 2000. Under these Rules "sensitive personal data" includes (Rule 3) : password, financial information such as bank account or credit/debit card details, physical, physiological and mental health condition, sexual orientation, medical records & history, biometric information etc. However information that is freely available in the public domain or accessible under the RTI Act will not be treated as "sensitive personal data or information". For example, names and addresses of citizens registered as voters are easily available on the website of the Chief Electoral Officers. These will not be treated as 'sensitive personal information' for the purpose of the IT Rules.
Under the 2011 IT Rules, every body that collects "sensitive personal data/information" of the kind mentioned above is required to put in place various measures for ensuring the security of such information. The scope and shortcomings of these Rules are examined in depth in the report submitted by the Justice A. P. Shah led Group of Experts on Privacy in 2012.
Clearly, the definition of 'sensitive personal data/information' contained in the 2011 IT Rules will not apply to names and addresses of RTI applicants. So there is no law in force that can protect such personal information. It is in this legal vacuum that recommendations have to be made to the DoPT about protecting personal data.
Protecting RTI users from harm
By the latest count at least 51 murders reported across the country has been related to the use of RTI by the deceased. More than 240 other have been assaulted or severely mentally harassed into withdrawing their RTI applications. It is in this context that in November 2013, the Calcutta High Court had directed that public authorities should not insist on disclosure of postal addresses of RTI applicants - to ensure their security (see attachment). My critical analysis of the direction is accessible at this link. The DoPT's OM mentioned above refers to this case also. However, nothing in this order pertains to disclosure of RTI applications and first appeals and the responses of the public authorities to the same on their websites. Security of RTI users is paramount, no doubt. However, RTI users need to take a stand whether they would like to exercise their fundamental right to seek information in complete anonymity or would they like to pressure the system to ensure that their personal details are not misused to harass them or assault or get rid of them.
Until the system works to protect every RTI user, perhaps the middle path would be to press for the deletion of all contact details except the names of the RTI applicant/appellant and those of the PIO/FAA from the documents.
I request readers to share their views on this subject with me.
Please circulate this email widely.