I had first written about this in July 2018. Justice B. N. Srikrishna and his committee had submitted the first draft proposal. A lot has changed since then. Since its introduction last year, MeitY (Ministry of Electronics and Information Technology), has solicited comments and suggestions on the PDP Bill from the public, various stakeholders, ministers and consultants. Based on these suggestions, a revised Personal Data Protection Bill, 2019 (Draft Bill), was cleared by the Union Cabinet on December 4, 2019. The bill was introduced in Lok Sabha on Dec. 11 and passed on to the Standing Committee. The final report from the Standing Committee is expected by the first day of the last week of the Budget Session, 2020.
The Key Features of the Initial Personal Data Protection Bill Covered the Following Issues:
- Territorial applicability
- Grounds for data processing
- Sensitive personal data:
- Rights of the data principal
- Obligations of the data fiduciary
- Exemptions
- Data Protection Authority
- Cross-border storage of data
- Transfer of data outside the country
- Offences and penalties
The biggest cause of concern currently is how effectively does the revised bill meet the objective of protecting privacy? There is this fear of unrestrained access to personal data by government agencies. In sharp contrast, the 2018 draft had many privacy protections.
After having provided for privacy safeguards, the bill empowers the central government, in Section 35, to allow any government agency to bypass all these:
- in the interest of the sovereignty and integrity of India, security of the State, friendly relations with foreign states or public order and
- for preventing any cognizable offence relating to the above (a).
The only safeguards in this context are: (i) a written order from the central government specifying the reasons for breaching privacy and (ii) in a manner (procedures, safeguards and oversight mechanism) “as may be specified” in future. Nobody knows how this can be used or misused.
Key Features of the Revised Personal Data Protection Bill as per the Government Website:
- Promote concepts of consent, purpose limitation, storage limitation and data minimization etc.
- Lay down obligations on agencies collecting personal data (data fiduciary) to collect only that data which is required for a specific purpose and with the express consent of the individual (data principal)
- Confer rights on the individual to obtain personal data, correct inaccurate data, erase data, update the data, port the data to other fiduciaries and the right to restrict or prevent the disclosure of personal data
- Establish Data Protection Authority of India (DPAI) to protect the interests of individuals, prevent misuse of personal data, ensure compliance and promote awareness about data protection
- Notify “social media intermediary” as a significant data fiduciary whose actions have a significant impact on electoral democracy, security of the state, public order or sovereignty and integrity of India
- Confer the “right of grievance” to individuals to complaint against data fiduciary
- Empower the central government to exempt any government agency from application of the proposed law
- Empower DPAI to specify the “code of practice” to promote good practices of data protection and facilitate compliance and
- Provide for “Adjudicating Officer” for deciding penalties and award compensation for violations and “Appellate Tribunal” to hear appeals against these.
The Penalties and Consequences of Violating the Personal Data Protection Bill
Four points that need to be considered are:
- Processing or transferring personal data in violation of the Bill, punishable with a fine of Rs 15 crore or 4% of the annual turnover of the fiduciary, whichever is higher.
- Failure to conduct a data audit, punishable with a fine of five crore rupees or 2% of the annual turnover of the fiduciary, whichever is higher.
- Re-identification and processing of de-identified personal data without consent is punishable with imprisonment of up to three years, or fine, or both.
- The central government may direct data fiduciaries to provide it with any: (i) non-personal data and (ii) anonymized personal data (where it is not possible to identify data principal) for better targeting of services.
The Future of Data Protection in India: Balancing Privacy and Security
[pdf-embedder url=”http://cxmlab.com/media-bucket/2020/01/Personal-Data-Protection-Bill-2019-1.pdf” title=”Personal Data Protection Bill, 2019″]
