Table of Contents
Context to Digital Personal Data Protection Bill 2023
The Digital Personal Data Protection Bill, 2023, has recently made headlines as it was introduced in the Lok Sabha. This bill is significant as it aims to establish provisions for safeguarding personal data and individual privacy. However, it has not been without controversy, as some Members of Parliament from opposition parties objected to its introduction, advocating for it to be referred to a Parliamentary committee for further review and deliberation. This development has sparked discussions and debates about the implications and necessity of the proposed data protection legislation.
The need for the Digital Personal Data Protection Bill, 2023
Definition of Personal Data: Personal data encompasses any information that can be used to identify an individual or is related to an identifiable person. In an increasingly digital world, the scope and sensitivity of personal data have expanded significantly.
Deliberation and Formulation: The Ministry of Electronics and Information Technology has engaged in thorough deliberations regarding digital personal data and its protection. These discussions have culminated in the drafting of the ‘Digital Personal Data Protection Bill, 2023.’
Balancing Rights and Necessity: The primary purpose of the draft Bill is to strike a delicate balance. It aims to protect the right of individuals to safeguard their personal data while acknowledging the essential need to process such data for lawful purposes.
Guidance and Best Practices: The Bill serves as a vital guide, outlining best practices and rules for organizations and government entities. It offers a framework on how personal data should be handled, emphasizing the regulation of data processing.
Defining Rights and Obligations: Importantly, the Bill delineates the rights and duties of citizens, often referred to as “Digital Nagrik,” on one side. On the other hand, it establishes the obligations of data fiduciaries, who are entrusted with collecting and handling personal data, to ensure that it is processed lawfully and ethically.
key features:
1. Applicability:
- The Bill applies to the processing of digital personal data within India.
- It also extends its applicability to the processing of personal data outside India if it involves offering goods or services or profiling individuals in India.
2. Consent:
- Personal data may only be processed for lawful purposes with the consent of the individual.
- Consent must be preceded by a notice containing details about the data to be collected and the purpose of processing.
- Individuals have the right to withdraw their consent at any time.
- For individuals under 18 years of age, consent will be provided by their legal guardian.
3. Rights and Duties of Data Principal:
- Data principals (individuals whose data is processed) have several rights, including the right to access information about processing, seek correction and erasure of personal data, and nominate someone to exercise their rights in case of death or incapacity.
4. Transfer of Personal Data outside India:
- The central government will identify countries to which data fiduciaries may transfer personal data.
- Such transfers will be subject to prescribed terms and conditions.
5. Exemptions:
- The Bill outlines specific cases where the rights of data principals and obligations of data fiduciaries do not apply. These include the prevention and investigation of offenses and the enforcement of legal rights or claims.
- Certain activities, such as data processing by government entities for state security and public order, and activities related to research, archiving, or statistical purposes, may be exempted from the Bill’s application through government notifications.
6. Data Protection Board of India:
- The central government will establish the Data Protection Board of India.
- The Board’s functions include monitoring compliance, imposing penalties, directing data fiduciaries to take necessary measures in case of data breaches, and addressing grievances.
7. Penalties:
- The Bill specifies penalties for various offenses. For instance, non-fulfillment of obligations concerning children’s data may incur penalties of up to Rs 200 crore, while failure to implement security measures to prevent data breaches may result in penalties of up to Rs 250 crore.
Significance of Digital Personal Data Protection Bill, 2023
Enhanced Data Privacy and User Control:
- The bill is designed to provide robust protection for personal data, ensuring that users have greater control over their own information. This empowers individuals to make informed choices about how their data is used and shared.
Accountability for Corporations and Consumers:
- The legislation introduces stringent norms and penalties for both big corporations and consumers. Failure to adhere to the prescribed norms can result in significant fines. This promotes accountability in the handling of personal data.
Upholding the Right to Privacy:
- The bill aligns with the “Right to Privacy,” recognizing it as a fundamental right. It aims to make entities such as internet companies, mobile apps, and businesses more accountable for the collection, storage, and processing of citizens’ data. This is a crucial step in safeguarding individuals’ privacy in the digital realm.
Consent-Centric Approach:
- Under the bill, entities, whether public or private, will be required to seek explicit consent from users before collecting and processing their data. This signifies a shift towards a consent-centric approach, where the privacy choices of every consumer are respected and valued.
Strengthened Data Protection:
- The bill enhances the protection of personal data, making it less susceptible to unauthorized access, breaches, or misuse. It sets a higher standard for data security, safeguarding the sensitive information of individuals.
What are the Concerns w.r.t. the Digital Personal Data Protection Bill, 2023? Some of the most contentious issues include
Wide-Ranging Exemptions for Government and Its Agencies:
- Critics have expressed concerns about the extensive exemptions granted to the government and its agencies under the bill. These exemptions may be perceived as allowing government entities to bypass certain data protection regulations.
Dilution of Powers of the Data Protection Board:
- There are apprehensions that the bill may dilute the powers and authority of the Data Protection Board. This could potentially limit the board’s ability to effectively monitor and enforce data protection measures.
Amendment to the Right to Information Act (RTI), 2005:
- One of the contentious issues revolves around an amendment proposed by the bill to the Right to Information Act, 2005. This amendment could restrict the sharing of details linked to personal information of government officials.
Removal of Public Interest Caveat:
- The concerns regarding the RTI Act amendment stem from the fact that the bill eliminates the public interest caveat. Currently, exemptions apply only when sharing such information does not serve a larger public interest. The proposed amendment removes this safeguard.
Override of Section 43A of the Information Technology Act, 2000:
- The bill overrides Section 43A of the Information Technology Act, 2000, which mandates that companies compensating users for mishandling their data. The bill’s approach differs, as it opts for ex-gratia payments at the discretion of governments rather than compensation through a judicial process.
Data privacy regulations vary from country to country, with many nations implementing legislation to protect individuals’ personal information. Here’s an overview of how some countries regulate data privacy:
1. European Union (EU):
- The EU’s General Data Protection Regulation (GDPR), enacted in 2018, is considered one of the most stringent data privacy laws globally. It provides individuals with greater control over their personal data and imposes strict requirements on organizations handling such data. GDPR serves as a global benchmark for data protection.
2. China:
- China has recently tightened its laws concerning the transfer of personal data overseas. It places restrictions on cross-border data transfers, requiring companies to undergo security assessments and obtain government approval before transferring data abroad.
3. Vietnam:
- Similar to China, Vietnam has also introduced stricter regulations governing the transfer of personal data overseas. Companies are required to follow specific guidelines and seek authorization when transferring data outside the country.
4. Australia:
- Australia passed a bill in 2018 that granted law enforcement agencies access to encrypted data. This legislation aimed to address security concerns related to encrypted communications while balancing privacy rights.
These examples illustrate that data privacy regulations can vary significantly from one country to another. Some prioritize individual privacy rights and stringent data protection measures, while others focus on national security and law enforcement needs. As data continues to play a central role in the digital age, countries are constantly evolving their data privacy laws to address new challenges and protect their citizens’ rights.
Conclusion
Digital Personal Data Protection Bill, 2023 represents a significant step towards safeguarding the rights and privacy of individuals in the digital age. It empowers individuals by granting them substantial rights and control over their personal data, ensuring greater awareness and decision-making autonomy.
The bill places clear obligations on companies to adhere to these individual rights and establishes robust mechanisms for addressing grievances, backed by significant penalties for non-compliance. This framework aligns with the principles laid out in the landmark Supreme Court judgment in the Justice K. S. Puttaswamy (Retd) Vs Union of India Case (2017).
The unanimous decision of the nine-judge bench of the Supreme Court recognized the constitutionally protected fundamental right to privacy for all Indians, acknowledging it as an intrinsic part of life and liberty under Article 21. The Digital Personal Data Protection Bill, 2023, reinforces and legislates this fundamental right, emphasizing the importance of preserving privacy and data security in an increasingly digital world.
