Draft of data law blends security, privacy & safety

Recognising privacy as a fundamental right, a draft personal data protection bill has proposed "explicit consent" for processing 'sensitive personal information' like religious or political belief,

sexual orientation and biometric information.

It has also provided for the right to be forgotten and prescribed steep penalties for violations.

The draft of Personal Data Protection Bill, 2018, - which is based on the recommendations of a panel headed by Justice B N Srikrishna -- restricts and imposes conditions on the cross-border transfer of personal data, and suggests setting up of a Data Protection Authority to prevent any misuse of personal information.

The panel submitted its report on data protection as also the draft of the Bill to the government on Friday.

The draft provides for a penalty of Rs 15 crore or 4 per cent of the worldwide turnover of any data collection entity, including the State, for violation of personal data processing provisions.

Failure to take prompt action on a data security breach can attract up to Rs 5 crore fine or 2 per cent of turnover, whichever is higher, as a penalty.

"The Bill provides that right to privacy is a fundamental right and it is necessary to protect personal data as an essential facet of informational privacy," the draft has said.

It has allowed processing of personal data only for the purpose it is collected or for compliance with any law, employment and for any function of Parliament or any state legislature.

‘‘Sensitive personal data’’ comprises passwords, financial data, health data, sex life, sexual orientation, biometric data, genetic data, caste or tribe and religious or political belief or affiliation.

"Personal data may be processed on the basis of the consent of the data principal, given no later than at the commencement of the processing," it has said, adding that processing of sensitive personal data should be on the basis of explicit consent.

It provides for the processing of personal data only for purposes that are clear, specific and lawful. Collection of personal data has been limited to such data that is necessary for the purposes of processing.

Data fiduciary, which includes the state, has to give the individual information of the purpose for which the personal data is to be processed.

It will retain personal data only as long as may be reasonably necessary to satisfy the purpose for which it is processed. It provides for the right to be forgotten after the particular purpose has been served.

Besides a Data Protection Authority to prevent any misuse of personal data, it also provides for setting up of an Appellate Tribunal. Compensation has to be given to any person whose has been wronged, it has suggested.

The draft bill makes obtaining, transferring or selling of personal data in contravention as an offence.

‘‘We want Indian data protection law to become a model globally, blending security, privacy, safety and innovation," Law Minister Ravi Shankar Prasad said at a conference.

He added that the report will go through the process of inter-ministerial consultations and Cabinet as well as parliamentary approval.

Justice Srikrishna said privacy has become "a burning issue" and, therefore, every effort has to be made to protect data at any cost.