A Step Closer
The draft Digital Personal Data Protection Bill, 2022, improves upon the previous draft released in 2019. But the wait for regulations continues
The new Bill aims to transform India into a digitally empowered society and knowledge economy
X THE WAIT HAS been long. The draft of the Personal Data Protection Bill 2019 was tabled by the government a few years ago. But it was withdrawn in August 2022 after it received a slew of amendments and recommendations. Three months after it was withdrawn, a new draft called the Digital Personal Data Protection Bill, 2022—that proposes stiffer penalties for data breaches and softer data localisation provisions—has been put in the public domain for consultation.
The new Bill is in line with the ‘Digital India’ programme that aims to transform the nation into a digitally empowered society and knowledge economy and focusses on the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process personal data for lawful purposes.
The Bill is based on the principles that the usage of personal data by organisations must be done in a manner that is lawful, fair and transparent, and that the personal data will be used for the purpose for which it is collected. Individuals need to give consent before their data is processed, and every individual has a right to know what items of personal data a data fiduciary (individual, company, firm, state, etc., that decides the purpose and means of collecting and processing an individual’s personal data) wants to collect, along with the purpose of such collection and how it will be processed. Individuals will also have the right to withdraw consent or demand the erasure and correction of data collected by the data fiduciary.
For non-compliance, the government has proposed penalties as high as `500 crore. That’s a big jump from the penalty of up to `15 crore or 4 per cent of the global turnover of an entity that the 2019 draft had proposed. The Bill also proposes to set up a Data Protection Board to ensure compliance with the Bill; the 2019 draft had proposed a Data Protection Authority.
The latest draft, however, takes a softer stand on data localisation requirements as the Bill permits data transfer to select global destinations based on some predefined assessments; the earlier draft didn’t allow this. It also gives power to the government to offer exemptions from the provisions of the Bill in the interest of national security.
But, according to Manish Sehgal, Partner at Deloitte India, the exemptions granted to central and state agencies, and the exclusion of personal data stored in non-digital format, are gaps in the protection of personal data and the path to ensuring complete privacy.
While the Bill is far from final, it does address some of the concerns raised in the previous draft and stakeholders are hopeful that this is a step that brings India closer to a data privacy law.