DRAFT DIGITAL PERSONAL DATA PROTECTION BILL, 2022 – INFORMATION TECNOLOGY
News: The latest draft of the data protection law — the Digital Personal Data Protection Bill, 2022 (DPDP Bill, 2022) has now been made open for public comments.
Need for the Data Protection law:
FEATURES OF THE DRAFT PERSONAL DATA PROTECTION BILL,
2022.
1. Data Bill based on seven principles:
2. Data Principal and Data Fiduciary:
●
The bill uses the term
“Data Principal” to denote the individual whose data is being collected.
●
The term “Data Fiduciary”
is the entity (can be an individual, company, firm, state etc), which decides
the “purpose and means of the processing of an individual’s personal data.
●
The law also makes a
recognition that in the case of children - defined as all users under the age
of 18 - their parents or lawful guardians will be considered their ‘Data
Principals.
3. Definition of Data:
●
Under the law, personal
data is “any data by which or in relation to which an individual can be
identified.”
●
Processing means “the
entire cycle of operations that can be carried out in respect of personal
data.”
●
So right from collection
to storage of data would come under processing of data as per the bill.
4. Right to consent:
●
The bill also makes it
clear that individuals need to give consent before their data is processed and
that “every individual should know what items of personal data a Data Fiduciary
wants to collect and the purpose of such collection and further processing.”
●
Further, the notice of
data collection needs to be in clear and easy-to-understand language.
Individuals also have the right to withdraw consent from a Data Fiduciary.
5. Significant Data Fiduciaries and it's
responsibilities:
●
The bill also talks of
‘Significant Data Fiduciaries, who deal with a high volume of personal data.
●
The Central government
will define who is designated under this category based on a number of factors
ranging from the volume of personal data processed to the risk of harm to the
potential impact on the sovereignty and integrity of India.
●
“This category needs to
fulfill certain additional obligations to enable greater scrutiny of its
practices,” according to the bill’s explanatory note.
●
Such entities will have
to appoint a ‘Data protection officer’ who will represent them. They will be
the point of contact for grievance redressal. They will also have to appoint an
independent Data auditor who shall evaluate their compliance with the act.
6. Right to erase data, right to nominate:
●
Data principals will have
the right to demand the erasure and correction of data collected by the data
fiduciary.
●
They will also have the
right to nominate an individual who will exercise these rights in the event of
death or incapacity of the data principal.
●
The bill also gives consumers
the right to file a complaint against a ‘Data Fiduciary’ with the Data
Protection Board in case they do not get a satisfactory response from the
company.
7. Cross-border data transfer:
●
The bill also allows for
cross-border storage and transfer of data to “certain notified countries and
territories.”
●
However, “an assessment
of relevant factors by the Central Government would precede such a
notification,” adds the note.
8. Financial penalties:
●
The draft also proposes
to impose significant penalties on businesses that undergo data breaches or
fail to notify users when breaches happen.
●
Entities that fail to
take “reasonable security safeguards” to prevent personal data breaches will be
fined as high as Rs 250 crore.
9. Exemptions to certain entities:
●
The Government could also
exempt certain businesses from adhering to provisions of the Bill on the basis
of the number of users and the volume of personal data processed by the entity.
● This has been done keeping in mind startups of the country who had complained that the previous version of the Bill was too “compliance intensive”.
Concerns raised by experts regard the bill:
1. No provision for classification of data:
●
This Bill is less
explicit in the harms caused by data privacy breaches and does not distinguish
between personal data and sensitive personal data.
2. Blanket exemptions to Government agencies and some
private entities:
●
The draft Bill does not
consider surveillance as harmful.
●
However, The 2019 Bill
explicitly defined surveillance as a harm under Section 3(20). Clause 18(2)(a)
of the DPDPB, 2022 allows the Union Government to exempt any “instrumentality”
of the State from the application of DPDPB, 2022 in the interests of
“sovereignty and integrity of India, security of the State, friendly relations
with foreign States, maintenance of public order or preventing incitement to
any cognizable offence relating to any of these''.
●
This would result in
grave violations of a citizen’s privacy, while also extending immunity to Government
arms from the application of the law.
●
Earlier, the government
could exempt any state agency from having to comply with the Act, but now they
can exempt any entity, any data fiduciary. Not just a state agency.
3. Lack of independence to the Data protection board:
●
This draft Bill replaces
the Data Protection Authority with the Data Protection Board of India, but it
is still not an independent body.
●
The Union government will
prescribe the strength and composition of the Board, the process of selection,
the terms and conditions of appointment and service, and the removal of its
Chairperson and other Members.
●
This brings into question
the independence of the Board. The ability to appoint the chief of the board is
a power that the Indian government has given itself.
4. Issues in data localization:
●
The draft Bill removes
the requirement of data localization (which the 2019 Bill, and the subsequent
report of the Joint Parliamentary Committee, released in December 2021,
required).
●
Section 17 of the draft
Bill mentions that it will release a list of countries and territories to which
personal data might be transferred, after an assessment of certain factors.
●
However, no criteria have
been stated on how the government will define which countries to allow data
transfers to.
●
“This is in contrast with
Articles 44 to 50 of the General Data Protection Regime which permits transfer
of personal data of Europeans only to such countries which provide a minimum
level of protection to such data.
5. Unscrupulous fine on data principle:
●
If a user submits false
documents while signing up for an online service, or files frivolous grievance
complaints, the user could be fined up to Rs 10,000.
●
This implied that a user
cannot use a pseudonym at all. Unless it is a financial transaction, should you
be precluded from providing a pseudonym in case you feel like doing so? People
may want to maintain their privacy and not give their details to all service
providers they interact with.