After over four years of work, rounds of deliberation, and multiple iterations, a dedicated law to ensure the data privacy of Indians will be presented for Parliament’s consideration on Thursday. If cleared, the Bill may bring in heavy penalties for digital platforms for failing to protect user data.
The Digital Personal Data Protection Bill, 2023, will set out the conditions for collecting and processing personal data, as well as the penalties on platforms for failing to protect it. The government will table the new Bill exactly one year after withdrawing the previous draft of the Personal Data Protection Bill, 2019.
The Bill may propose penalties ranging up to Rs. 250 crore for each instance of data fiduciaries failing to take safeguards to prevent personal data breaches. A data protection board will be responsible for deciding on penalties in cases of data breaches. The government will have the power to block digital platforms after more than two instances of penalties for data breaches.
Every digital platform may need to take consent from users before collecting any digital personal data, along with an itemised notice for the same. For collecting children’s data, consent from parents or legal guardians will be needed, except for a category of platforms to be defined later on.
However, the final version of the Bill would be a distinct framework compared to the previously proposed draft legislation on the same subject.
The final Bill allows cross-border data transfers, does not classify data into categories such as sensitive and critical, and does not prescribe criminal penalties on platforms for violating the data privacy of users.
Although data security experts were advocating for data privacy legislation in India for a long time, the Supreme Court’s 2017 judgment recognising the right to privacy as a fundamental right of citizens provided grounds for the government to bring a data privacy Bill.
The Ministry of Electronics and Information Technology in the same year constituted a committee of experts chaired by Justice B N Srikrishna to create a draft Bill. The committee presented Draft Personal Data Protection Bill, 2018.
In 2019, the Bill was tabled in Parliament with some amendments and was referred to a joint parliamentary committee (JPC). However, the government withdrew the draft last year, as the JPC suggested 81 amendments and 12 recommendations in a Bill of 99 Sections. This was followed by a new draft released for public consultations in November 2022. The government received as many as 21,666 suggestions from industry stakeholders and legal experts.
Policy advocacy groups and experts have demanded thorough discussions on the Bill before its passage.
“Many asks by the industry and civil society have been incorporated in the revised versions of the Bill that surfaced during multiple consultations. However, some provisions like the age of consent for children, expanding the list of legitimate purposes to enable innovation, the rule-making process under the Act in the absence of a data protection authority, and the appeal process can benefit from a discussion in Parliament,” said Aparajita Bharti, co-founder, TQH Consulting.