The Lok Sabha on Monday passed the Digital Personal Data Protection Bill, 2023, a first-ever legislation dedicated for digital privacy amid concerns of MPs regarding the removal of the data localisation mandate and increased government control.
The Bill was passed with an amendment to a minor editing error. Once the Bill comes into effect, all digital platforms will be required to obtain unconditional, free, specific, and informed consent from users for processing their data. They will also need to issue a notice explaining the purpose of data processing and the rights of the users. The government will appoint a data protection board, an independent body that will examine personal data breaches and impose penalties.
The Bill has gone through over four years of work, rounds of deliberation, and at least four iterations. The latest version of the Bill does not mandate local storage of personal data, providing a major relief to big tech firms like Google, Meta, and Amazon. The government may, however, notify a list of countries in future, where data cannot be transferred.
The Bill prescribes penalties of up to Rs 250 crore for each instance of a data breach arising from a lack of reasonable safeguards on platforms. The government may block the operations of entities not complying with the law even after two instances of penalties. The draft Bill of the final version was released for public consultation in November 2022.
“Before bringing this Bill to the Parliament, we carried out extensive public consultations. The draft (released in November) was discussed in detail with about 48 organisations and 39 ministries. We received approximately 24,000 pieces of feedback during these consultations,” Union Minister for Communication and IT Ashwini Vaishnaw said in the Lok Sabha.
Jayadev Galla, a Telugu Desam Party member in the Lok Sabha, raised concerns about the Centre’s possible control over the data protection board. “For example, the government will establish the board, determine its headquarters, decide its chairperson and members, and loosely tie qualifications to become the chairperson. This will give the government elbow room to appoint one at its own discretion,” Galla said, suggesting reconsideration of the proposed amendment to the Right to Information Act, as it could potentially open avenues for corruption.
Several parties, including the YSR Congress Party, and Biju Janata Dal, extended their support to the Bill, albeit with some reservations. The Bill is expected to be introduced to the Rajya Sabha on Tuesday.
Syed Imtiaz Jaleel, a Member of Parliament from the All India Majlis-e-Ittehadul Muslimeen, said: “The Bill raises serious questions, one of them being the excessive centralisation of power. The Union government can exempt any government or private-sector entity from the application of the provisions of the law merely by issuing a notification.”
On the question about the right to withdrawal, Vaishnaw said the Bill continues to provide the right to be forgotten to data principals, now renamed as the right to erasure. He said the government had repeatedly assured that all the legal requirements for data fiduciaries would be clarified in the rules to be notified later.
Policy advocacy groups have expressed concern about the lack of detailed discussion on the Bill.
“The Bill was unfortunately only discussed for 20 minutes in the Lok Sabha. Some important points were raised by opposition members, including the lack of independence of the Data Protection Board, the need to re-examine the RTI amendment, and the age of consent for children. However, disappointingly, not enough time was allocated to respond to all of these inputs,” said Aparajita Bharti, Founding Partner at TQH Consulting.
About the method of taking parental consent for collecting children data, Vaishnaw said: “The Bill in a clear way provides for the apps that can be used by children. Today there are many platforms like DigiLocker, through which parental consent can be obtained.”
Regarding the method of obtaining parental consent for the collection of children’s data, Vaishnaw said: “The Bill clearly stipulates the apps that children can use. Today there are many platforms like DigiLocker, through which parental consent can be obtained.”