DRAFT DIGITAL PERSONAL DATA PROTECTION BILL, 2022 – INFORMATION TECNOLOGY
News: The latest draft of the data protection law — the Digital Personal Data Protection Bill, 2022 (DPDP Bill, 2022) has now been made open for public comments.
Need for the Data Protection law:
- Constant
interactions with digital devices
have led to unprecedented amounts of personal data being generated round
the clock by users (data principals). When coupled with the computational
power available today with companies (data fiduciaries), this data can be
processed in ways that increasingly impair the autonomy,
self-determination, freedom of choice and privacy of the data principal.
- The current legal
framework for privacy enshrined in the Information Technology Rules, 2011
(IT Rules, 2011) is wholly inadequate
to combat such harms to data principals, especially since the right to
informational privacy has been upheld as a fundamental right by the Supreme Court (K.S. Puttaswamy vs
Union of India, 2017).
- First,
the extant framework is premised on privacy being a statutory right
rather than a fundamental right and does not apply to processing of
personal data by the Government.
- It
has a limited understanding of the kinds of data to be protected.
- It
places scant obligations on the data fiduciaries which, moreover, can be
overridden by contract.
- There are only minimal consequences for the data fiduciaries for the breach of these obligations.
- While
protecting the rights of the data principal, data protection laws need to
ensure that the compliances for
data fiduciaries are not so onerous as to make even legitimate
processing impractical.
- The
challenge lies in finding an adequate
balance between the right to privacy of data principles and reasonable
exceptions, especially where government processing of personal data is
concerned.
- Given
the rate at which technology
evolves, an optimum data protection law design needs to be future
proof - it should not be unduly detailed and centered on providing solutions
to contemporary concerns while ignoring problems that may emerge going
forward.
- The law needs to be designed for a framework of rights and remedies that is readily exercisable by data principals given their unequal bargaining power with respect to data fiduciaries.
FEATURES OF THE DRAFT PERSONAL DATA PROTECTION BILL,
2022.
1. Data Bill based on seven principles:
- Usage
of personal data by organizations must be done in a manner that is lawful,
fair to the individuals concerned and transparent to individuals.
- Personal
data must only be used for the purposes for which it was collected.
(Process limitation).
- Data
minimization (Collection limitation).
- Data
accuracy when it comes to collection.
- Personal
data that is collected cannot be “stored perpetually by default,” and
storage should be limited to a fixed duration. (Storage llimitation).
- There
should be reasonable safeguards to ensure there is “no unauthorized
collection or processing of personal data.
- The
person who decides the purpose and means of the processing of personal
data should be accountable for such processing.
2. Data Principal and Data Fiduciary:
●
The bill uses the term
“Data Principal” to denote the individual whose data is being collected.
●
The term “Data Fiduciary”
is the entity (can be an individual, company, firm, state etc), which decides
the “purpose and means of the processing of an individual’s personal data.
●
The law also makes a
recognition that in the case of children - defined as all users under the age
of 18 - their parents or lawful guardians will be considered their ‘Data
Principals.
3. Definition of Data:
●
Under the law, personal
data is “any data by which or in relation to which an individual can be
identified.”
●
Processing means “the
entire cycle of operations that can be carried out in respect of personal
data.”
●
So right from collection
to storage of data would come under processing of data as per the bill.
4. Right to consent:
●
The bill also makes it
clear that individuals need to give consent before their data is processed and
that “every individual should know what items of personal data a Data Fiduciary
wants to collect and the purpose of such collection and further processing.”
●
Further, the notice of
data collection needs to be in clear and easy-to-understand language.
Individuals also have the right to withdraw consent from a Data Fiduciary.
5. Significant Data Fiduciaries and it's
responsibilities:
●
The bill also talks of
‘Significant Data Fiduciaries, who deal with a high volume of personal data.
●
The Central government
will define who is designated under this category based on a number of factors
ranging from the volume of personal data processed to the risk of harm to the
potential impact on the sovereignty and integrity of India.
●
“This category needs to
fulfill certain additional obligations to enable greater scrutiny of its
practices,” according to the bill’s explanatory note.
●
Such entities will have
to appoint a ‘Data protection officer’ who will represent them. They will be
the point of contact for grievance redressal. They will also have to appoint an
independent Data auditor who shall evaluate their compliance with the act.
6. Right to erase data, right to nominate:
●
Data principals will have
the right to demand the erasure and correction of data collected by the data
fiduciary.
●
They will also have the
right to nominate an individual who will exercise these rights in the event of
death or incapacity of the data principal.
●
The bill also gives consumers
the right to file a complaint against a ‘Data Fiduciary’ with the Data
Protection Board in case they do not get a satisfactory response from the
company.
7. Cross-border data transfer:
●
The bill also allows for
cross-border storage and transfer of data to “certain notified countries and
territories.”
●
However, “an assessment
of relevant factors by the Central Government would precede such a
notification,” adds the note.
8. Financial penalties:
●
The draft also proposes
to impose significant penalties on businesses that undergo data breaches or
fail to notify users when breaches happen.
●
Entities that fail to
take “reasonable security safeguards” to prevent personal data breaches will be
fined as high as Rs 250 crore.
9. Exemptions to certain entities:
●
The Government could also
exempt certain businesses from adhering to provisions of the Bill on the basis
of the number of users and the volume of personal data processed by the entity.
● This has been done keeping in mind startups of the country who had complained that the previous version of the Bill was too “compliance intensive”.
Concerns raised by experts regard the bill:
1. No provision for classification of data:
●
This Bill is less
explicit in the harms caused by data privacy breaches and does not distinguish
between personal data and sensitive personal data.
2. Blanket exemptions to Government agencies and some
private entities:
●
The draft Bill does not
consider surveillance as harmful.
●
However, The 2019 Bill
explicitly defined surveillance as a harm under Section 3(20). Clause 18(2)(a)
of the DPDPB, 2022 allows the Union Government to exempt any “instrumentality”
of the State from the application of DPDPB, 2022 in the interests of
“sovereignty and integrity of India, security of the State, friendly relations
with foreign States, maintenance of public order or preventing incitement to
any cognizable offence relating to any of these''.
●
This would result in
grave violations of a citizen’s privacy, while also extending immunity to Government
arms from the application of the law.
●
Earlier, the government
could exempt any state agency from having to comply with the Act, but now they
can exempt any entity, any data fiduciary. Not just a state agency.
3. Lack of independence to the Data protection board:
●
This draft Bill replaces
the Data Protection Authority with the Data Protection Board of India, but it
is still not an independent body.
●
The Union government will
prescribe the strength and composition of the Board, the process of selection,
the terms and conditions of appointment and service, and the removal of its
Chairperson and other Members.
●
This brings into question
the independence of the Board. The ability to appoint the chief of the board is
a power that the Indian government has given itself.
4. Issues in data localization:
●
The draft Bill removes
the requirement of data localization (which the 2019 Bill, and the subsequent
report of the Joint Parliamentary Committee, released in December 2021,
required).
●
Section 17 of the draft
Bill mentions that it will release a list of countries and territories to which
personal data might be transferred, after an assessment of certain factors.
●
However, no criteria have
been stated on how the government will define which countries to allow data
transfers to.
●
“This is in contrast with
Articles 44 to 50 of the General Data Protection Regime which permits transfer
of personal data of Europeans only to such countries which provide a minimum
level of protection to such data.
5. Unscrupulous fine on data principle:
●
If a user submits false
documents while signing up for an online service, or files frivolous grievance
complaints, the user could be fined up to Rs 10,000.
●
This implied that a user
cannot use a pseudonym at all. Unless it is a financial transaction, should you
be precluded from providing a pseudonym in case you feel like doing so? People
may want to maintain their privacy and not give their details to all service
providers they interact with.