Analyzing the Data Protection Bill

S Mohini Ratna, Editor, VARINDIA 
 

Today, India has more than 800 million internet users and it is expected to increase by 45% in the next five years to 900 million in 2025. Given the dynamic nature of the online sphere, privacy concerns and issues are rapidly changing. There is an urgency to bring a robust data protection policy and its implications on citizens.

The Digital Personal Data Protection Bill, 2022 introduces a new framework for personal data protection, making it paramount to comprehend and understand its applicability and functions. The Government of India sees this released bill as one of the parts of its larger vision of a Digital Economy, this vision will include a comprehensive “Digital India Act” that would in due course of time replace the existing Information Technology Act, 2000.

Hence, it becomes crucial to take a closer look at its provisions, implications and shortcomings considering its potential to impact our day to day lives. The proposed DPDP Bill, 2022 is aimed at “framing out the rights and duties of the citizen (Digital Nagrik) on the one hand and the obligations to use collected data lawfully of the Data Fiduciary on the other hand. The reworked version of India's long-awaited data protection law has been cleared by the Cabinet, and could come before Parliament in the Monsoon Session.

The proposed DPDP Bill, 2022 establishes severe penalties for violations of any of the legislation's provisions, which will be determined by the Data Protection Board of India. It provides financial penalties with a cap of ₹500 crores, which proves to be of much higher quantity as compared to the PDP Bill, 2019. The bill does not allow data principals to seek compensation from data fiduciaries for damages incurred because of unlawful processing. In addition, the legislation imposes obligations on data principals, and if they fail to comply with the regulations, fines of up to ₹10,000 can be levied.

Nearly six years after the Supreme Court held privacy to be a fundamental right, the Centre has made a second attempt at framing legislation for protection of data.

In the recently held VARINDIA Infotech Forum, the subject and matter experts felt that some of the most contentious issues flagged by experts in the November draft have been retained. These include the wide-ranging exemptions to the center and its agencies, and diluting the role of the data protection board. The key Issues and Analysis are:
►Concerns about exemptions for State data processing and violation of privacy rights.
►Differential treatment of consent and storage limitation for public and private entities.
►Questions about the independent functioning of the Data Protection Board.
►Lack of right to data portability and the right to be forgotten for data principals.
►Implications of verifying parental consent for children's data processing.
►Definition of harm may be narrow and lack clarity on significant loss.

During the panel discussion session in the Infotech Forum, leading tech experts warned against compromising privacy and transparency in data protection laws and the data science experts emphasized the importance of balancing privacy and access to information. Whereas, the legal experts stressed harmonizing data protection laws with existing RTI Act for a robust system. At the same time, Government agencies advocate for a transparent and accountable Data Protection Board. The Global leaders support stringent data protection laws to safeguard citizens' rights.

The Bill, once becomes the law, will play a crucial role in India’s trade negotiations with other nations, and especially regions like the Europeon Union, whose General data Protection Rules ( GDPR) are among the world’s most exhaustive privacy laws.

To make this law more effective there is need to launch nationwide campaigns to raise awareness about data protection laws and individuals' rights. There is need to find a mechanism for the widespread by Collaborating with educational institutions and organizations to include data protection education in curriculums. This could be very impactful by engaging with the private sector to promote best practices in data handling and compliance.

The Data Protection Bill is a significant step towards safeguarding digital personal data and privacy rights of Indian citizens. However, it must address critical issues and learn from international best practices to ensure its effectiveness and relevance in the rapidly evolving technological landscape. By harmonizing with the Right to Information Act, ensuring government accountability, empowering an independent Data Protection Board, and providing accessible grievance redress mechanisms, the Bill can strike a balance between privacy protection and transparency.

Going forward, as India embraces its digital future, it is crucial to create a progressive and inclusive Data Protection Bill that upholds citizens' rights and sets a benchmark for responsible data governance.