The Digital Personal Data Protection Bill 2022

The Union Government has released a revised personal data protection bill, now called the Digital Personal Data Protection Bill, 2022. The Bill has been introduced after 3 months of the withdrawal of the Personal Data Protection Bill, 2019, it is open for public consultation till December 17, 2022. It eases cross-border data flows and increases penalties for breaches. But it gives the Centre wide-ranging powers and prescribes very few safeguards.

Officials at the Ministry of Electronics and IT have said the new draft strikes a delicate balance and factors in learning from global approaches, while staying aligned to the Supreme Court’s ruling on privacy as a fundamental right, but within reasonable restrictions.

The Union information technology and communications minister Ashwini Vaishnaw said that the proposed data protection board will perform independently and the draft - digital personal data protection bill would be tabled in the Parliament in the Budget session.

“Everyone is saying the bill will make justice accessible to everybody, not necessarily to only those who are tech savvy sitting in Delhi, Bangalore or Mumbai who have access to everything. But people from Jharkhand, Chattisgarh, tribal areas of Odisha will also be able to seek justice under the bill,” Vaishnaw said. Citing cybersecurity threats, especially from state actors, Vaishnaw said that it was important to keep track of threats the internet landscape is under.

While commenting on the Bill, Justice BN Srikrishna said that it is good for government agencies and could prove to be beneficial for business entities as well; however, it does little to guard the fundamental right to privacy of individuals. If the Bill gets passed as it is, it will not be able to safeguard citizens or individuals against the poaching of data and misuse thereof by government agencies.

Justice Srikrishna further said, the Bill is fundamentally flawed as it would permit, and may encourage, the executive to act capriciously and infringe the fundamental right of privacy of personal data. The so-called regulator will be a puppet of the government and will have no independence.

The government will not be able to violate the privacy of citizens under the proposed data protection law as it will get access to personal data only in exceptional circumstances like national security, pandemic and natural disasters, Minister of State for Electronics and IT Rajeev Chandrasekhar said.

He further said, the proposed Data Protection Board -- which adjudicates matters related to data protection -- will be independent and will not have any government officer on the board. So, let’s wait and watch.

S Mohini Ratna, Editor, VARINDIA