Personal Data Protection Bill cleared by government; set to be tabled in Monsoon session of Parliament: Report

The Personal Data Protection Bill has been cleared by the PM Narendra Modi-led Union Cabinet today. The next step towards passing it into law will be taken when it is tabled in the Monsoon session of Parliament. This was reported by CNBC Awaaz quoting its own sources.

The data protection bill is the same as the one revealed by the BJP-led NDA government in November, 2022 barring minor alterations. The Bill had been put out for public consultation. The Bill is directed at protecting the privacy of an individual in the digital age.

Apar Gupta, Co-founder and Executive Director, Internet Freedom Foundation, in his column on the issue in the Indian Express, has said that the data protection bill is directed at the "expansion of state power that tilts against individual privacy."

This comes after a 2018 Bill on data protection, which was formulated by Justice BN Srikrishna Committee, came under criticism for being complicated and putting high responsibility on the industry for data localization. 

Personal Data Protection Bill cleared by Union Cabinet

"The new Bill makes sure that consumer rights to data protection are captured as rights,” Indian Express quoted Rajeev Chandrasekhar, Minister of State for Electronics and IT as saying.

Apart from the personal data protection part, the Bill is directed at not becoming a hurdle and slowing down the economy with any kind of rules that would interfere with businesses, which was the case with the 2018 bill. 

The Ministry of Electronics and IT had issued a statement in December 2022 where it invited feedback from the public on the draft Bill, as a part of the government's public consultation exercise. At the time, the bill stated, “Currently, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, made by the Central Government in the exercise of its powers under the Information Technology Act 2000, provide the security practices and procedures that a body corporate or any person collecting, receiving, possessing, storing, dealing or handling information on behalf of the body corporate is required to observe for protecting personal data of users. These practices and procedures include the requirements that such body corporate or person publish on the website a policy for privacy and disclosure of personal information, data or information, to use information collected for the purpose for which it has been collected, to keep it secure and to obtain prior permission of the information provider for disclosing personal data”.

Personal Data Protection Bill highlights

According to a report by PRS, the following are the highlights of the Personal Data Protection Bill:

• The Bill will apply to the processing of digital personal data within India where such data is collected online, or collected offline and is digitised. It will also apply to such processing outside India, if it is for offering goods or services or profiling individuals in India.
• Personal data may be processed only for a lawful purpose for which an individual has given consent. Consent may be deemed in certain cases.
• Data fiduciaries will be obligated to maintain the accuracy of data, keep data secure, and delete data once its purpose has been met.
• The Bill grants certain rights to individuals including the right to obtain information, seek correction and erasure, and grievance redressal.
• The central government may exempt government agencies from the application of provisions of the Bill in the interest of specified grounds such as security of the state, public order, and prevention of offences.
• The central government will establish the Data Protection Board of India to adjudicate non-compliance with the provisions of the Bill.