On July 5, 2023 the Union Cabinet has cleared the Digital Personal Data Protection (DPDP) Bill. This clears the way for the Bill to be introduced in Parliament in the upcoming Monsoon Session, scheduled to begin on July 20, 2023. Digital Personal Data Protection Bill 2023 specifies norms on management of personal data of Indian residents and requires explicit consent from people whose data is collected and used. Given the importance, Digital Personal Data Protection Bill is expected to appear in MBA Admission Interviews and as MBA GD Topics. MBAUniverse.com presents a complete analysis of this topic.
What is Digital Personal Data Protection Bill 2023
The Digital Personal Data Protection Bill essentially allows laypersons to complain to the Data Protection Board of India, consisting of technical experts constituted by the government, if they have reason to believe that their personal data has been used without their consent - for example, cell phone numbers or Aadhaar details. “The Board will institute an investigation into the breach,” the official said. The Bill draws from an EU law - The General Data Protection Regulation - and benchmarks 23 instances in which taking consent for recording data is not possible, like golden hour during an accident or natural disasters.
Timelines of Digital Personal Data Protection Bill
The Bill comes after multiple versions floated by the Union government, a process that was started in 2017 – refer timelines below.
- In 2017, the central government constituted a Committee of Experts on Data Protection chaired by Justice B. N. Srikrishna to examine issues relating to data protection in the country. The Committee submitted its report in July 2018.
- Based on the recommendations of the Committee, the Personal Data Protection Bill, 2019 was introduced in Lok Sabha in December 2019.
- The Bill was referred to a Joint Parliamentary Committee which submitted its report in December 2021. In August 2022, the Bill was withdrawn from Parliament.
- In November 2022, the Ministry of Electronics and Information Technology released the Draft Digital Personal Data Protection Bill, 2022 for public feedback.
- Digital Personal Data Protection Bill 2023 was passed by Union Cabinet in July 2023
Highlights of Digital Personal Data Protection Bill 2023
- The Bill will apply to the processing of digital personal data within India where such data is collected online, or collected offline and is digitised. It will also apply to such processing outside India, if it is for offering goods or services or profiling individuals in India.
- Personal data may be processed only for a lawful purpose for which an individual has given consent. Consent may be deemed in certain cases.
- Data fiduciaries will be obligated to maintain the accuracy of data, keep data secure, and delete data once its purpose has been met.
- The Bill grants certain rights to individuals including the right to obtain information, seek correction and erasure, and grievance redressal.
- The central government may exempt government agencies from the application of provisions of the Bill in the interest of specified grounds such as security of the state, public order, and prevention of offences.
- The central government will establish the Data Protection Board of India to adjudicate non-compliance with the provisions of the Bill.
Why is this Bill important?
“Personal data” can be defined as information that relates to an identified or identifiable individual. Businesses as well as government entities process personal data for delivery of goods and services. Processing of personal data allows understanding preferences of individuals, which may be useful for customisation, targeted advertising, and developing recommendations. Processing of personal data may also aid law enforcement. However, unmonitored processing may have adverse implications for the privacy of individuals, which has been recognised as a fundamental right. It may subject individuals to harm such as financial loss, loss of reputation, and profiling.
Currently, India does not have a standalone law on data protection. The usage of personal data is regulated under the Information Technology (IT) Act, 2000. It has been observed that this framework is not adequate to ensure the protection of personal data.
Issues with the Data Protection Bill
Experts say that over 20,000 comments were received on the draft Bill though these will not be put out in public domain. They also say that there has not been much change between the draft that was circulated in public consultation and the final Bill, which will be tabled in the parliament. Here are key issues highlighted by experts and media:
- Exemptions to data processing by the State on grounds such as national security may lead to data collection, processing and retention beyond what is necessary. This may violate the fundamental right to privacy.
- The Bill accords differential treatment on consent and storage limitation to private and government entities performing the same commercial function such as providing banking or telecom services. This may violate the right to equality of the private sector providers.
- The central government will prescribe the composition, and manner and terms of appointments to the Data Protection Board of India. This raises a question about the independent functioning of the Board.
- The Bill does not grant the right to data portability and the right to be forgotten to the data principal.
- The Bill requires all data fiduciaries to obtain verifiable consent from the legal guardian before processing the personal data of a child. To comply with this provision, every data fiduciary will have to verify the age of everyone signing up for its services. This may have adverse implications for anonymity in the digital space.
We hope you have learnt all the important aspects about the Digital Personal Data Protection (DPDP) Bill. Given the importance, Digital Personal Data Protection Bill is expected to appear in MBA Admission Interviews and as MBA GD Topics. Refer MBAUniverse.com analysis of this topic before you attend interview or group discussion. All the best!
