cross-border data

Personal Data Protection Bill

Rajeev Chandrasekhar

chart

data policy

AI, Artificial Intelligence

<div>
	The first codification of the fundamental right to privacy as affirmed by the Supreme Court, the Personal Data Protection Bill aims to provide individuals protect their personal data privacy and keep their fundamental rights whose personal data are processed, along with creating a framework for measures in the processing of data and remedies for unauthorised and harmful content. To achieve these, the Bill proposes to build the Data Protection Authority of India.</div>
<div>
	&nbsp;</div>
<div>
	<strong>Introduction of Personal Data Protection Bill</strong></div>
<div>
	&nbsp;</div>
<div>
	Introduced by Union minister Ravi Shankar Prasad, the Ministry of Electronics and Information Technology in 2017 set up a committee to check on issues related to personal data and its protection.</div>
<div>
	&nbsp;</div>

<div>
	The initial draft was prepared and presented a year later in July 2018 by the committee headed by retired Supreme Court judge Justice B N Srikrishna. The delay has reportedly been caused by multiple amendments and inter-ministerial consultations. In 2019, the Bill was cleared by the Union Cabinet and was tabled on 11 December.</div>
<div>
	&nbsp;</div>
<div>
	The Bill was introduced in the Lok Sabha in February 2020 and has been referred to a Joint Parliamentary Committee (JPC) of both the Houses, headed by BJP MP Meenakshi Lekhi, for examination and report.</div>
<div>
	&nbsp;</div>
<div>
	<strong>Provisions of the Bill</strong></div>
<div>
	&nbsp;</div>
<div>
	The provisions of this Act shall apply to:</div>
<div>
	&nbsp;</div>
<div>
	1. The processing of personal data where such data has been collected, disclosed, shared, or otherwise processed within the territory of India.</div>
<div>
	&nbsp;</div>
<div>
	2. The processing of personal data by the state, any Indian company, any citizen of India or any person or body of persons incorporated or created under Indian law.</div>
<div>
	&nbsp;</div>
<div>
	3. The processing of personal data by data fiduciaries or data processors not present within the territory of India, if such processing is in connection with any business carried on in India, or any systematic activity of offering goods or services to data principals within the territory of India; or in connection with any activity which involves profiling of data principals within the territory of India.</div>
<div>
	&nbsp;</div>
<div>
	The provisions of this Act shall not apply to the processing of anonymised data, other than the anonymised data referred to in section 91.</div>
<div>
	&nbsp;</div>
<div>
	<strong>What is personal data and personal data breach</strong></div>
<div>
	&nbsp;</div>
<div>
	According to the draft, &quot;Personal data&quot; means data about or relating to a natural person who is directly or indirectly identifiable, having regard to any characteristic, trait, attribute, or any other feature of the identity of such natural person, whether online or offline, or any combination of such features with any other information, and shall include any inference drawn from such data for the purpose of profiling.</div>
<div>
	&nbsp;</div>
<div>
	Whereas, &quot;personal data breach&quot; means any unauthorised or accidental disclosure, acquisition, sharing, use, alteration, destruction of, or loss of access to, personal data that compromises the confidentiality, integrity, or availability of personal data to a data principal.</div>
<div>
	&nbsp;</div>
<div>
	<strong>Sensitive personal data</strong></div>
<div>
	&nbsp;</div>
<div>
	The &quot;sensitive personal data&quot; means such personal data constitute&mdash;</div>
<div>
	&nbsp;</div>
<div>
	1. Financial data</div>
<div>
	2. Health data</div>
<div>
	3. Official identifier</div>
<div>
	4. Sex life</div>
<div>
	5. Sexual orientation;</div>
<div>
	6. Biometric data;</div>
<div>
	7. Genetic data;</div>
<div>
	8. Transgender status;</div>
<div>
	9. Intersex status;</div>
<div>
	10. Caste or tribe;</div>
<div>
	11. Religious or political belief or affiliation; or</div>
<div>
	12. Any other data categorised as sensitive personal data under section 15.</div>
<div>
	&nbsp;</div>
<div>
	<strong>Criticism of the Bill</strong></div>
<div>
	&nbsp;</div>
<div>
	On November 22, 2021, Congress&rsquo; Jairam Ramesh, Manish Tewari, Vivek Tankha, and Gaurav Gogoi, the Biju Janata Dal&rsquo;s (BJD) Amar Patnaik, and the Trinamool Congress&rsquo; (TMC) Derek O&rsquo;Brien and Mahua Moitra sent dissent notes to the committee chairman P P Chaudhary.</div>
<div>
	&nbsp;</div>
<div>
	The committee&#39;s Opposition members are concerned that the proposed Bill, in the guise of national security, may encroach on the powers of state governments. This is reflected in the objections flagged by parties like the TMC and even the BJD.</div>
<div>
	&nbsp;</div>
<div>
	While praising the &ldquo;democratic, transparent and consultative&rdquo; approach taken by the JPC, Ramesh has proposed that the government not be given sweeping powers by keeping it out of the purview of the proposed legislation.</div>
<div>
	&nbsp;</div>
<div>
	Gogoi has also raised the same issue, along with questioning the rationale for the removal of a clause that penalised companies for data breaches.</div>
<div>
	&nbsp;</div>
<div>
	&ldquo;Previously, the government had brought very high and strict penalties. It is only when penalties are high that technology companies are forced to comply with the regulations. That is what we have seen in Europe and other parts of the world,&rdquo; said Gogoi. The removal of this clause at the last minute does not have the unanimity of the committee, he added.</div>
<div>
	&nbsp;</div>
<div>
	Penalties in the earlier draft of the Personal Data Protection Bill ranged from Rs 5 crore to Rs 15 crore, or 2-4 per cent of the worldwide turnover of the entity depending on the nature of the offence.</div>
<div>
	&nbsp;</div>

Learn what is Personal Data Protection Bill, its provisions, analysis, data privacy and its requirement here at Business Standard.

Personal Data Protection Bill

What is Personal Data Protection Bill ?

Latest Updates on Personal Data Protection Bill

Important to put curbs on cross-border data flow: CAIT writes to minister

Data Bill to cause a behavioural change in firms: Rajeev Chandrasekhar

'We had two options: Complex law or start with clean slate': MoS IT

Centre withdraws Personal Data Protection Bill, industry disappointed

India's investments in AI to cross $880 mn by 2023: NASSCOM report