70% respondents want data protection bill to drop localisation rule: Survey

New legislation should clearly define nature of datasets, respondents say

Proposed government legislation on data protection must exclude non-personal data and allow cross-border transfers, a majority of respondents told a private company’s survey.

The government early in August withdrew the Personal Data Protection (PDP) Bill, 2019, after four years of deliberations. The government said it would bring a new Bill with a "comprehensive framework" and "contemporary digital privacy laws ".

The draft PDP Bill included provisions on non-personal data while mandating intermediary platforms to store at least one serving copy of personal data on a server in the Indian Territory. A survey by data privacy solutions provider Tsaaro said on Monday 55 per cent of respondents want cross-border transfers without government approval. As many as 73 per cent of respondents said the bill should not govern non-personal data.

The survey had 847 professionals in the privacy domain as respondents and it was conducted online almost a week after the PDP Bill was withdrawn.

Several civil society groups and think tanks had opposed the draft bill saying that it gave sweeping rights to government and law enforcement agencies. When questioned about the government’s powers under the new bill to process citizens’ data without consent, 55 per cent of the respondents said the citizens should be informed and should have a right to consent in these situations.

The survey said 79 per cent of people agreed with the appointment of the Data Protection Authority (DPA) proposed under the draft PDP bill. When asked about the proposed collaborations of other regulators like TRAI and RBI with the DPA, 71 per cent of the respondents believed that a collaboration might help in the resolution of multi-sectoral grievances.

Around 78 per cent of participants said the new bill should clearly define critical and sensitive datasets. “India has attempted to create a complex new legal framework for data protection in a much shorter period than it took Europe to craft the General Data Protection Regulation. This means that shortcomings are inevitable, and implementation challenges are expected,” Tsaaro said in a statement.

“Taking multiple suggestions into account from the individuals who took up the survey, a compiled suggestion that has come across is that they believe that the DPB has to be comprehensive since our diversity and issues are way different from that of any developed country (UK, EU or the US), so a full-on replica of their legislation wouldn’t be feasible,” the company said.