Data Protection Bill, 2019
Polity & Governance
18th Dec, 2019
- The Personal Data Protection Bill, 2019 has been introduced in Lok Sabha by the Minister of Electronics and Information Technology, Mr. Ravi Shankar Prasad, on December 11, 2019.
- The Bill seeks to provide for protection of personal data of individuals, and establishes a Data Protection Authority for the same.
About the Bill-
- The Personal Data Protection bill, drafted by a panel headed by a former Supreme Court judge and submitted to the government last year, is key for how firms including global tech giants Amazon, Facebook, Alphabet's Google and others process, store and transfer Indian consumers' data.
- Broad guidelines on collection, storage and processing of personal data, consent of individuals, penalties and compensation, code of conduct and an enforcement model is likely to be a part of the law.
- Personal data is data which pertains to characteristics, traits or attributes of identity, which can be used to identify an individual.
- The Bill categorises certain personal data as sensitive personal data. This includes financial data, biometric data, caste, religious or political beliefs, or any other category of data specified by the government, in consultation with the Authority and the concerned sectoral regulator.
The Bill governs the processing of personal data by:
(ii) companies incorporated in India, and
(iii) foreign companies dealing with personal data of individuals in Indi
About data fiduciary-
- A data fiduciary is an entity or individual who decides the means and purpose of processing personal data. Such processing will be subject to certain purpose, collection and storage limitations.
- For instance, personal data can be processed only for specific, clear and lawful purpose. Additionally, all data fiduciaries must undertake certain transparency and accountability measures such as:
- (i) implementing security safeguards (such as data encryption and preventing misuse of data), and
- (ii) instituting grievance redressal mechanisms to address complaints of individuals. They must also institute mechanisms for age verification and parental consent when processing sensitive personal data of children.
About the Rights of the individual-
The Bill sets out certain rights of the individual (or data principal). These include the right to:
(i) obtain confirmation from the fiduciary on whether their personal data has been processed,
(ii) seek correction of inaccurate, incomplete, or out-of-date personal data,
(iii) have personal data transferred to any other data fiduciary in certain circumstances, and
(iv) restrict continuing disclosure of their personal data by a fiduciary, if it is no longer necessary or consent is withdrawn.
Why companies are worried?
- The proposed law may have a considerable impact on MNCs operating in India, whether with or without a physical presence, due to its data localisation requirements and cross-border data transfer restrictions.
- The Reserve Bank of India had, in April last year, issued a data localisation directive, mandating all authorised payment system operators and banks to store payment systems data only in India.
- This led to various ambiguities in the requirements as well as industry pushback on the strict requirements imposed, especially by global payment companies.
Grounds for processing personal data-
- The Bill allows processing of data by fiduciaries only if consent is provided by the individual. However, in certain circumstances, personal data can be processed without consent.
- These include: (i) if required by the State for providing benefits to the individual, (ii) legal proceedings, (iii) to respond to a medical emergency.
Data Protection Authority-
The Bill sets up a Data Protection Authority which may:
- take steps to protect interests of individuals,
- prevent misuse of personal data, and
- ensure compliance with the Bill.
- It will consist of a chairperson and six members, with at least 10 years’ expertise in the field of data protection and information technology. Orders of the Authority can be appealed to an Appellate Tribunal. Appeals from the Tribunal will go to the Supreme Court.
The Bill amends the Information Technology Act, 2000 to delete the provisions related to compensation payable by companies for failure to protect personal data. The central government may direct data fiduciaries to provide it with any: (i) non-personal data and (ii) anonymised personal data (where it is not possible to identify data principal) for better targeting of services.