| Introduction: Contextual introduction. Body: Explain how the Digital Personal Data Protection Bill, 2022 is an improvement over Personal Data Protection Bill, 2019. Also write several issues in it. Conclusion: Write a way forward. |
The Union Government has released the fourth iteration of a data protection law in India, now called the Digital Personal Data Protection Bill, 2022. The Personal Data Protection Bill, 2018, was proposed by the Justice Srikrishna Committee.
An improvement:
- Cross border data flows: The PDP Bill, 2019 provided for local storage of data within India’s geography. The DPDP Bill, 2022 allows for cross border data flow to “countries and territories” notified by the Central government.
- Regulatory framework: the current draft considerably reduces the scope of the proposed Data Protection Board of India (DPB). Out of the 22 clauses in the DPDP Bill, the Central government has been provided with rule making power in around 14 clauses.
- Disempowering the data principals: the DPDP Bill, 2022 does not allow them to seek compensation from data fiduciaries for harms they have suffered due to unlawful processing.
- Penalties: the quantum of penalties that can be imposed, with the cap being placed at ₹500 crore, are of a much higher magnitude than provided for under the PDP Bill, 2019. It places duties on data principals.
- The bill recognises the data principal’s right to postmortem privacy (Withdraw Consent) which was missing from the PDP Bill, 2019.
Concerns:
- Age of digital consent continues to be 18. It would result in unequal access to the internet and, finally, requiring consent from parents would hamper autonomous development of children. Such restrictions are in violation of India’s obligations under the Convention on Rights of the Child.
- It does not provide for the right of data portability which empowered data principals by allowing them to choose between different platforms and enhanced competition to increase consumer welfare.
- It subsumes the right to be forgotten under the right to erasure. This compromises on the right to freedom of speech and expression of other individuals.
- Moreover, the DPDP Bill, 2022 fails to provide adequate legislative guidance for framing these rules. This leads to the concern of excessive delegation of legislation.
- The Central government exercises greater control over the proposed Data Protection Board of India (DPB) because it will appoint members of the DPB, set out the terms and conditions of appointment and lay out its functions.
The exemption provided under the Bill should be “just, fair, reasonable and proportionate procedure”. So, providing greater power to the government as opposed to an independent statutory authority, need to be re-examined.
