Details Awaited – Personal data protection bill this time does well to emphasise purpose limitation. But subsequent rules are the key

Source: The post is based on the article “Details Awaited – Personal data protection bill this time does well to emphasise purpose limitation. But subsequent rules are the key” published in The Times of India on 4^th August 2023.

Syllabus: GS 2 – Government Policies and Interventions for Development in various sectors and Issues arising out of their Design and Implementation.

Relevance: About Digital Personal Data Protection Bill, 2023

News: Recently, the Digital Personal Data Protection Bill, 2023, was introduced in Lok Sabha after the changes made on recommendation of the parliamentary committee.

What are the key provisions of the new Digital Personal Data Protection Bill, 2023?

The Bill has three notable features:

Firstly, it emphasizes purpose limitation to prevent data misuse, ensuring that even unwittingly given consent does not grant access beyond the specified purpose.

For example, a food delivery app may in its fine print also seek the phone contact list. The bill clearly spells out that even if consent is unwittingly given, purpose limitation will apply. In this example, the phone contact list will be out of bounds for the app.

Secondly, individuals have the right to have their data erased.

Thirdly, the bill introduces consent managers, licensed intermediaries, to help people navigate the legal aspects of consent.

However, the effectiveness of the bill depends on the subordinate legislation or rules that the government will later draft.

Must Read: Data Protection Bill approved by Cabinet: Content, concerns and The dangers in the Digital Personal Data Protection Bill

What can be the way ahead?

First, the drafted rules should provide clear definitions for exemptions from the checks imposed by data protection law.

Currently, the government has a broad exemption for using the personal data for upholding sovereignty and public order. However, these exceptions should be more specific and precise, considering that governments collect significant amounts of personal data.

Second, privacy being a fundamental right, the bill needs to be thoroughly debated in the Parliament. However, considering India’s significant amount of unprotected personal data, the bill’s passage should not be delayed.