New Digital Personal Data Protection Bill in Monsoon Session

Source: The post is based on the article “New Digital Personal Data Protection Bill in Monsoon Session” published in The Hindu on 12th April 2023

What is the News?

The Government of India has told the Supreme Court that the new Data Protection Bill will be introduced in the monsoon session of Parliament.

What is the purpose of the Data Protection Bill?

Purpose: To provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process personal data for lawful purposes.

To be replaced by: The bill would replace the current Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules which was notified in 2011. 

– Note: The Supreme Court recognised privacy as a fundamental right in 2017 and highlighted the need to protect online personal data from prying eyes.

Applicability: The Bill will apply to the processing of digital personal data within India where such data is collected online, or collected offline and is digitized. It will also apply to such processing outside India if it is for offering goods or services or profiling individuals in India.

Definitions: The Bill defines data as a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by humans or by automated means”.

– The Bill separately defines 1) data fiduciary as persons who determined the purpose and means of processing personal data, 2) data principal as the individual to whom the personal data is related to and 3) data processor as any person who processes personal data on behalf of a data fiduciary.

What are the key Provisions of the bill?

Personal data may be processed only for a lawful purpose for which an individual has given consent. Consent may be deemed in certain cases.

Data fiduciaries will be obligated to maintain the accuracy of data, keep data secure, and delete data once its purpose has been met.

The Bill grants certain rights to individuals including the right to obtain information, seek correction and erasure, and grievance redressal.

The central government may exempt government agencies from the application of provisions of the Bill in the interest of specified grounds such as security of the state, public order, and prevention of offences.

The central government will establish the Data Protection Board of India to adjudicate non-compliance with the provisions of the Bill.