Why the Personal Data Protection Bill is bad news for business

News: Personal Data Protection Bill seeks to regulate the use of data and to foster a privacy protection framework in the country. However, it fails to strike the balance between privacy rights and ease of doing business.

What are the areas of concern with the Data Protection Bill?

How the Personal Data Protection bill is bad for business?

First, It imposes several regulatory burdens on businesses. The burden of these regulations can be fatal to new entrants/startups.

Second, Some portions of the bill are out of sync with international data protection practices. This could hamper India’s competitive advantage as a digital market and can stunt the growth of our digital economy.

Third, The bill entirely prohibits the transfer of ‘critical data’ to move outside India. The definition of this critical data is entirely decided by the authorities and not defined in the bill. These requirements can destroy the basic value of the digital economy and can place India in the same category as protectionist China.

Fourth, The bill requires companies to have data protection officers physically located within India. This step can be seen as less about protection and more about protectionism by the outside world.

Fifth, JPC has recommended monitoring, testing and certification of all hardware to ensure its integrity and trustworthiness. This is to ensure that no malicious software may cause a data breach.

However, this may contradict the goal of electronics manufacturing as such wide requirement is unheard of even in the EU’s GDPR. This also ignores existing requirements under the bureau of Indian standards.

Sixth, Extensive compliance requirements like conducting audits, impact assessments are not known in any data Protection regime. This may deter wholesome participation by businesses in the Indian market. Also, technology companies that thrive on competitive advantage will be reluctant to share information.

What should be the way forward?

Search regulatory mechanism is more likely to be interventionist than facilitative.
This will negatively impact innovation and ease of doing business. The government should consider its provisions and the unintended consequences of such a rigid regulatory regime.

Source: This post is based on the article “Why the Personal Data Protection Bill is bad news for business” published in the Indian Express on 24th January 2022.