{"id":54214,"date":"2019-12-07T14:54:00","date_gmt":"2019-12-07T09:24:00","guid":{"rendered":"https:\/\/blogadmin.forumias.com\/?p=54214"},"modified":"2020-02-26T15:01:12","modified_gmt":"2020-02-26T09:31:12","slug":"7-pm-taking-it-personally-data-protection-bill-7th-december-2019","status":"publish","type":"post","link":"https:\/\/forumias.com\/blog\/7-pm-taking-it-personally-data-protection-bill-7th-december-2019\/","title":{"rendered":"7 PM | Taking it personally: Data Protection Bill| 7th December 2019"},"content":{"rendered":"\n<p><strong>Context:\n<\/strong>The\nPersonal Data Protection Bill.<\/p>\n\n\n\n<p><strong>More\nin news:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>The Personal Data Protection Bill could\nbe introduced in either house of the Parliament in the current Winter Session\nwhich will conclude on December 13.<\/li><\/ul>\n\n\n\n<p><strong>Personal\nData: <\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>According to the Justice B. N.\nSrikrishna committee of experts on a Data Protection Framework for India,\n\u201cpersonal data includes data from which an individual may be identified or\nidentifiable, either directly or indirectly\u201d.&nbsp; <\/li><li>The Committee sought to distinguish\npersonal data protection from the protection of sensitive personal data, since\nits processing could result in greater harm to the individual.&nbsp; <\/li><li>Sensitive data is related to intimate\nmatters where there is a higher expectation of privacy (e.g., caste, religion,\nand sexual orientation of the individual). &nbsp;<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" width=\"750\" height=\"724\" src=\"https:\/\/i0.wp.com\/blogadmin.forumias.com\/wp-content\/uploads\/2020\/02\/7-dec.jpg?resize=750%2C724&#038;ssl=1\" alt=\"\" class=\"wp-image-54215\"\/><\/figure>\n\n\n\n<p><strong>Justice\nB. N. Srikrishna committee:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>The Committee was constituted by the\nunion government in July 2017, to deliberate on a data protection framework.<\/li><li>The Supreme Court in its&nbsp;Puttaswamy\njudgment, 2017&nbsp;declared privacy a fundamental right. This set the\ngovernment in motion to take steps to bring a new data protection legislation\nfor the country.<\/li><li>The report has emphasized those\ninterests of the citizens and the responsibilities of the state have to be\nprotected, but not at the cost of trade and industry.<\/li><\/ul>\n\n\n\n<p><strong>The\nDraft Personal Data Protection Bill, 2018:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Definitions:&nbsp;<\/strong>The\nBill defines <\/li><li>\u2018personal\ndata\u2019 as any information which renders an individual identifiable, <\/li><li>data\n\u2018processing\u2019 as any operation, including collection, manipulation, sharing or\nstorage of data, <\/li><li>\u2018data\nprincipal\u2019 as the individual whose personal data is being processed, <\/li><li>\u2018data\nfiduciary\u2019 as the entity or individual who decides the means and purposes of\nprocessing data, <\/li><li>\u2018data\nprocessor\u2019 as the entity or individual who processes data on behalf of the\nfiduciary.<\/li><li><strong>Regulation:\n<\/strong>The\nBill regulates the processing of personal data of individuals (data principals)\nby government and private entities (data fiduciaries) incorporated in India and\nabroad.&nbsp; Processing is allowed if the individual gives consent, or in a\nmedical emergency, or by the State for providing benefits.<\/li><li><strong>Copy\nof personal data: <\/strong>The Bill requires that a serving copy of\npersonal data be stored within the territory of India. &nbsp;Certain critical\npersonal data must be stored solely within the country.<\/li><li><strong>Data\nProtection Authority (DPA): <\/strong>A national-level Data Protection\nAuthority (DPA) is set up under the Bill to supervise and regulate data\nfiduciaries. The Authority is empowered to: <\/li><li>take\nsteps to protect interests of individuals,<\/li><li>prevent\nmisuse of personal data, <\/li><li>ensure\ncompliance with the Bill.&nbsp;<\/li><li><strong>Rights\nof the individual:&nbsp;<\/strong>The Bill sets out certain rights of the\nindividual.&nbsp; These include:<\/li><li>right to obtain confirmation from the\nfiduciary on whether its personal data has been processed, <\/li><li>right to seek correction of inaccurate,\nincomplete, or out-of-date personal data, <\/li><li>right to have personal data transferred\nto any other data fiduciary in certain circumstances.<\/li><li><strong>Obligations\nof the data fiduciary:<\/strong>&nbsp;The Bill sets out obligations of\nthe entity who has access to the personal data (data fiduciary) such as:<\/li><li>implementation\nof policies with regard to processing of data, <\/li><li>maintaining\ntransparency with regard to its practices on processing data, <\/li><li>implementing\nsecurity safeguards (such, as encryption of data), <\/li><li>instituting\ngrievance redressal mechanisms to address complaints of individuals.<\/li><li><strong>Grounds\nfor processing personal data:&nbsp;<\/strong>The Bill allows\nprocessing of data by fiduciaries if consent is provided.&nbsp; However, in\ncertain circumstances, processing of data may be permitted without consent of\nthe individual which includes: <\/li><li>if\nnecessary for any function of Parliament or state legislature, or if required\nby the state for providing benefits to the individual, <\/li><li>if\nrequired under law or for th\u00ad\u00ad\u00ad\u00ade compliance of any court judgement<\/li><li>to\nrespond to a medical emergency, threat to public health or breakdown of public\norder, <\/li><li>for\nreasonable purpos\u00ad\u00ades specified by the Authority, related to activities such as\nfraud detection, debt recovery, and whistle blowing.<\/li><li><strong>Exemptions:&nbsp;<\/strong>The\nBill provides exemptions to certain data processing activities.&nbsp; It states\nthat processing of an individual\u2019s personal data will not be subject to the\nobligations specified, and the data principal will not have the rights defined\nin the Bill, if their personal data is processed for the purposes of <\/li><\/ul>\n\n\n\n<p>(i)\nnational security (pursuant to a law), <\/p>\n\n\n\n<p>(ii)\nprevention, detection, investigation and prosecution of contraventions to a\nlaw, <\/p>\n\n\n\n<p>(iii)\nlegal proceedings, <\/p>\n\n\n\n<p>(iv)\npersonal or domestic purposes, <\/p>\n\n\n\n<p>(v)\njournalistic purposes.<\/p>\n\n\n\n<p><strong>Key\nIssues:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Civil society groups have criticised the\nopen-ended exceptions given to the government in the Bill, allowing for\nsurveillance.<\/li><li>The Bill mandates storage of a copy of\npersonal data within India to expedite law enforcement\u2019s access to data.&nbsp;\nThis purpose may not be served in some cases, such as when the fiduciary is\nregistered as an entity in a foreign country. Moreover, it is contended that\nsecurity and government access are not achieved by localisation. Even if the\ndata is stored in the country, the encryption keys may still be out of reach of\nnational agencies.<\/li><li>The Supreme Court, in&nbsp;Puttaswamy vs\nUoI, allowed exceptions to the right to privacy of an individual under certain\nsituations.&nbsp; These include cases where a larger public purpose is\nsatisfied by the infringement of privacy of an individual.&nbsp; Such an\nexemption must be backed by a law, and must be necessary for and proportionate\nto achieving the purpose.&nbsp;However, it is unclear if exemptions for legal\nproceedings, or for research and journalistic purposes meet the requirements of\nnecessity and proportionality.&nbsp;<\/li><li>The data principal may raise a complaint\nonly if a violation of the provisions of the Bill has caused, or may cause them\nharm.&nbsp; It could be questioned why the mere violation of the rights of the\nprincipal is not enough to raise a complaint.&nbsp; The data principal\nadditionally has to demonstrate and prove that harm has been caused to them by\nunlawful data processing; and this may place undue burden on the data\nprincipal.<\/li><\/ul>\n\n\n\n<p><strong>Way\nforward:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Bringing in a legislation on the data\nprotection in the country would protect individual privacy, ensure autonomy,\nallow data flows for a growing data ecosystem.<\/li><li>It can create a free and fair digital\neconomy where freedom is the enhancement of individual autonomy with regard to\npersonal data and fairness is the regulatory framework where this individual\nright is respected.<\/li><li>The Personal Data Protection Bill is\ndesigned to fall between the laissez faire approach of US law and the much\nstricter regimen of the General Data Protection Regulation (GDPR) in force in\nthe European Union, striking a balance between the imperatives of privacy and\nsecurity.<\/li><\/ul>\n\n\n\n<p><strong>Source:\n<\/strong><a href=\"https:\/\/indianexpress.com\/article\/opinion\/editorials\/personal-data-protection-bill-privacy-security-6154541\/\">https:\/\/indianexpress.com\/article\/opinion\/editorials\/personal-data-protection-bill-privacy-security-6154541\/<\/a><strong><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Context: The Personal Data Protection Bill. More in news: The Personal Data Protection Bill could be introduced in either house of the Parliament in the current Winter Session which will conclude on December 13. Personal Data: According to the Justice B. N. Srikrishna committee of experts on a Data Protection Framework for India, \u201cpersonal data&hellip; <a class=\"more-link\" href=\"https:\/\/forumias.com\/blog\/7-pm-taking-it-personally-data-protection-bill-7th-december-2019\/\">Continue reading <span class=\"screen-reader-text\">7 PM | Taking it personally: Data Protection Bill| 7th December 2019<\/span><\/a><\/p>\n","protected":false},"author":61,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"footnotes":""},"categories":[130,955,9],"tags":[],"class_list":["post-54214","post","type-post","status-publish","format-standard","hentry","category-7-pm","category-7-pm-brief-infograph","category-public","entry"],"jetpack_featured_media_url":"","views":{"total":0,"cached_at":"","cached_date":1704949173},"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/forumias.com\/blog\/wp-json\/wp\/v2\/posts\/54214","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forumias.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forumias.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forumias.com\/blog\/wp-json\/wp\/v2\/users\/61"}],"replies":[{"embeddable":true,"href":"https:\/\/forumias.com\/blog\/wp-json\/wp\/v2\/comments?post=54214"}],"version-history":[{"count":0,"href":"https:\/\/forumias.com\/blog\/wp-json\/wp\/v2\/posts\/54214\/revisions"}],"wp:attachment":[{"href":"https:\/\/forumias.com\/blog\/wp-json\/wp\/v2\/media?parent=54214"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forumias.com\/blog\/wp-json\/wp\/v2\/categories?post=54214"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forumias.com\/blog\/wp-json\/wp\/v2\/tags?post=54214"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}