GS Paper 2
Syllabus: Governance/ Government Policies and Interventions
Source: BBC
Context: The recently passed Digital Personal Data Protection Bill in India has raised concerns among privacy experts due to its potential impact on the landmark right to information (RTI) law.
Major Provision of the New Bill:
| Aspect | Details |
| The Digital Personal Data Protection Bill 2022 (DPDP) is India’s new law aimed at regulating the collection, storage, and processing of personal data, based on the recommendation of the committee led by retired Justice B N Srikrishna. | |
| Personal Data | Personal data is any data by which or in relation to which an individual can be identified E.g., Name, address |
| Rights of Individuals on Personal Data | Individual consent is required for collection and Processing. Individuals also have the right to withdraw consent and demand the erasure of data |
| The bill mandates that individuals can access essential information in languages listed in the Indian Constitution’s eighth schedule. | |
| The 2022 Bill outlines seven principles: | 1. Usage of personal data must be lawful, fair, and transparent.
2. Personal data should be used only for its intended purposes. 3. Data minimization is emphasized. 4. Data accuracy during collection is crucial. 5. Personal data shouldn’t be stored indefinitely; limited storage duration is mandated. 6. Safeguards must prevent unauthorized data collection or processing. 7. Accountability lies with the entity determining data processing purpose and means |
| Data Principle and Data Fiduciary | The bill defines “Data Principal” as the individual whose data is collected, “Data Fiduciary” (e.g., Facebook) as the entity controlling data processing, and acknowledges parents/ guardians as “Data Principals” for children under 18. |
| Creation of an Independent Regulator | ‘Significant Data Fiduciaries’ handle substantial personal data and will be designated by the Central government based on specific criteria. They must appoint a ‘Data Protection Officer’ and an independent Data Auditor. |
| Cross-Border Data Transfer | The bill permits cross-border data transfer to specified countries with strong data security measures, where the Indian government can access Indians’ data. This is a departure from the previous bill, which mandated local data storage requirements. |
| Grievance Redressal | Establish a Data Protection Board for enforcing compliance. If Data Fiduciary’s response is unsatisfactory, consumers can file complaints with this Board. |
| Penalties | Entities lacking “reasonable security safeguards” against data breaches face fines of up to Rs 250 crore. The proposed Data Protection Board could levy penalties of up to ₹500 crore for substantial non-compliance.Top of Form
|
| Exemptions | The bill offers exemptions (by the government) for businesses based on user numbers and data volume, addressing concerns from startups about compliance burden. National security and government agency exemptions are retained, safeguarding India’s interests. |
| Non-Personal Data | The bill mandates providing non-personal data to the government when demanded. |
The Digital Personal Data Protection Bill impacts the Right to Information (RTI) Act in the following ways:
- Exemption of Personal Information: The new data protection law changes a provision in the RTI Act to exempt “personal information” from being disclosed. This affects information sought under the RTI law.
- Impact on Transparency: Activists and experts are concerned that the change will reduce transparency and hinder the ability to access information.
- Blanket Ban on Personal Information: The new law introduces a blanket ban on personal information, making it difficult to access information even if it relates to public activities or larger public interest.
- Increased Denials: Officials are expected to deny more RTI requests using the personal information exemption, affecting the availability of crucial information.
- Exception Burden: While the change doesn’t affect the provision allowing access if public interest outweighs the harm, it shifts the burden to individuals seeking information to prove its public interest.
Other Concerns related to the draft Bill: Click Here
For Comparing India’s proposal with other countries: Click Here
Insta Links:
New draft digital data protection bill: How it compares with the older version and laws elsewhere
Mains Links:
The Digital Personal Data Protection Bill must ensure that individuals’ personal data is collected and processed in a manner that respects their privacy rights under Article 21 of the Indian constitution. Comment.
