Committee submits Data Protection Bill, emphasises empowerment of Indians

Arghya Sengupta, Research Director, Vidhi Centre for Legal Policy plays key role as member

dataprotection.jpg

Delhi: The Committee of Experts under the Chairmanship of Justice B.N. Srikrishna submitted the much anticipated ‘The Personal Data Protection Bill, 2018’ and its Report on data protection to the Ministry of Electronics and Information Technology on 27th July 2018. The Committee, of which Vidhi’s Research Director Arghya Sengupta is a member, has placed the Draft Bill and Report in the public domain after almost a year of deliberations.

The Ministry will begin the process of public consultations on the Bill, which seeks to provide a legal framework for protecting the personal information of individuals in India.

“For the Committee, the Puttaswamy judgement was like our Constitution,” said Dr. Arghya Sengupta. “We have learnt from best practices that exist in developed countries but the Bill has been drafted with Indian realities in mind. It is a template for empowerment, progress, and innovation, not just in India but in the global South, where the number of internet users is growing rapidly.”

The Committee recognised that individuals to whom personal data belongs (“data principals”)  are central to the legal framework. Therefore, other than very specific instances where other grounds of processing personal data are allowed, data fiduciaries may only process personal data where the data principal has given her free, informed and specific consent which is capable of being withdrawn. Additionally, the law also provides heightened protection to sensitive personal data by requiring the data principals’ explicit consent.

Enforcement and compliance mechanisms for the proposed law have been bolstered to ensure that data principals’ rights are protected. This includes giving an independent Data Protection Authority (“DPA”) the powers of inquiry, search and seizure, and imposition of penalties for violations of obligations imposed on data fiduciaries. Apart from putting into place ex post measures of regulating violations of the law, the Draft Bill also proposes that ex ante measures of organisational access control be put into place where data fiduciaries are encouraged to build in privacy-enhancing practices into their organisational framework.

The law is going to be applicable to both private and public entities processing personal data. Further, significant deterrent measures have been developed in the proposed law. For instance, data fiduciaries can be liable to pay penalties up to Rs. 15 crore or 4 percent of their worldwide turnover for committing certain offences.

Data is becoming a valuable resource as India embraces a digital economy. A strong data protection law is necessary for data-driven innovation to flourish. At the same time, the Committee has endeavored to strike a balance between the fundamental right to privacy of individuals and the needs of industry. Further, the law has facilitated and encouraged contextual sectoral responses. In order to ensure that data protection regulatory activity is truly participatory and democratic, provision has been made for the DPA to approve codes of practice in consultation with sectoral regulators, industry or trade associations, and data principals.

Over the last three years, the Vidhi Centre for Legal Policy has emerged as a leading think tank in the area of data protection and privacy. Vidhi had assisted the Committee in drafting the White Paper on ‘A Data Protection Framework for India’ in 2017. Subsequently, Vidhi has also worked with the Committee to analyse public comments and provide research and drafting support to prepare the Draft Bill and Report. Going forward, Vidhi will continue to inform the public discourse on data protection and collaborate with all stakeholders to ensure fair and effective implementation of data protection norms.

The Personal Data Protection Bill, 2018 can be accessed here: http://meity.gov.in/content/personaldata-protection-bill-2018

 Data Protection Framework and committee Report can be downloaded here: http://meity.gov.in/writereaddata/files/Data_Protection_Committee_Report.pdf

For further details contact Ms. Remya Muralidharan: remya.muralidharan@vidhilegalpolicy.in, 9971685468