Explained: Data Protection Bill Receives Cabinet Nod. What Are The Concerns?

The Union Cabinet on Wednesday gave its nod to the draft of the Digital Data Protection Bill, which will be tabled in the monsoon session of the parliament. The version of the Bill approved by the Cabinet has retained most of the provisions that were present in the draft issued by the Ministry of Electronics and IT (Meity) in November 2022, which were flagged by experts for privacy concerns.

It has been nearly six years since the Supreme Court upheld privacy as a fundamental right. However, there has been no legislation for protection of data yet. The first version of such a legislation was presented in late 2019 but was later withdrawn after it was worked on for nearly five years, after the "numerous changes" recommended by the Joint Parliamentary Committee. A new draft of the Bill was issued in November 2022.

What did the Data Protection Bill, 2022 Draft include?

The Personal Data Protection (PDP) Bill was renamed the Digital Data Protection Bill. The new Bill proposed to set up an appellate body known as the Data Protection Board, instead of the Data Protection Authority. 

It also proposed to exempt government notified data fiduciaries from sharing details of data processing with the data owners under the "Right to Information about personal data". 

The Union government was also bestowed with the authority to establish "fair and reasonable" reasons for which personal data can be used without the consent of a data principal. 

The proposed Bill further established severe penalties for violations of any of the legislation's provisions, which will be determined by the Data Protection Board of India. It provided financial penalties with a cap of ₹500 crores; which is higher than what was proposed in the PDP Bill 2019. 

It had proposed to omit Section 43 A of the IT Act, which relates to the provision for compensation to be paid to victims in case of data protection.

What were the concerns surrounding Data Protection Bill, 2022?

While the legislation prioritises obtaining consent from the owner of data before it is given, experts have flagged the wide-ranging exceptions given to the government and its bodies. 

One such outright exemption provided to the government for the procession of personal data is if it is in the interest of "India's sovereignty and integrity, security, friendly relations with foreign states, public order maintenance, or avoiding incitement to any cognizable offence relating to any of these."  This provides the government an unsolicited and disproportionate influence that may be utilized for their own benefit, and it places citizens' personal data under the hands of the government without the permission of the data principal, a LiveLaw report noted. 

The internet rights organisation, Internet Freedom Foundation, said that the Bill "fails to adequately address data protection concerns and instead puts in place a regime to facilitate the data processing activities of state and private actors."

Were public consultations taken on the Bill?

The Personal Data Protection Bill, 2019 was introduced in the Parliament on December 11, 2019, it was sent to a Joint Parliamentary Committee with members from both the Houses for its review and suggestions. After nearly two years and several extensions, the Joint Committee on the Personal Data Protection Bill, 2019 brought out its report on December 16, 2021. However, it was later withdrawn.

The PDP Bill, 2022 was released on November 18, 2022 for public consultation. Lawyer and Internet Freedom Foundation head Apar Gupta observed that he consultation process was not inclusive at all, considering it was conducted through the MyGov platform, and individuals were required to register via mobile, limiting accessibility. 

"Were the responses made public? (no) What was the composition of stakeholders in terms of percentage distribution? (not provided) Was there a robust process in place to analyze and incorporate the feedback received? (not disclosed) If changes were implemented based on the submissions, why was the rationale not shared publicly?" he said in a tweet. 

The contents of the Bill will remain confidential until it is tabled in the Parliament. The monsoon session of Parliament is scheduled to be held from July 20 to August 11.