Explained: What Is Personal Data Protection Bill And Why It Was Withdrawn In Parliament

In a surprise move, the government on Wednesday withdrew the Personal Data Protection Bill from Lok Sabha and said it will come out with a "set of fresh legislations" that will fit into the comprehensive legal framework. The government would hold a wide public consultation before putting the new legislation to Parliament, sources said.

"The government will bring a set of new legislation for a comprehensive legal framework for the digital economy," IT Minister Ashwini Vaishnaw, who moved for the withdrawal of the Bill in the House, told PTI.

According to sources, the Bill could be replaced by more than one bill, dealing with privacy and cyber security and the government may bring the new set of bills in the Winter Session of Parliament.

What is the Personal Data Protection Bill, 2019?

The Personal Data Protection Bill was passed in Parliament on December 11, 2011. 

The Bill aims,
'to provide for protection of the privacy of individuals relating to their personal data, specify the flow and usage of personal data, create a relationship of trust between persons and entities processing the personal data, protect the rights of individuals whose personal data are processed, to create a framework for organisational and technical measures in processing of data, laying down norms for social media intermediary, cross-border transfer, accountability of entities processing personal data, remedies for unauthorised and harmful processing, and to establish a Data Protection Authority of India for the said purposes and for matters connected therewith or incidental thereto.'

In the age of the growing digital economy, the Bill asserts the fundamental right to privacy and protects personal data as an essential facet of informational privacy.

The Bill was first drafted by an expert committee headed by Justice BN Srikrishna in 2018. The central government introduced a draft of the Bill in 2019 in the Lok Sabha, which was referred to the Joint Committee of Parliament (JCP) in December 2021 and was later tabled in Parliament after several extensions. 

Why was the Bill withdrawn?

The government circulated among members a statement, containing reasons for withdrawal of the Bill and it was made part of the supplementary agenda of Lok Sabha on Wednesday afternoon.
According to the statement circulated to Lok Sabha members on Wednesday, the 2019 Bill was deliberated in great detail by the JCP, which proposed 81 amendments and 12 recommendations for a comprehensive legal framework for the digital ecosystem.

"Considering the report of the JCP, a comprehensive legal framework is being worked upon. Hence, in the circumstances, it is proposed to withdraw 'The Personal Data Protection Bill, 2019' and present a new bill that fits into the comprehensive legal framework," the statement said.

The withdrawn Bill had proposed restrictions on the use of personal data without the explicit consent of citizens. It had also sought to provide the government with powers to give exemptions to its probe agencies from the provisions of the Act, a move that was strongly opposed by the opposition MPs who had filed their dissent notes.

BJP MP PP Chaudhary, who was chairperson of the JCP when it submitted its report to Parliament, told The Indian Express that it was “necessary” for the government to withdraw the Bill.

Speaking top IE, Chaudhary said, "The JCP had recommended a number of changes to the Bill and it would have been difficult for the government to add all those things in the final legislation. It would have also made it very complex to debate in Parliament."

After the Bill was withdrawn, Minister of State for IT Rajeev Chandrashekhar tweeted that this will soon be replaced by a comprehensive framework of global standard laws including digital privacy laws for contemporary and future challenges and catalyse Prime Minister Narendra Modi's vision.

He said the JCP report on the Personal Data protection bill had identified many issues that were relevant but beyond the scope of a modern Digital Privacy law.

"Privacy is a fundamental right of Indian citizens & a Trillion-dollar Digital Economy requires Global std Cyber laws," he said in another tweet.

What would be the new consideration in the re-worked Bill?

The government would hold a wide public consultation before putting the new legislation to Parliament, sources said.

The key discussions in the panel were based on whether the proposed Data Protection Authority should get constitutional status and whether States should have their own Data Protection Authorities. 

According to reports, the Bill will do away with some recommendations by the JCP such as including “trusted hardware” and local storage of some kinds of personal data within the boundaries of India. Instead, they will be better suited elsewhere than in privacy legislation; they will be brought under the larger framework for the internet ecosystem which will replace the Information Technology Act, 2000, soon.

The JCP’s report also proposed that social media companies that do not act as intermediaries are to be treated as content publishers and non-personal data be included in the ambit of the Bill.