Digital Personal Data Protection (Amendment) Bill 2023: Impact on RTI and Privacy Rights

Why in the News?

The Digital Personal Data Protection (Amendment) Bill, 2023 has sparked a nationwide debate in India, particularly due to its perceived impact on the Right to Information (RTI) Act, 2005. While the government cites the protection of personal privacy as a priority, critics argue that the amendment could dilute the transparency and accountability mechanisms that underpin Indian democracy.

Why Is the Data Protection Amendment Controversial?

1. RTI Act Dilution

• The amendment reportedly removes citizens' access to personal information held by public authorities, previously permitted under Section 8(1)(j) of the RTI Act, 2005.
• Activists claim this undermines public interest disclosures and weakens transparency.

2. Civil Society Resistance

• Over 30 civil society organizations have opposed the changes, warning of a weakened RTI framework.
• Since the final Rules under the Act are still in draft, this provides a window for public consultation and possible revisions.

3. Privacy vs. Transparency

• The amendment is framed around the 2017 Supreme Court ruling recognizing privacy as a fundamental right.
• Critics argue that the existing RTI law already balanced privacy and transparency, and this amendment disrupts that balance.

Overview of the Digital Personal Data Protection (Amendment) Bill, 2023

Origin and Evolution

• Based on the Justice B.N. Srikrishna Committee (2018) recommendations.
• The earlier Personal Data Protection Bill, 2019 was withdrawn after review.
• A revised Digital Personal Data Protection Bill, 2023, was passed in August 2023, and subsequent amendments have led to public outcry.

Key Features of the Data Protection Bill

1. Applicability

• Applies to the processing of digital personal data within India.
• Also applicable outside India if goods/services are offered to Indian residents.

2. Consent-Based Processing

• Personal data must be processed only after informed consent.
• Individuals (Data Principals) can withdraw consent anytime.

3. Exceptions Without Consent

Consent not required in cases such as:

• Government subsidies and benefits
• Medical emergencies
• Employment purposes
• Voluntary data sharing

4. Rights of Data Principals

• Right to access, correct, erase data, and file grievances.

5. Duties of Data Principals

• Must not impersonate or file false complaints.
• Violations can attract penalties.

6. Obligations of Data Fiduciaries

• Ensure data accuracy, security, and timely deletion of data.

7. Government Exemptions

• Central government can exempt agencies on grounds like national security and public order.

8. Data Protection Board of India

Regulatory authority with powers to:

• Enforce compliance
• Impose penalties
• Resolve grievances
• Members appointed by the central government for two-year terms.

9. Cross-Border Data Transfers

• Allowed unless data is transferred to blacklisted countries.

​

Key Concerns with the Data Protection Amendment

Weakening of RTI Act

• Eliminating Section 8(1)(j) access could limit transparency in governance.

Excessive Government Exemptions

• Risk of unregulated surveillance and data misuse.

Lack of Independent Oversight

• Short tenure of Board members raises questions on autonomy and accountability.

No Right to Data Portability or Erasure

• Absence of rights like data portability and right to be forgotten restricts user control.

Inadequate Safeguards Against Harm

• Lacks provisions to protect against profiling, discrimination, or financial harm from data breaches.

Potential Benefits of the Amendment

Enhanced Individual Data Control

• Individuals get more authority over their personal data lifecycle.

Greater Accountability for Data Handlers

• Stricter obligations on data fiduciaries improve compliance and data breach reporting.

Trust in Digital Ecosystems

• Strengthened legal framework could boost user confidence in digital services.

International Compatibility

• Enables cross-border data flows, supporting India’s global digital trade aspirations.

What Lies Ahead: Outlook and Recommendations

Public & Legal Pushback Expected

• With Rules still in draft, civil society resistance and court challenges are likely.

Need to Balance Privacy and RTI

• Laws must ensure personal privacy while preserving democratic transparency.

Stronger Oversight Required

• The Data Protection Board must be independent and empowered to function effectively.

Public Consultation is Key

• The draft stage is an opportunity for inclusive dialogue and refinement of provisions.