The Dangers In The Digital Personal Data Protection Bill

Relevance: GS 2 - Government policies and interventions for development in various sectors and issues arising out of their design and implementation; Transparency & accountability and institutional and other measures. GS4 - Information sharing and transparency in government, Right to Information.

(Source: The Hindu,08/02/23)

Click here for Daily Current Affairs

Why in the news?

• The Indian government is on the verge of introducing the Digital Personal Data Protection (DPDP) Bill in Parliament, signifying a major milestone in data privacy legislation. However, the process surrounding the Bill and its potential impact have raised questions about transparency and citizens' rights.

What are the issues with the Digital Personal Data Protection Bill?

• Impacting fundamental rights: The DPDP Bill of 2022 includes provisions that may impact citizens' fundamental rights, especially the Right to Information (RTI) Act.
• The DPDP Bill 2022 proposes amendments to Section 8(1)(j) to exempt all personal information, jeopardizing transparency and accountability.
• Justice A.P. Shah Report on Privacy noted that data protection law doesn't require changes to the RTI Act.
• Excessive discretionary powers to the government: The DPDP Bill, 2022, grants the central government the power to exempt any government or private sector entity from the law's provisions through a simple notification.
• This opens the possibility of arbitrary exemptions for favored entities, and government bodies like the UIDAI, leading to potential privacy violations. However, smaller organizations, including NGOs, research institutions, and Opposition parties, would face stringent data fiduciary obligations without exemption.
• Lack of autonomy to the Data Protection Board: The Data Protection Board, responsible for enforcing the law, lacks sufficient autonomy as the central government holds significant power over its composition, selection, and removal of members.
• The chief executive responsible for managing the board is to be appointed by the government.
• The idea of a government-controlled Data Protection Board with the power to impose hefty fines raises concerns about possible misuse to target political opposition and dissenters.

Key features of Digital Personal Data Protection Bill

• Applicability: The Bill will apply to the processing of digital personal data within India where such data is:
  • collected online, or collected offline and is digitised.
  • It will also apply to the processing of personal data outside India, if it is for offering goods or services or profiling individuals in India.
• Personal data is defined as any data about an individual who is identifiable by or in relation to such data.
• Processing has been defined as an automated operation or set of operations performed on digital personal data.It includes collection, storage, use, and sharing.

• Consent: Personal data may be processed only for a lawful purpose for which an individual has given consent. Consent will be deemed given where processing is necessary for:
  • performance of any function under a law,
  • provision of service or benefit by the State,
  • medical emergency,
  • employment purposes, and
  • specified public interest purposes such as national security, fraud prevention, and information security.
• For individuals below 18 years of age, consent will be provided by the legal guardian.
• Rights and duties of data principal: An individual, whose data is being processed (data principal). The Bill grants certain rights to individuals including the right to obtain information, seek correction and erasure, and grievance redressal.
• Obligations of data fiduciaries: The entity determining the purpose and means of processing, called data fiduciary will be obligated to maintain the accuracy of data, keep data secure, and delete data once its purpose has been met.
• Transfer of personal data outside India: The central government will notify countries where a data fiduciary may transfer personal data. Transfers will be subject to prescribed terms and conditions.
• Exemptions: The central government may exempt government agencies from the application of provisions of the Bill in the interest of specified grounds such as security of the state, public order, and prevention of offences.
• Data Protection Board of India: The central government will establish the Data Protection Board of India. The central government will prescribe the composition of the Board, selection process, terms and conditions of appointment and service, and manner of removal.
• Functions
  • monitoring compliance and imposing penalties,
  • directing data fiduciaries to take necessary measures in the event of a data breach, and hearing grievances made by affected persons.
• Penalties: The schedule to the Bill specifies penalties for various offences such as:
  • up to Rs 150 crore for non-fulfilment of obligations for children and
  • up to Rs 250 crore for failure to take security measures to prevent data breaches.
  • Data fiduciaries are subject to fines of up to Rs 500 crore for non-compliance.
• Penalties will be imposed by the Board after conducting an inquiry.

Conclusion

• It is crucial that the data protection law addresses the flaws of the previous draft and ensures the protection of people's fundamental rights, including the right to information and privacy. These concerns must be addressed urgently before enacting the DPDP Bill.

(*Click this link to read prelims specific weekly current affairs articles)

FAQs

MCQ

Question: ‘Right to Privacy’ is protected under which Article of the constitution of India? (UPSC-2021)

(a) Article 15

(b) Article 19

(c) Article 21

(d) Article 29