Union Minister of Information Technology (MeitY) Ashwini Vaishnaw introduced the much-awaited Digital Personal Data Protection (DPDP) Bill, 2023 in the Lok Sabha. Vaishnaw said the objective of the bill “recognizes” the right of a person’s digital personal data and allows for the process such personal data for lawful purposes.
The bill was rumoured to have been certified as a Money Bill—which means, it would have to pass scrutiny in the lower house only; however, the Center later clarified that its introduction would be as a general bill.
DPDP Bill, 2023 sees the light a year after the BJP government withdrew its controversial Personal Data Protection Bill 2019, and six years after the Supreme Court directed the Centre to establish a data protection regime in its 2017 Puttaswamy judgment.
Opposition MPs opposed the bill observing that the bill introduced was completely different from its earlier avatar and the deliberations by the Joint Parliamentary Committee over the same.
MeitY in November 2022 released a draft version of the bill and invited suggestions for the same. The bill went through several rounds of consultations, and all stakeholders were invited to give their feedback on the draft law.
Key Features of the DPDP Bill, 2022
- The scope of the Digital Personal Data Protection Bill, 2022, is limited to the online personal data of a user and thus does not offer protection for an Indian user's offline personal data.
- A user must give their consent to the companies to process their personal data, as per the bill. However, the user is deemed to have given consent in case of a medical emergency, disaster, breakdown of public order, court order, etc.
- Under the draft DPDP Bill, 2022, data principals—individuals to whom the personal data relates—have certain rights such as the right to information about their personal data, the right to correct/ erase personal data among others.
- The Bill allows the Government to carve out exemptions for “any instrumentality of the State” as well as certain types of data fiduciaries/ organisations that process data for law enforcement or judicial purposes.
Concerns over the DPDP Bill, 2023
Internet Freedom Foundation (IFF), an advocacy group, expressed its disappointment with the version of the bill that was introduced today. “The DPDPB, 2023, like its 2022 predecessor fails to account for concerns raised by civil society through years of consultations across different iterations of the bill in 2018, 2019 and 2021,” IFF said.
“The amendment of the Right to Information Act, 2005 which will significantly weaken the historically progressive law,” it added.
“The Digital Data Protection Bill, 2023 has been introduced as a Financial Bill which gives the Government a lot of powers with no and insufficient legislative guidance,” advocacy group Software Freedom Law Centre (SFLC) said. “The bill does not provide for compensation to be granted for data principals whose privacy has been violated and has suffered a loss,” it added.
“The issue of deemed consent that had raised red flags earlier has been reworded but principally remains the same. Data Principals have been saddled with duties and penalties prescribed for acting in violation of these,” Prasanth Sugathan, SFLC Legal Director said.
BOOM reported experts’ concerns over how the proposed changes in the DPDP bill to the Right to Information Act, 2005—India’s ‘sunshine legislation’—will “severely restrict and dilute” the law.
Timeline of the bill:
- In 2017, while upholding an Indian citizen’s fundamental right to privacy in the Puttaswamy judgment, Supreme Court directed the government to bring in a data protection law. SC held that informational self-determination and privacy constituted an integral part of privacy rights. A team of experts led by retired Supreme Court judge BN Srikrishna was tasked with drafting a data protection bill.
- In 2019, The BJP government tabled the Personal Data Protection Bill, 2019 in Parliament but the same was referred to a Joint Parliamentary Committee for further evaluation.
- In 2021, the JPC submitted a reworked version of the draft legislation based on its internal deliberations.
- In 2022, IT Minister Ashwini Vaishnaw withdrew the Personal Data Protection Bill, 2019 citing the need for a “comprehensive legal framework.”
- In 2023, the new avatar of the bill is introduced in the Lok Sabha Monsoon Session.
