India’s Rajya Sabha has passed the Digital Personal Data Protection Bill of 2023, signaling a significant step forward in strengthening privacy rights and obligations for individuals and firms in the country. The bill aims to establish requirements for collecting online data, with exceptions for government entities and law enforcement agencies. It also outlines the responsibilities of entities handling and processing data, as well as the rights of individuals.
The bill, passed through a voice vote in the absence of opposition leaders who walked out earlier, focuses on the processing of digital personal data in both online and offline settings. It applies to data collected within India and also to data collected outside of India if it is used for offering goods or services within the country.
One of the key amendments introduced by the bill is the removal of public interest exemptions in disclosing personal information, as stated in the Right to Information Act of 2005. This means that personal information, including officials’ salaries, can no longer be disclosed in the public interest.
Minister of Electronics and Information Technology Ashwini Vaishnaw, while responding to the bill, emphasized that it allows for the processing of digital personal data in a manner that recognizes individuals’ right to protect their personal information while also considering the need for lawful data processing purposes.
Under the new legislation, personal data may only be processed with the lawful consent of individuals. However, consent may not be required for legitimate uses such as voluntary data sharing or processing by the State for licenses, benefits, and services.
Data fiduciaries are obligated to maintain data accuracy, ensure data security, and delete data once its purpose has been fulfilled. The bill also grants individuals certain rights, including the right to access information, seek correction and erasure, and have their grievances addressed.
Specific provisions have been made to exempt government agencies from certain aspects of the bill, such as in cases related to national security, public order, and offense prevention.
To enforce compliance with the bill, the Data Protection Board of India will be established by the central government. However, it is worth noting that the bill does not regulate the risks associated with processing personal data and does not grant the right to data portability or the right to be forgotten to individuals.
Additionally, the bill allows for the transfer of personal data outside of India to countries approved by the central government. However, concerns have been raised regarding the evaluation of data protection standards in these countries.
The members of the Data Protection Board of India will serve a two-year term, with the possibility of reappointment. This short tenure may potentially impact the independent functioning of the board.
The Digital Personal Data Protection Bill of 2023, which proposes penalties ranging from a minimum of ₹50 crore to a maximum of ₹250 crore for entities that violate the regulations, aims to strike a balance between safeguarding personal data and enabling necessary data processing.
With this significant development in data protection legislation, India is taking a decisive step forward in strengthening privacy rights and obligations, addressing concerns related to the handling and processing of personal data. However, the bill’s effectiveness and its potential impact on data security and individual rights will be closely monitored in the coming months.
