INTRODUCTION
As the country’s digital economy and cyber ecosystem multiply, it is critical to put in place a robust safeguarding framework that guarantees the responsibility of enterprises that manage personal data. Without such legislation, such organisations cannot be held liable in the case of a breach of information or comparable incident. As a consequence, there is a pressing requirement for agreement and a concerted effort to develop adequate data protection laws. The anticipated Indian bill, which is expected to be introduced in parliament soon, is geared towards safeguarding individuals’ privacy and guaranteeing their sensitive information is not misused. This blog discusses the history of the law, its ramifications, the outcome, and the current scenario for the Anticipation Indian Bill.
HISTORY OF INDIAN PRIVACY BILL
As a result of the increasing number of people using the internet and the broad use of technology, an immense amount of sensitive information has been generated. This data has been gathered without the consent or accountability of individuals, raising worries regarding privacy violations.
In response to increasing concerns about data privacy, a group of experts was formed in 2012 to outline core areas of data privacy protection, such as transparency, collection and purpose constraints, security, confidentiality, consent gathering, availability of data, and correction, and observe them by investigating authorities. Several individuals were concerned about the growing popularity of Aadhar. Several petitions have been brought to the Supreme Court, alleging threats to privacy as a result of data breaches, etc.
The Supreme Court established a nine-judge committee to consider whether the right to confidentiality is a basic right. The Supreme Court replied enthusiastically, ruling in K.S. Puttaswamy v. Union of India that the right to solitude is a fundamental right.
Following the Puttaswamy choices, a committee was established in August 2017 under the leadership of Minister of Justice (Retd.) B.N. Srikrishna to examine data protection issues, recommend solutions, and draft a data protection bill. The committee handed its findings and a drafted data privacy bill before the Department of the Ministry of Information Technology and Electronics on July 27, 2018.
Subsequently, in December 2019, the Rajya Sabha enacted the Personal Data Protection Bill 2019, which established compliance standards for personal data, expanded individuals’ rights, established a central data protection regulator, commanded data localization, and implemented monetary penalties for noncompliance. In 2019, the Indian privacy bill was forwarded to the Joint Parliamentary Committee of Parliament (JPC) for investigation, which suggested 81 revisions and 12 suggestions that altered the legislation’s mandate.
However, the administration withdrew the unsuccessful personal data protection bill from parliament, leaving the DPB’s fate in question. According to the Ministry of Information Technology and Electronics, the IT Act could be amended to take into account the country’s developing technological landscape.
DIFFICULTIES IN THE OLD PRIVACY BILL -
The Indian government’s proposed Indian privacy law generated concerns for a variety of reasons, including challenges relating to
Data Localization: The need for private information to be maintained on computers or data centres situated within Indian territory is referred to as data localization. The measure authorised the government to exclude some kinds of personally identifiable information from this obligation, as well as designate certain data types as “critical” and have them stored solely in India. This rule was criticised by technology businesses since it required them to build a new infrastructure for data storage in India even if they hadn’t established an actual presence there. Furthermore, there was not a specific definition of “critical and sensitive data” in the bill.
Governmental Access: The governmental access to data paragraph permitted the government access to all personally identifiable information for the purposes of ensuring national security and preventing, detecting, investigating, and prosecuting crimes or other legal violations. However, in India, lax security measures against state surveillance posed an important risk to privacy. The legislative framework for government monitoring lacked judicial warrants, third-party oversight, or any duty to inform the target of surveillance, putting it in violation of globally recognised human rights norms.
Inadequate Measures: The drafted bill additionally contained inadequate oversight measures. The central government exercised significant influence over the regulatory framework, including the capacity to designate the members of the information protection authority based on the recommendations of an independent panel. Commissioners of the authority must have specialised knowledge and at least ten years of professional experience in disciplines associated with safeguarding data, information technology, data management, data science, the security of data, cyber, and internet legislation, according to the bill. However, given India’s small pool of experts who fit that description, an ongoing relationship between lawmakers and the data trustees being regulated could undermine the authority’s independence.
These flaws generated serious worries about the Indian government’s drafted data privacy bill, causing business organisations to write letters to the Minister of Electronics.
RECOMMENDATION MADE BY THE GOVERNMENT:
The Indian government recommended a data protection measure that would force firms to retain personal data in India, raising security and governmental access to data issues. Some businesses supported the bill, claiming it would improve law enforcement accessibility and give the Indian government greater flexibility in taxing internet giants. Civil society businesses, on the other hand, criticised the open-ended prohibitions for government monitoring and pointed out that encryption keys may still be within the grasp of national authorities. The measure was opposed by IT behemoths and industry groups, who feared a fractured internet and protectionist rules that would damage young startups and larger corporations that process international data in India. Due to the response and the demand for reform, the measure was eventually dropped.
CURRENT SCENARIO:
The Department of the Ministry of Information Technology and Electronics proposed a new law, the Digital Personal Data Protection Bill 2022, on November 18, 2022. If approved by Parliament, it will substitute for the 2011 rules as well as some elements of the current legislation. India’s new data protection bill intends to impose requirements on corporations that establish the aims and methods of data processing (referred to as “data fiduciaries”). Organisations that collect identifiable information from users for the purpose of selling and delivering groceries, for example, conclude that the aim of collection is to assist with the purchase and shipment of goods. It also attempts to govern firms that process this kind of information (known as “data processors”) in accordance with the companies’ decisions.
For instance, if an application employs the services of an internet storage provider to keep sensitive data, such a provider would only operate on orders from the corporation. Aside from that, the bill specifies the legal rights of the people to whom personal data relates (referred to as “data principals”).
RIGHTS PROVIDED UNDER THE PROPOSED BILL TO THE INDIVIDUALS
The following are the summarised rights being provided by the Indian Privacy Bill:
Right to be informed: right to be informed about the processing of their personally identifiable information and to receive a summary of the information being processed. Individuals have the right to know whether or not a firm is processing or has processed personal data about them, as well as how such data is handled by the company.
Right to terminate consent: Based on the previously mentioned right, an individual may request an explanation of their data that is being handled or that was recently processed, as well as the company’s processing actions currently (or that have been) conducted.
Right to correction and erasure: Under this right, individuals have the right to correct, erase, complete incomplete personal data, and update the same.
Right to redressal of grievances: Individuals have the right to make a trip to an office or authority established by a firm for the purpose of registering and addressing grievances about the collection and use of personal data.
Right to nominate: The proposed measure would allow persons to appoint another person to execute their freedoms in the case of their passing or incompetence (due to instability of their thoughts or body).
Right to withhold consent: Whenever personal data is handled only on the basis of consent the proposed law allows the person in question to terminate their consent for that processing.
CONCLUSION
In comparison to existing law, the bill gives individuals significant rights and gives them greater information awareness, decisional autonomy, and control over their personal information, while also requiring companies to respect individuals’ rights and provide operational redressal mechanisms, with serious consequences of up to Rs 50 crore for infringing on individual rights. The proposed law takes significant steps towards ensuring the rights of digital users by granting people actionable rights, requiring corporations, and proposing the establishment of the Privacy and Data Protection Board to serve as an adjudicatory authority for the settlement of user disputes. While the consultation with the public is still ongoing, it remains to be seen whether the bill will be introduced during the Budget Session.
Click Here : Anticipation Indian Bill.
