Dais is wide open
The deadline for the submission of comments on Digital Personal Data Protection Bill 2022 is inching closer. Concerned stakeholders should register their feedback by the earliest to make the consultation process, initiated by the Central government, a true success. As India marches forth on the path of digitisation more rapidly than ever, the vitality — as also the vulnerability — of data has grown multi-fold. The profundity of the exercise of formulating a legal framework to protect personal data of Individuals can be gauged from the fact that it also pertains to national security and integrity in certain ways. The process of establishing a legal framework to protect data has been in the making for around five years. The Digital Personal Data Protection Bill 2022 is the fourth iteration of similar nature since 2017. To make it fair and comprehensive, the government has refined it several times — also creating a sync with the fundamental right to privacy, as established by the Supreme Court in 2017. The legislation has been through several high-level committees — from BN Srikrishna Committee in 2017 to Joint Parliamentary Committee in 2021. On November 18 this year, it was floated directly in the public domain for wider consultation. The entire draft revolves around three planks — data fiduciary, data principal and grievance resolver. Data Principal is the individual to whom the personal data relates. If such an individual happens to be a child, data principal will comprise parents or lawful guardians of the child. Data Fiduciary is a person who alone, or in conjunction with other persons, determines the purpose and means of processing the personal data. The main grievance resolver is the Data Protection Board, envisaged under the draft bill. The current draft is perhaps a compact and simple version when compared to the past proposals. From close to hundred, the number of clauses in the current draft has come down to 30, and language is simpler and more progressive. On the positive side, the centrality of Data Principal has assumed greater significance in the draft. Clause 12 offers them right to information about personal data; Clause 13 right to correction and erasure; Clause 14 the right of grievance redressal etc. These improvements notwithstanding, there is a lot of scope for improvement. Also, some of the shortcomings that were flagged in the previous proposals appear to be left unaddressed. The biggest unwanted trait that has flown in from the previous versions of the bill is the excessive executive control and the exemption of instrumentalities of state on certain grounds. Clause 18 of the DPDPB carries forward the exemptions provided to the Central Government under the Data Protection Bill, 2021. The Central Government is also provided a strong hold in terms of influencing the composition of the Data Protection Board — the main body for the grievance redressal mechanism. Under clause 19 (2), the Union Government is empowered to prescribe the provisions for the removal of the Board's chairperson and other members. Clause 19 (3) empowers the government to appoint the Chief Executive of the Board. This overreaching control of the Union Government has raised reservations among certain quarters regarding the independent functioning of the Board. Provision of extra freedom to data fiduciaries in terms of collection of personal data of individuals is being seen as yet another bone of contention. Clause 6 of the draft bill requires data fiduciaries to notify the data principal about the nature of the data they will be collecting and the purpose for which such data may be processed. This, however, misses crucial information like the involvement of third parties and time period for which the data can be stored. Also, contrary to the concept of data localisation, when it comes to transfer of data to other countries and blocs, it is the government, and not legally laid out parameters, that would exercise discretion — leaving little control with the data principal herself. Imposition of hefty fines on data principals is yet another contentious aspect of the draft. With all pros and cons of the draft, the government appears to strike a balance among a wide spectrum of things ranging from national security to ease of doing business and safety of individuals. However, to do so, it is contested whether it requires the degree of control provided under the DPDPB. The dais for discussion is wide open. Reservations around the legislation can be registered so that the government can incorporate them and come out with a robust, sustainable Bill in the future.