What is India's data protection bill and why is it facing opposition?

The Personal Data Protection Bill, 2023 was tabled in the Lok Sabha on Thursday (August 3) after multiple attempts to bring in a robust legal safeguard in the past failed.

If enacted, the bill will govern the nation's digital data framework to safeguard personal data and address the growing concerns surrounding data privacy, drawing inspiration from international data protection laws like the European Union's General Data Protection Regulation (GDPR).

Union Minister Ashwini Vaishnaw tables The Digital Personal Data Protection Bill, 2023 for introduction in Lok Sabha pic.twitter.com/wrg5RSlnNW

— ANI (@ANI) August 3, 2023

However, the bill drafted by the Ministry of Electronics and Information Technology (MEITY) has faced opposition from certain quarters, with concerns raised about its impact on citizens' privacy and its potential implications for surveillance by the government.

Key provisions

• The Digital Personal Data Protection Bill, 2023 aims to hold companies accountable for protecting the personal data of individuals who generate the data, referred to as 'data principals,' and mandates clear communication about the purpose of data collection.
• Data fiduciaries, or companies collecting data, are required to appoint a Data Protection Officer and provide users with the right to delete or modify their personal data. It will also include foreign entities operating in India.
• The bill also proposes significant fines on fiduciaries, ranging from ₹50 crore to ₹250 crore, for non-compliance with data protection requirements.

Upto Rs 250 cr fine for every data breach in Data Protection Bill, 2023

Read @ANI Story | https://t.co/FDu8Ts2DwW#DataProtectionBill #LokSabha #SupremeCourt pic.twitter.com/TOgKoPDXNx

— ANI Digital (@ani_digital) August 3, 2023

• These fines can be compounded, allowing multiple fines for repeated violations.
• Additionally, certain firms classified as 'significant' data fiduciaries will be subject to more strict requirements, such as the ones in data audits and impact assessments of the collected data.
• The establishment of the Data Protection Board of India (DPBI), as the nodal agency is a crucial aspect of the bill.
• Appointments to the DPBI will be made by the Union Government, and the board will function as an adjudicatory body to address privacy-related grievances and disputes.

ALSO READ: What is Personal Data Protection Bill? Why did the Indian govt withdraw it?

Opposition concerns

• The Personal Data Protection Bill has faced opposition from various political parties, including the Indian National Congress.
• Critics argue that the bill empowers the government to access private data, potentially leading to a surveillance state.
• They believe that the exemptions provided to the "State and its instrumentalities" could be misused, leading to overbroad surveillance as the government can access the data to "in the interest of sovereignty and integrity of India".
• The bill omits Section 43A of the Information Technology Act, 2000, which mandates companies to provide compensation to users in case of mishandling of their data. Government sources say the process of compensation should be taken care of by a civil authority.

Digital Personal Data Protection Bill is an oblique attempt to further undermine the landmark Right to Information Act and should be withdrawn.

Modi’s govt’s working is totally opaque. It has consistently weakened the RTI and now creating more exceptions through DPDP Bill. pic.twitter.com/YgoPGcYNqd

— D. Raja (@ComradeDRaja) July 31, 2023

• The opposition has led to calls for further examination of the bill by the Parliamentary Standing Committee on Communications and Information Technology.
• Some believe the bill could weaken the Right to Information Act, 2005 too as the government could access data on information seekers too. 

ALSO READ: Will Personal Data Protection Bill allay privacy concerns?

• Congress MP Manish Tewari expressed concern that the bill creates a divide between non-governmental organisations, which are bound by its provisions, and the government, which enjoys exemptions. The opposition believes that these exemptions may undermine the 2017 Supreme Court's Puttaswamy judgment that declared privacy a fundamental right.

ALSO READ: EU order to stop Meta data transfer to US is a bigger headache for Zuck than the $1.3 billion fine

The bill, if passed, will significantly impact companies and organisations operating in India, as they will have to comply with strict data protection regulations. The establishment of the Data Protection Board of India will provide an avenue for individuals to seek redressal for privacy-related grievances.