Digital Personal Data Protection Law<\/u><\/span><\/span><\/span><\/h1>\nSyllabus: GS2\/ Government Policies & Interventions<\/strong><\/span><\/span><\/span><\/p>\nIn Context<\/u><\/strong><\/span><\/span><\/span><\/p>\n\n- Recently the Lok Sabha has passed the<\/span><\/span><\/span> Digital Personal Data Protection Bill, 2023<\/strong><\/span><\/span><\/span>.<\/span><\/span><\/span><\/li>\n<\/ul>\n
Need of Strong Data Protection Regime<\/u><\/strong><\/span><\/span><\/span><\/p>\n\n- Data a new oil to Industry: <\/strong><\/span><\/span><\/span>As India\u2019s data economy grows, it finds itself grappling with regulation in order to catch up with the rich data that Indians are sharing every day, as they log onto hundreds of platforms\u2014whether to bank electronically or to purchase groceries or to stay connected on social media.<\/span><\/span><\/span><\/li>\n
- Threats posed to Digital Economy:<\/strong><\/span><\/span><\/span> Risk exposure to the digital economy has increased manifolds amidst the pandemic. For example, Ransomware, the data breach at Mobikwik.<\/span><\/span><\/span><\/li>\n
- Internet Crime:<\/strong><\/span><\/span><\/span> Protection from several instances of internet crimes like cybercrime, cyberbullying and harassment.<\/span><\/span><\/span><\/li>\n
- National Security Concern:<\/strong><\/span><\/span><\/span> Data of security agencies could be at risk compromising national security and many private entities are against data localisation.<\/span><\/span><\/span><\/li>\n
- Surveillance state: <\/strong><\/span><\/span><\/span>Inadequate data protection legislation & unlimited government access can lead to a totalitarian regime<\/span><\/span><\/span> (Aadhar Act).<\/strong><\/span><\/span><\/span>\n
\n- Currently, Personal data was regulated by IT Act, 2000. However, this Act was applicable only to foreign companies & corporates working in India.<\/span><\/span><\/span><\/li>\n<\/ul>\n<\/li>\n
- Puttaswamy v India (2017):<\/strong><\/span><\/span><\/span> Supreme Court has declared Data Privacy as a Fundamental Right under Article 21.<\/span><\/span><\/span><\/li>\n<\/ul>\n
Key Provisions of the Bill<\/u><\/strong><\/span><\/span><\/span><\/a><\/p>\n\n- Applicability: <\/strong><\/span><\/span><\/span>The Bill applies to the processing of digital personal data within India where such data is: (i) collected online, or (ii) collected offline and is digitised.\u00a0 It will also apply to the processing of personal data outside India if it is for offering goods or services in India.\u00a0<\/span><\/span><\/span><\/li>\n
- Consent:\u00a0 <\/strong><\/span><\/span><\/span>Personal data may be processed only for a lawful purpose after obtaining the consent of the individual. A notice must be given before seeking consent.\u00a0\u00a0<\/span><\/span><\/span>\n
\n- The notice should contain details about the personal data to be collected and the purpose of processing.\u00a0<\/span><\/span><\/span><\/li>\n<\/ul>\n<\/li>\n
- Lower age of consent: <\/strong><\/span><\/span><\/span>The Bill <\/span><\/span><\/span>gives powers to the central government<\/strong><\/span><\/span><\/span> to prescribe a <\/span><\/span><\/span>lower age of consent than 18 years <\/strong><\/span><\/span><\/span>for accessing Internet services without parental consent if the platform they are using can process their data in a \u201cverifiably safe manner\u201d.\u00a0<\/span><\/span><\/span>\n
\n- This would essentially mean a white-listing approach for companies in the edtech sector, and for medical purposes, among other things.<\/span><\/span><\/span><\/li>\n<\/ul>\n<\/li>\n
- Ease of cross-border data flows: <\/strong><\/span><\/span><\/span>The Centre has proposed to significantly ease cross-border data flows to international jurisdictions \u2013 by <\/span><\/span><\/span>moving away from a whitelisting approach<\/strong><\/span><\/span><\/span> to a<\/span><\/span><\/span> blacklisting mechanism<\/strong><\/span><\/span><\/span>.\u00a0<\/span><\/span><\/span>\n
\n- Earlier, the government had said that it would issue a list of countries where data flows would be allowed.\u00a0<\/span><\/span><\/span><\/li>\n<\/ul>\n<\/li>\n
- Impact on Social Media Companies: <\/strong><\/span><\/span><\/span>Significant Data Fiduciaries (<\/span><\/span><\/span>the fiduciaries with huge volume and processing sensitive data<\/strong><\/span><\/span><\/span>) have to develop their <\/span><\/span><\/span>own user verification mechanism<\/strong><\/span><\/span><\/span>.<\/span><\/span><\/span>\n
\n- It will<\/span><\/span><\/span> reduce the anonymity of users<\/strong><\/span><\/span><\/span> and decrease trolling, fake news and cyberbullying.<\/span><\/span><\/span><\/li>\n<\/ul>\n<\/li>\n
- Exemptions: <\/strong><\/span><\/span><\/span>Rights of the data principal and obligations of data fiduciaries (except data security) will not apply in specified cases.\u00a0\u00a0<\/span><\/span><\/span>\n
\n- These include:<\/strong><\/span><\/span><\/span> (i) prevention and investigation of offences, and (ii) enforcement of legal rights or claims.\u00a0\u00a0<\/span><\/span><\/span><\/li>\n
- The central government may, by notification, exempt certain activities from the application of the Bill.\u00a0\u00a0<\/span><\/span><\/span><\/li>\n
- These include:<\/strong><\/span><\/span><\/span> (i) processing by government entities in the interest of the security of the state and public order, and (ii) research, archiving, or statistical purposes.<\/span><\/span><\/span><\/li>\n<\/ul>\n<\/li>\n
- Data Protection Board of India: <\/strong><\/span><\/span><\/span>The central government will establish the Data Protection Board of India.\u00a0 Key functions of the Board include: (i) monitoring compliance and imposing penalties, (ii) directing data fiduciaries to take necessary measures in the event of a data breach, and (iii) hearing grievances made by affected persons.\u00a0\u00a0<\/span><\/span><\/span>\n
\n- Board members will be appointed for two years and will be eligible for re-appointment.\u00a0<\/span><\/span><\/span><\/li>\n<\/ul>\n<\/li>\n