MeitY releases draft of the revised data protection bill for public comment

The proposed bill comes in place of the Data Protection Bill, which was withdrawn by the government in August this year. The draft proposes to set up a Data Protection Board of India, which will carry on functions as per the provisions of the bill.

According to the ministry, the purpose of this Act is to provide for the processing of digital personal data in a manner that recognises both the right of individuals to protect their personal data and the need to process personal data for lawful purposes, and for matters connected therewith or incidental thereto.

The focus of the draft bill will be solely on personal data, the parliamentary Committee’s bill had sought to regulate personal and non-personal data.

The data fiduciary is required to give itemised notice to users on data sought to be collected, in clear and plain language.

A "Data Fiduciary” is anyone who alone or in conjunction with other persons determines the purpose and means of processing of personal data.

Users shall also be allowed the right to give, manage, and withdraw consent from sharing information.

The new draft also states that the central government may, after an assessment, notify countries or territories outside India to which a data fiduciary may transfer personal data, in accordance with such terms and conditions as may be specified.

The Centre by notification may grant exemption from the application of provisions of this Act in case of national security, maintenance of public order or preventing incitement to any cognisable offence relating to any of these.

The exemption can also be granted in case the data is necessary for research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a data principal and such processing is carried on in accordance with standards.

A “Data Principal” is anyone to whom the personal data relates and where such individual is a child includes the parents or lawful guardian of the child.

Government entities will also be allowed to store personal data for an indefinite period of time.

The government can also exempt some entities from:

Issuing notice before collection of personal data

Right to information requiring clarification on whether data is being collected, processed

From storing data only for as long as the purpose for it is collected, is served

The Board can impose financial penalties on non-compliance by a firm of up to Rs 500 crore, after giving the person a reasonable opportunity of being heard.

A penalty of up to Rs 250 crore has been proposed in case the Data Fiduciary or Data Processor fails to protect against personal data breaches in its possession or under its control.

The draft has also proposed a penalty of Rs 200 crore in case the Data Fiduciary or Data Processor fails to inform the Board and data owner about the data breach.

The draft personal data protection bill, issued in 2019, had proposed a penalty of Rs 15 crore or four percent of the global turnover of an entity.