Digital Personal Data Protection Bill 2023:
In the era of 21st century where the world is enamored with the rush of technology, the protection of personal data becomes the need of the hour. Data Protection Bill is a welcome step towards strengthening India’s cyber-security posture. Creating a non-permeable wall of data will provide a sense of security and liberty to the citizens. After multiple of iterations and amendments finally the Digital Personal Data Protection Bill 2023 has been passed by the parliament on 9 August, 2023.
Data Protection Bill:
The bill creates a comprehensive framework for the processing, collecting, indexing, using and disseminating of digital personal data by the companies, organizations, ministries, firms, industries or any other governmental or non-governmental entities. The bill aims to curb the fraudulent activities and misuse of personal data by online platforms.
Key highlights of the bill:
• The digital personal data protection act, 2023 applies to the processing of digital personal data within the territory of India collected online or collected offline and later digitized.
• This act is also applicable to processing of digital personal data outside the Indian territory if it involves providing goods and services to the data principals within the territory of India.
• The specific obligation under this act is to appoint three supervising authorities which includes:
a) Data Protection Officer (DPO)
b) Data Auditor
c) A board for conducting the Data Protection Impact Assessment (DPIA)
• The decision of the board can be appealed to Telecom Dispute Settlement and Appellate Tribunal.
• The bill gives power to the central government to prescribe a lower age of consent to 18 years for accessing internet services without parental consent if the platform they are using can process their data in a verifiable safe manner.
• The bill allows a Data Fiduciary to process the personal data of children only with parental consent.
• Breach of data and failure to notify about the breach of data to the data principals and data protection board would attract the penalty up to INR 250 crores.
Data Protection Board of India:
The central government will establish the data protection board of India. Key function of the board includes:
I. Monitoring, compliance and imposing penalties
II. Directing data fiduciary to take necessary measures in the breach of data policy
III. Addressing the grievances of the victim
Concerns and challenges:
• Exemption of the state:
The bill gives the discretionary power to the central government, state government, local bodies and legal authorities to access and process the personal data of an individual for lawful and reasonable purpose.
• Conflict with Right to Privacy:
The bill empowers the central government to exempt any authority or private sector entity from the provisions of the bill by issuing a notification. This may lead to an encroachment into an individual’s privacy.
• Overriding consent of an individual:
The bill overrides the consent of an individual where the state processes the personal data for provision of benefit, services, licensing, permit or certificate.
• Transfer of data outside India:
The bill allows the transfer of personal data outside India except the countries which are notified by the central government. This mechanism may not ensure the adequate evaluation of data protection standards in the countries where the transfer of personal data is allowed.
Emergence of Data Privacy:
Justice KS Puttaswamy v. Union of India and others 2018 case also referred as Adhaar case is the cornerstone of the ‘Right to Privacy’ jurisprudence in India. The nine Judge Bench in this case unanimously reaffirmed the right to privacy as a fundamental right enshrined under article 21 Right to life and liberty under the Constitution of India. The Court held that the right to privacy was integral to freedoms guaranteed across fundamental rights and was an intrinsic aspect of dignity, autonomy and liberty.
This judgment led the need to safeguard the interest of public by protecting their personal data from being leaked, encroached, breached and misused through online platforms. Thus, the foremost step towards protecting the personal data was made and the result of what came out was the Digital Personal Data Protection Bill 2018 drafted by Sri Krishna committee.
Conclusion:
The Digital personal data protection act 2023 can prove to be a robust effort towards safeguarding the personal data of an individual keeping in the mind the day by day increment in the number of internet users in India.
The proposed law makes huge strides in securing the rights of digital users by extending actionable rights to users, obligating companies and proposing the constitution of the Data Protection Board as a supervisory body for the resolution of user grievances.
However, the bill provides the enormous power to the central government to access and process the personal data of an individual for various purposes which is one of the highly criticized the provisions of this act.
