Data protection Bill tabled, penalties of up to Rs 250 crore for leaks

The Bill, a product of over four years of work, numerous deliberations, and multiple revisions, presents a distinct framework compared to earlier draft legislation on the subject.

 

In a relief for the industry, the Bill allows cross-border data transfers, introduces voluntary undertaking

of data breaches, and removes criminal penalties prescribed in the 2019 draft.

The Bill allows for data processing without user consent under certain circumstances, such as medical emergencies, disasters, court orders, and government agency requirements.

Every digital platform will be required to provide a notice outlining the purpose of data processing and users’ rights, available in all 22 official languages. Platforms that have already collected personal data will need to send a notice to users, offering them an opportunity to withdraw their consent.

The Bill excludes anonymised, non-personal, and offline personal data, and does not categorise data as sensitive or critical. To reduce litigation, the Bill includes provisions for alternative dispute resolution (ADR). If enacted, the law will become a key component of India’s rapidly expanding digital economy.

An independent body, the Data Protection Board, will be established to examine personal data breaches and impose penalties. If the board determines that a platform has failed to take “reasonable security safeguards” to prevent a data breach, it can impose a penalty of up to Rs. 250 crore. Non-compliance with obligations related to children’s data may result in a penalty of Rs. 200 crore.

However, the government has the discretion to exempt certain entities, including startups, from the Bill’s provisions, depending on the volume and nature of the personal data they process. Government agencies may also be exempted under various circumstances.

Under the proposed law, platforms must obtain verifiable consent from a parent or lawful guardian before processing personal data of individuals under 18 or persons with disabilities. Certain classes of platforms may be exempt from this condition. Processing of personal data that could adversely affect a child’s well-being is prohibited, as is tracking, behavioural monitoring, and targeted advertising directed at children.

Disputes with the board’s decisions can be taken to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). The Bill outlines the broad principles of data protection, with the specifics of legal requirements to be clarified when the government defines the rules following the Bill’s enactment.

The Bill’s journey began in 2017, following the Supreme Court’s recognition of the right to privacy as a fundamental right of citizens. The Ministry of Electronics and Information Technology constituted a committee of experts, chaired by Justice BN Srikrishna, which presented the Draft Personal Data Protection Bill, 2018. The draft was tabled in Parliament in 2019, with some amendments. However, the government withdrew the draft last year after the joint parliamentary committee suggested 81 amendments and 12 recommendations to a Bill of 99 sections.

A new draft was released for public consultations in November 2022, and the government received 21,666 suggestions from industry stakeholders and legal experts.