The proposed Digital Personal Data Protection Bill, 2022 (“DPDP Bill”) was eventually made available for public comment on November 18, 2022 by the Ministry of Electronics and Information Technology (“MeitY”).
The Bill seeks to create a thorough data privacy framework for India’s digital personal data. It covers both online and offline personal data collection from Data Principals that has been digitized. It also applies to the profiling of data subjects or the offering of goods or services to data principals within Indian territory when processing digital personal data outside of Indian territory. The purpose of this clause is to introduce extraterritorial applicability.
The non-automated processing of personal data, offline processing of personal data, processing of personal data by an individual for any domestic or personal purpose, and the inclusion of personal information about an individual in a record that has been in existence for at least 100 years are all not covered by the DPDP Bill.
Revenue records in the Indian setting could be more than a century old, but they might still require protection. As a result, it will be necessary to balance the compliance requirements for less critical data while also taking into account the justification for and specifics of the exclusions.
With respect to notices to be given for the purpose of consent, Data Principals are given an option of requiring that notice be provided in any of the 22 languages specified in the Eighth Schedule of the Constitution of India. There would be complexities that could arise due to the translated versions.
The main ground for processing personal data remains consent of the Data Principal. However, the concept of “deemed consent” has been introduced where a data principal is deemed to have given consent for the processing of their personal data if (a) such data has been shared voluntarily, (b) the processing is necessary for the performance of any function under law, or the provision of any service or the issuance of any licenseby the State, (c) the processing is necessary for compliance with any law or judgment, (d) the processing is necessary for responding to a medical emergency or medical treatment, (e) the processing is necessary to ensure safety or to provide services during any disaster or breakdown of public order (f) processing is related to employment (g) if the processing is necessary for public interest (h) if the processing is for any fair and reasonable purpose after taking into consideration the legitimate interests of the Data Fiduciary, the public interest and the reasonable expectations of the Data Principal.
When it is reasonable to assume that the purpose for which such personal data was collected is no longer being served by its retention and retention is no longer required for legal or business purposes, a Data Fiduciary is required to stop keeping personal data or remove the means by which the personal data can be associated with specific Data Principals.
The DPDP Bill does require parental authorization in order to protect the processing of children’s personal data. Before processing any personal information about a child, the Data Fiduciary is required to get verifiable parental consent. A data fiduciary is not allowed to process personal information in a way that could endanger children, track them, observe their behavior, or use their information to target them with advertisements.
In order to ensure that the DPDP Bill’s numerous exceptions do not have an impact on sensitive personal data, it is important to carefully consider their implications.
Each Data Fiduciary must designate a Data Protection Officer who reports to the Board of Directors of the organization and an Independent Data Auditor to assess compliances. Additionally, a business must create a Data Protection Impact Assessment and carry out periodic audits.
The Central Government may alert the jurisdictions where personal data may be transferred in order to manage cross-border data transmission.
It is suggested that a Data Protection Board be established for the purpose of enforcing the DPDP Bill’s provisions. User complaints will be addressed, and compliance will be tracked. A High Court appeal might be lodged regarding a Board order. The Board also has the power to refer complaints to mediation or other dispute resolution mechanisms.
Each Data Fiduciary must designate a Data Protection Officer who reports to the Board of Directors of the organization and an Independent Data Auditor to assess compliances. Additionally, a business must create a Data Protection Impact Assessment and carry out periodic audits.
The Central Government may alert the jurisdictions where personal data may be transferred in order to manage cross-border data transmission.
It is suggested that a Data Protection Board be established for the purpose of enforcing the DPDP Bill’s provisions. User complaints will be addressed, and compliance will be tracked. A High Court appeal might be lodged regarding a Board order.
The bill is up for public comment until December 17, 2022. The DPDP Bill, a condensed version of earlier proposals, aims to bring openness. To address issues relating to the practical challenges of erasing personal data after its intended use has been fulfilled and withdrawing consent, it will need to be further clarified.
To ensure that the law, when put into effect, has meaningful compliance and functions as a disincentive to break it, it will also be necessary to discuss the timetables for compliance as well as the “serious” non-compliance carrying a big quantum of penalties.
