The Union Cabinet of India has officially approved the Digital Personal Data Protection Bill 2022 on July 5,2023. The bill is scheduled to be introduced in the forthcoming Monsoon session of Parliament, commencing on July 20 and concluding on August 11. Following public consultations and feedback, the bill had undergone revisions and extensive inter-ministerial discussions in November last year.
The bill's scope encompasses the processing of digital personal data in India, regardless of whether it is collected online or offline and subsequently digitised. Furthermore, it applies to data processing outside of India when it involves offering goods or services, or profiling individuals within India.
Under the bill, personal data can only be processed for lawful purposes with the consent of the individual. Individuals have the right to withdraw their consent at any time. In certain cases, consent is considered given when processing is necessary for legal functions, provision of state services or benefits, medical emergencies, employment purposes, and specified public interest purposes such as national security and fraud prevention.
The Data Protection Board of India, established by the bill, monitors compliance, imposes penalties, directs data fiduciaries in data breaches, and addresses grievances. Personal data should be deleted once the processing purpose is fulfilled, except when retention is legally or business-wise necessary. Composition, selection, terms, and removal procedures of the board are determined by the government.
Individuals whose data is processed can access information, request correction/erasure of their data, nominate representatives in case of incapacity or death, and seek grievance redressal. They must provide accurate information and avoid false complaints. Violation of duties may lead to penalties.
Penalties for non-compliance range from up to Rs 150 crore for children's data to up to Rs 250 crore for failure to implement security measures. The Data Protection Board will impose penalties following an inquiry.
It has been six years since the Supreme Court held privacy to be a fundamental right. This is certainly a crucial step to frame legislation for the protection of data. However, detailed information about the bill remains confidential at this time, leaving the outcome uncertain.
