New Delhi: The upcoming data protection Bill may cap the penalty at Rs 250 crore for data breaches instead of the earlier proposed amount of Rs 500 crore.
The new draft Bill has the provision of penalties ranging up to Rs 250 crore for each instance of data fiduciaries failing to take safeguards to prevent personal data breaches.
According to an earlier draft of the Digital Personal Data Protection Bill 2022, the proposed Data Protection Board could impose a fine of up to Rs 500 crore. The provision has been eliminated in the revised bill.
The revised bill states that “If the board determines at the conclusion of an inquiry that breach of the provisions of this Act by a person is significant, it may, after giving the person an opportunity of being heard, impose such financial penalty as is specified in Schedule 1,”. Schedule 1 lists out the range of penalties, which ranges from Rs 10,000 to Rs 250 crore depending on the seriousness of the violation. The earlier draft has stipulated that in the case of non-compliance, a penalty of up to Rs 500 crore could be imposed.
Among other changes, the government could also lower the age of consent from 18 to 14 and exempt certain firms from adhering to additional obligations for protecting kids’ privacy if they can process their data in a “verifiably safe” manner, The Economic Times (ET) reported yesterday.
The change is a major departure from the earlier draft of the data protection Bill which was floated in November and fixed the age of consent at 18, requiring companies to obtain the consent of the individual’s parents before processing data of those under 18.
The Centre has retained the major provisions of the draft data protection Bill including penalties for data breaches, parental consent for children’s data, and deemed consent, in the final version to be tabled in Parliament. On July 5, the union cabinet had approved the draft Bill released for public consultation in November 2022.
