New Delhi: The central government has retained the major provisions of the draft Digital Personal Data Protection Bill, 2022, including penalties for data breaches, parental consent for children’s data, and deemed consent, in the final version to be tabled in Parliament, informed sources. The Union Cabinet on Wednesday approved the draft Bill released for public consultation in November 2022.
The government received as many as 21,666 suggestions from industry stakeholders and legal experts, a senior government official told reporters.
The Bill will continue with a principle-based approach, and it will be followed by a rulebook, said an official.
The Bill, which seeks to enforce the fundamental right to privacy of citizens, has the provision of penalties ranging up to Rs. 250 crore for each instance of data fiduciaries failing to take safeguards to prevent personal data breaches.
It also requires online platforms to take clear and informed consent from the user (principal) before collecting any personal data.
“There are several items listed in the draft Bill based on the impact on the people, the number of people affected, the extent of harm, etc. One should look at the penalty amount basis the overall impact of a breach,” said the official.
He said that in case of a data breach, the affected data principals will be able to seek compensation in civil courts. The Bill requires platforms to give the person/entity an itemised notice before collecting anybody’s data. The notice must contain a description of the personal data sought and the purpose of processing of such personal data. The provision is likely to change the way a majority of the websites collect cookies, the official said.
The draft released last year is the third version of the much-awaited data privacy law of the country. Thirty-eight government organisations and 48 private organisations took part in the consultations. The Bill is set to get introduced in the monsoon session of Parliament, which will begin on July 20.
The Bill requires platforms to obtain verifiable parental consent “in such manner as may be prescribed” before processing any personal data of a child — any user below the age of 18. The final version of the Bill is likely to keep the age of parental consent unchanged, notwithstanding multiple companies demanding to reduce it to 16 years.
“Our actions as far as children’s data is concerned have to be significantly more thoughtful as compared to adults. As a society, we hold that responsibility. For instance, personal data of children should not be used for targeted ads,” said the official quoted earlier.
Another provision of the draft Bill that became a part of contention during public discussions was the provision of deemed consent.
In specific circumstances, a data principal might be deemed to have given consent to the processing of his/her personal data if such processing is necessary.
“There are certain circumstances in which taking consent (for sharing personal data) is not feasible. In situations like natural disasters like cyclones and earthquakes, you are not going to look for consent,” said the official.
For private companies, deemed consent could be considered under “very specific categories” related to employment-related items, said the official.
The government may also retain the concepts of voluntary undertaking and alternative dispute resolution mechanisms to reduce litigations.
Harsh Walia, partner at law firm Khaitan & Co., said: “Wednesday’s approval by the Union Cabinet for the Digital Personal Data Protection Bill, 2022, is a leap towards India’s digital realm. This landmark development sets the stage for the Bill’s introduction before Parliament. As the regulatory framework surrounding data protection in India slowly takes shape, implementation will follow, enforcement mechanisms will materialise, and compliance will become the cornerstone of responsible data governance.”
ENSURING RIGHT TO PRIVACY
The final version of the Digital Personal Data Protection Bill may include:
- Penalties up to Rs. 250 crore for failing to secure personal data
- Platforms must give an itemised notice before collecting data
- Users to be notified on data already shared by them
- Parental consent must for getting data of users below 18 years
- Users to get a right to erase their personal data with platforms
- Alternative dispute resolution to allow settlements outside legal system
