In a noteworthy move, the Government of India has presented a new digital privacy bill to the Lok Sabha (the lower house of India’s Parliament) despite voiced apprehensions from opposition leaders. The Digital Personal Data Protection Bill, 2023, follows the withdrawal of a similar privacy bill from last year and has been introduced amid renewed privacy debates.
The opposition maintains that the bill should undergo a thorough examination by the Lok Sabha’s Standing committee. Among the bill’s primary objectives is to place restrictions on cross-border data transfers, take punitive action against companies involved in data breaches, and lay a foundation for the setting up of a data protection authority to ensure compliance enforcement.
This new legislation stands as the third of its kind and arrives six years subsequent to the declaration by the Supreme Court recognising privacy as a fundamental right. The former version of this bill, the Personal Data Protection Bill, 2019, was removed from Parliament in August 2022. This decision could likely be attributed to the suggestions of 81 ammendments to the bill made in the Joint Parliamentary Committee Report.
A draft of the current bill was put up for consultation in December 2022, which, even though it contained measures protecting the fundamental right to privacy, fell short on several privacy safeguards. Minister of State for Electronics and Information Technology, Rajeev Chandrasekhar, expressed on Twitter that the bill aims to secure the rights of all citizens and promote innovation, while furnishing the government with lawful and authorised access in dealing with situations of emergency, such as pandemics or earthquakes.
The bill sets out the rights and responsibilities of users along with obligations of businesses to govern and shield the use of personal data. It stipulates businesses to be transparent about the kind and purpose of data collected, and assures users the liberty to alter or delete their personal information.
Nevertheless, the government’s conviction that the proposed law meets current privacy requisites and strikes a balance between individual privacy and data exchange has met with considerable criticism. Concerns over state surveillance and potential privacy violations by corporations are prevalent, with the bill giving the state a broad range of exemptions. For instance, personal data can be processed “to fulfil any legal obligation” or “in the interest of the sovereignty and integrity of India or the security of the State”.