Personal Data Protection Bill

Why in news?

Recently there was a large data breach at MobiKwik which has put the data of 9.9 crore users at risk.

Why such incidents are happening?

• The pandemic has forced people to participate in the digital economy.
• More people have taken to digital channels to fulfil a variety of needs like purchasing groceries and accessing health services.
• This has increased the number of personal data breaches from major digital service providers and the existing data protection regime in India is not able to address this.

What are the issues with the existing data protection regime?

• Currently, the Information Technology Act, 2000 regulates the entities which collect and process users’ personal data in India.
• However, this data protection regime fails to provide effective protection to users and their personal data.
• For instance, entities could easily override the protections by taking users’ consent to process the personal data under broad terms and conditions which users might not understand.
• Further, the framework emphasise more on data security but does not place enough emphasis on data privacy.
• So the entities employ technical measures to protect personal data but fail to respect users’ preferences in processing the personal data.
• Also the data protection provisions under the IT Act do not apply to government agencies.
• Moreover the existing law is inadequate to address the risks emerging from new developments in data processing technology.

What are the steps taken to address these flaws?

• The Supreme Court’s verdict in the K.S. Puttaswamy (Retd) v. Union of India case highlighted the need for a more robust data protection law.

• It established the right to privacy as a fundamental right and called for a data protection law that can effectively protect users’ privacy over their personal data.

• Consequently, B.N. Srikrishna Committee was formed to suggest a draft data protection law.
• Later Personal Data Protection Bill, 2019, was drafted and it now under scrutiny by a Joint Parliamentary Committee.
• But the Bill, in its current form, is a revised version of the draft legislative document proposed by the Committee.

How is the proposed bill different from the existing law?

• First, the bill seeks to apply the data protection regime to both government and private entities across all sectors.
• Second, it emphasises on data security and data privacy- entities must ensure safeguards to protect personal data and are in obligation to take transparency and accountability measures to uphold users’ privacy.
• Third, the bill seeks to give users a set of rights over their personal data and means to exercise those rights.
• For instance, user will be able to obtain information about the different kinds of personal data that an entity has about them and how the entity is processing that data.
• Fourth, the bill seeks to create an independent and powerful regulator known as the Data Protection Authority (DPA) which will monitor and regulate data processing activities to ensure compliance.
• Moreover, the DPA will give users a channel to seek redress when entities do not comply with their obligations.

What are issues in this bill?

• Though the bill can bring a massive and meaningful change to personal data protection in India, several provisions creates a cause of concern.
• For instance, under clause 35, the Central government can exempt any government agency from complying with the bill which will dilute the user protection safeguards.
• And the government agencies can now process personal data without following any safeguards which can create severe user privacy risks.
• The bill threatens users with legal consequences who withdraw their consent for a data processing activity.
• The users might now find it difficult to enforce various user protection safeguards in the bill.

Source: The Hindu