Lok Sabha passes Digital Personal Data Protection Bill, 2023
The Lok Sabha on Monday passed the Digital Personal Data Protection Bill, 2023, with a voice vote, amid strong protests from the opposition. The bill was moved by Union Minister for Electronics and Information Technology Ashwini Vaishnaw. If passed in the Rajya Sabha as well, it will balance individual rights to safeguard data with the legal requirement to utilize it for suitable purposes.
Why does this story matter?
The bill approved by the Union Cabinet on July 5 aims to prevent unchecked processing of personal data of citizens. In August 2022, the Centre withdrew the draft Personal Data Protection Bill, 2019, after a parliamentary committee suggested 81 amendments to it. The bill proposes an amendment to the Right to Information (RTI) Act—which many see as an attempt to dilute the RTI Act.
India comes closer to having law governing data use, process
With this development, the country moves closer to limiting cross-border data transfers, penalizing firms for data breaches, and establishing a framework for establishing a data protection authority to enforce compliance. The opposition, which has voiced worries about it, has demanded that it be referred to a parliamentary panel for further debate. It also claimed that the bill would infringe on people's Right to Privacy.
Opposition proposed amendments to Data Protection Bill
Besides infringement allegations, the MPs belonging to the opposition bloc—the Indian National Developmental Inclusive Alliance (INDIA)—have proposed amendments to the bill, including lowering the definition of children to those under 15 years. Notably, the bill proposes to impose restrictions on platforms for processing children's data. The bill will now head to the Rajya Sabha, where the ruling coalition is short of the majority mark.
'Individual consent' for data processing main provision in bill
If passed in the Rajya Sabha, the DPDP Bill will regulate the handling of digital personal data, including data gathered offline and digitized. It also forbids the unlawful processing of personal data and requires the individual's consent, even for legal reasons. Furthermore, the bill proposes establishing the Data Protection Board of India to implement the legislation.
Main objective behind DPDP Bill
Currently, India doesn't have a dedicated law for data protection, and digital personal data is regulated under the Information Technology (IT) Act, 2000. This bill, along with the Digital India Bill—the IT Act's proposed successor, the Indian Telecommunication Bill, 2022—and a policy for governing non-personal data, would form a holistic framework for technological regulations in India.
Likely to impact RTI Act
The bill proposes an amendment to the RTI Act that would allow public authorities to deny any personal information about administrative officials under Section 8(1)(j) of the RTI Act, citing the protection of individual privacy. Experts say Section 8(1)(j) is one of the most misused provisions of the Act. As many as 35% of RTI applications are rejected by invoking it.
Editors Guild opposes certain provisions of bill
On Sunday, the Editors Guild of India (EGI) expressed reservations over some provisions of the DPDP Bill, stating it can have an "adverse impact on press freedom." It urged the Lok Sabha speaker to refer the bill to a parliamentary standing committee for review, saying that it creates an enabling framework for the surveillance of citizens, including journalists and their sources.
