Data Protection Bill may expand the scope of data deletion
The Union Cabinet recently approved the draft of the Digital Personal Data Protection (DPDP) Bill, 2022. The government is yet to publish the Cabinet-approved draft. The new draft could expand the scope of data protected by the Bill. People might be able to seek the deletion of all data stored by companies, per Moneycontrol. Let's see how that would impact data protection in India.
Why does this story matter?
The DPDP Bill aims to be the cornerstone of India's data protection regime. However, it has faced criticism from civil society groups over its focus on personal data. Several organizations have argued the Bill does not take into consideration other valuable data companies store. At the same time, expanding the scope might also make the Bill compliance heavy.
Previous draft only provided deletion of personal data
The first draft of the DPDP Bill, 2022 gave users the right to ask 'data fiduciaries' (companies) to delete the data stored with them. However, it was limited to personal data. Therefore, companies could still store any other data in a deanonymized format. Companies were happy with his arrangement, as they only had to delete a user's personal identifiable information (PII).
Civil society groups asked for 'Right to be Forgotten' clause
Civil society groups like the CUTS-CCIER criticized this particular clause of the Bill. They prompted the government to amend the provision and introduce a 'Right to be Forgotten' clause. It is the right of a person to have private information, personal or otherwise, deleted from online. There are chances the government may have added the clause to the new draft.
Previous bill had Right to be Forgotten clauses
This is not the first time the Right to be Forgotten and the Data Protection Bill are being discussed together. The Personal Data Protection Bill, 2019—the previous version of the DPDP Bill—also had clauses about the Right to be Forgotten. However, the government decided to do away with them in the present version. The government said such clauses made the previous Bill compliance heavy.
The Bill will be tabled in the Parliament's Monsoon Session
It is unclear when we will see the Cabinet-approved version of the Bill. It is also expected to have provisions about an appellate body for people to appeal the Data Protection Board's decisions. The fresh draft of the DPDP Bill will be tabled in the Monsoon Session of the Parliament that begins on July 20.
