Explained: What Is Personal Data Protection Bill

The Joint Parliamentary Committee (JPC) established to look into the Personal Data Protection Bill has completed its report on the long-awaited legislation, paving the way for its tabling in Parliament during the Winter Session. The bill seeks to provide individuals with rights against the misuse of data pertaining to them.

The bill was first introduced in Parliament in 2019, and after an outcry from the opposition, it was referred to the JPC for further review. After two years of deliberation, the JPC has approved the bill's report.

The JPC report's recommendations, however, do not appear to have addressed the concerns raised about the 2019 bill, including the government's exemptions. PP Chaudhary, the JPC's chairperson, has received dissent notes from seven of the committee's 30 members, all of whom are MPs from opposition parties.

What does the bill propose?

Unsplash/Representational image

The original draft PDP Bill, which was introduced in Parliament in December 2019, was intended to establish provisions to protect, "Individuals' privacy relating to their personal data" by, among other things, defining the flow and use of personal data and establishing a trust relationship between persons and entities processing the data.

Its goal is to protect a user's rights in terms of how her data is processed by establishing "a framework for organisational and technical measures in data processing, laying down norms for social media intermediaries, cross-border transfer, accountability of entities processing personal data, and remedies for unauthorised and harmful processing."

Personal data is defined as any information "about or relating to a natural person who is directly or indirectly identifiable" and is linked to any "characteristic, trait, attribute, or any other feature of such natural person's identity, whether online or offline" by the Bill.

The Centre has planned to establish a Data Protection Authority of India to implement the law.

Why did the MPs object to the bill?

Unsplash/Representational image

Articles 12(a) and 35 of the Bill contain two specific features that have been identified as concerning.

Article 35 allows the Central Government to exempt any government agency from the law's provisions "in the interest of India's sovereignty and integrity, the state's security, friendly relations with foreign states, public order, and if it is satisfied that it is necessary or expedient to do so, subject to procedures, safeguards, and oversight mechanisms to be prescribed by the Government."

This is a very broad power that exacerbates the significant asymmetry in the citizen-state relationship. Because the government is one of the largest data processors and has a unique ability to influence people's lives, thanks to its monopoly on coercive powers and its obligation to provide welfare and services.

The current frameworks for protecting citizens from arbitrary and intrusive State action, as demonstrated by the Pegasus case, ethical concerns raised in facial recognition incidents, or indeed instances of privacy violations concerning Covid-19 related interventions, are not robust enough.

Furthermore, dissenting MPs have pointed out that because "public order" can be interpreted broadly, this Article gives the government broad powers to override individual freedom.

Article 12(a) eliminates the need for the data principal's informed consent for the processing of her data when it is required "for the performance of any function of the state authorised by law for I the provision of any service or benefit to the data principal from the state; or (ii) the issuance of any certification, licence, or permit by the state for any action or activity of the data principal by the state."

The dissenting MPs argue that, to the extent that the state may collect personal data without the individual's consent, the Article should require that such data collection be "proportionate" to the goal sought, as the Supreme Court has established "proportionality" as a test for any restriction on an individual's fundamental rights.

Furthermore, the main concerns raised revolve around the inclusion of social media in the PDP bill, which was not specified in the initial draft. According to the bill, social media intermediaries should be treated as publishers and subject to strict regulation.

Why was the bill kept pending for so long?

Unsplash/Representational image

The bill is a direct result of the Supreme Court's decision in the Justice KS Puttaswamy vs Union of India case in 2017, which declared "privacy" to be a fundamental right. It had ordered the Centre to introduce a strong data protection law when it handed down its decision in the case.

Under Justice BN Srikrishna's leadership, the Centre established an Expert Committee on Data Protection, which proposed the Personal Data Protection Bill, 2018 in July 2018.

The committee's draft was then circulated for public comment before being tabled in Parliament, where it was referred to the JPC, which received five extensions, the most recent in July this year, after multiple members, including its chairperson Meenakshi Lekhi, were inducted into the government, disqualifying their continued membership on the panel.

For more on news and current affairs from around the world please visit Indiatimes News.