© The Indian Express Pvt Ltd
Tags:
Journalism of Courage
Despite proposing to set up a data protection board, the Digital Personal Data Protection Bill (DPDP Bill) could also allow the government to direct any entity to furnish information “as it may call for,” allowing the Centre greater control over the law. The final version of the Bill could also further India’s online censorship regime – it is expected to propose that entities that have been penalised on at least two instances for violating norms can be blocked by the central government, The Indian Express has learnt.
The draft DPDP Bill, 2023, is scheduled to be tabled in Parliament on Thursday in what would be India’s second attempt at framing a privacy legislation, six years after the Supreme Court declared privacy as a fundamental right. The Bill, if enacted as law, will be a crucial legislation for the country, which is the largest market for some of the biggest tech companies in the world.
The final version of the Bill is learnt to have retained the contents of the original version of the legislation proposed last November, including those that were red flagged by privacy experts. Wide-ranging exemptions for the central government and its agencies, remain unchanged. The central government will have the right to exempt “any instrumentality of the state” from adverse consequences citing national security, relations with foreign governments, and maintenance of public order among other things.
It is also expected to state that if an entity is penalised in more than two instances, the central government– after hearing the entity – can decide to block their platform in the country. This could add to the pre-existing online censorship regime administered under Section 69 (A) of the Information Technology Act, 2000. The Bill, while laying down stringent consent norms for entities’ collecting personal data of individuals, also allows for a leeway for certain “legitimate uses,” both by the government itself, and private entities.
The Centre can process data of citizens without expressly seeking their consent for national security reasons and to offer other services such as subsidies, benefits, certificates, licence or permit.
The Indian Express had earlier reported that the Bill could give powers to the central government to prescribe a lower age of consent than 18 years for accessing Internet services without parental consent if the platform they are using can process their data in a “verifiably safe manner”.
The government could notify entities as “significant data fiduciaries,” after considering factors such as the volume of personal data they possess, the risks they could pose to electoral democracy, and their impact on national security and public order, among other things. Social media platforms like Facebook, YouTube and WhatsApp are likely to be clubbed under this category.
Other key changes to the upcoming Bill include further relaxations to cross-border data flows to international jurisdictions – by moving away from a whitelisting approach, to a blacklisting mechanism, as reported earlier by this newspaper.
Many of the rights proposed to be made available to individuals, including the ability to demand for an erasure of their personal data, could get suspended if their data has to be processed for enforcing a legal claim, and during investigations by agencies, among other things.
The data protection board, which will include members from the fields of data governance, administration or implementation of laws related to social or consumer protection, dispute resolution, information and communication technology, digital economy, and law, could be empowered to summon individuals and examine them under oath during its investigation into a violation.
Members of the data protection board, including its chairperson, could be prohibited from accepting employment at any entity against whom any violation-related proceedings were initiated, for at least a year from leaving the board.
