Draft Digital Personal Data Protection Bill 2022: Everything you need to know

The Ministry of Electronics and IT introduced a new data protection bill draft titled Draft Digital Personal Data Protection on November 18, 2022. ‘ With this bill, the Ministry of Electronics and IT, aims to secure an individual's personal data.

The main objective of the Draft is to seek users' consent and inform them about the data collection type. The Draft was first published in July 2018 and has now been officially reopened for public consultation till December 17, 2022.

But what is the Draft Digital Personal Data Protection Bill? How helpful will it be for the users? These are some of the questions we will address through this blog.

So, sit tight as we take you through all the nitty-gritties associated with the bill.

What is the applicability of the Draft Digital Personal Data Protection Act?

The Digital Personal Data Protection Bill represents the Indian Government's stance on protecting the citizens' personal data by describing the roles and responsibilities of individuals and organizations.

On the one hand, It lists out the rights and duties of the citizen who share personal data, and on the other hand, it frames the obligations of organizations using the collected data.

The Bill, when implemented, will introduce a comprehensive legal framework concerning personal data protection in India, putting the Indian subcontinent on the map with other leading nations with concrete privacy laws in place.

Organizations will be permitted to process digital personal data in a way that recognizes the right of individuals to secure their personal data, societal rights, and the necessity to process personal data for authorized reasons under the parameters of the Digital Personal Data Protection Act.

It is imperative to note that the Bill only applies to the 'processing of digital personal data,' which includes all the data collected online and offline data that has been digitized in the Indian subcontinent. However, this can also apply to data processed out of India but profiled and offered with services in India.

Benefits of the Draft Digital Personal Data Protection Bill

• Appointing the Data Protection Board of India will direct Data Fiduciaries to respond urgently and effectively to Personal Data breaches. While sharing a similar rank with the civil court, the board's power will be limited to compliance enforcement and issuing penalties. Data Fiduciary refers to the person(s) who decide on the purpose and method of processing Personal Data.

• Data fiduciaries must obtain consent from data principals with an itemized notice assenting to processing their l data. t Request and consent should be in clear and plain terms. Data Principal is the person whose personal data is being processed, stored, and used.

• Using deemed consent in cases where the data principal would approve processing their information. Deemed consent can be used for employment purposes and public interest, such as debt recovery and prevention of fraud.
• The DPDP grants data principals the right to correction, the right to erasure, and the right to be forgotten. It also provides data principals the right to nominate any other individual to exercise their rights in the event of death or incapacity. Rights of data principals; right of correction, right of erasure, and right to be forgotten.

• The proposal specifies that Consent Managers will be platforms registered with the Data Protection Board. Individuals can manage, review, and withdraw consent supplied by Data Fiduciaries through these platforms.

Seven principles of the Digital Personal Data Protection Bill 2022

The 2019 version of the bill was withdrawn because the government wanted to create a comprehensive legal framework that secured personal data and granted them protection rights simultaneously.

Below are a few changes/introductions we will see when the revised Draft Digital Personal Data Protection Bill comes into force.

1. Government control

A Data Protection Board, set up by the Union government, will now regulate the matters of personal data, with its role being primarily enforcing compliance and issuing penalties. The Government will have a say in the composition of the board and terms of service and will be responsible for implementing the law beyond the board's jurisdiction.

2. Data localization

One of the changes introduced under the draft bill is about data storage. Unlike previous personal data laws, this law does not require local data storage, i.e., organizations no longer need to store sensitive and critical data exclusively in India. That said, it also does not permit the free flow of data across borders. Organizations can transfer data only to the countries notified by the Indian Government,

3. Only monetary penalties

Under schedule I of the Digital Personal Data Protection Bill, the government can only issue monetary penalties in case of breaches or non-compliance. It also mentions that these penalties are limited to data breaches that may have a significant impact. The range of penalties may vary from INR 50 crore to INR 250 crore, with the maximum penalty limited to INR 500 crore, as per schedule 25 of the Bill.

4. Data pertaining to individuals under the legal age

According to the revised version of the Bill, parental consent is mandatory for individuals under 18. While the underlining of this provision is yet to be discussed, some experts have mentioned that the Bill fails to recognize that a toddler's consent differs from that of an adolescent.

Some critics have also expressed concern that parental approval may be detrimental to a child's personal development. Some parents may not want their children exposed to opposing perspectives.

These restrictions also directly violate India's stance on the Rights of the Child.

5. Collection of data

Specific data protection principles, such as limitations on the collection of data, have been removed from the Bill. The Bill permits the data fiduciaries to collect any personal data with the consent of the data principal.

However, it also enlists that the data principals should be provided with information about the kind of personal data that is relevant for a particular purpose. For instance, a photo filter app does not need access to location or contacts. But if it is asking for the said details, the user must know the relevant purpose for the same.

6. Government exemptions

According to the Bill's provisions, government bodies may be exempted from the regulations in the interests of India's sovereignty and integrity, security, foreign relations, public order, and other considerations. While the previous version of the Bill subjected government exemptions to a "just, fair, reasonable, and proportionate" mechanism, the latest revision puts no such bar on government bodies.

7. No unnecessary information requirements

It was mandated that significant information must be provided for the data principal in terms of their rights, grievance redressal mechanisms, information retention time, and source of information, but the current draft limits the scope of this information to two requirements; the personal data sought and the purpose of data processing.

Important provisions not included in the Draft

Even though the revised version of the Digital Personal Data Protection Bill grants several rights to data principals, it has been recorded that there are two important provisions that should be included in the Draft but aren't as of yet. These are

1. The right to data portability: This right allows the data principals to receive and review their personal data in a structured way. It would allow data principals to make the choice of platforms they want their data to be shared on and will eliminate the need to provide all their personal data again while switching platforms.

2. The right to foregone information: The right to foregone information or to be forgotten is not included in the Draft. This confusion of the general right to erasure and the right to be forgotten jeopardizes other people's freedom of speech and expression.

As a result, it can be said that the Draft Digital Personal Data Protection Bill is entirely focused on personal data and excludes the protection of non-personal data, which was a demand from both industry and civil society.

What are the next steps in the introduction of the Digital Personal Data Protection Bill?

As mentioned earlier, after multiple revisions, the Draft Digital Personal Data Protection Bill has been published for public review and is open for the same till December 17, 2022.

Even though the Draft has received praise from a number of experts for its improvements over previous iterations, there are still a few issues that the government should take into account.

There are speculations that more provisions, specifically important ones such as data portability and the right to forgone information, should be covered under this legislation. One of the next steps in moving forward with the DPDP Bill will be to create a plan to compensate individuals in cases of a data breach.

Additionally, commenters also contend that the Draft Bill needs to incorporate the tenets of the General Data Protection Regulation (GDPR), which governs privacy in the EU for the effective protection of personal data.

Frequently asked questions (FAQs)

How can organizations comply with the Digital Personal Data Protection Bill? The law obliges data processors to implement adequate security measures to safeguard user information, notify users in the case of a data breach, and discontinue retaining user data if users choose to terminate their accounts. The proposal establishes new safeguards that businesses must use in addition to data minimization rules to stop the illegal collection or processing of personal data.

What are the consequences of non-compliance with the Digital Personal Data Protection Bill? Besides the fines that can be imposed on organizations in case of non-compliance with the Digital Personal Data Protection Bill, failure to prevent data breaches can also incur companies a financial penalty of up to $30.6 million (₹250 crores). Additionally, a failure to notify users of the breach can ratchet the fines up to $61.3 million (₹500 crores).

What are SDFs or Significant Data Fiduciaries? Significant Data Fiduciaries are people who handle private information. The central government decides who will qualify for SDF's role. s Considering the sensitivity of this role, like the quantity of private information, processed, the amount of danger possessed, and any potential effects on India's sovereignty and integrity. According to the Bill, such organizations must also appoint a designated "Data Protection Officer" to act as their representative and point of contact for complaints.