Introduction
India's 6-year long journey in the realm of data protection and privacy has finally culminated into the latest Digital Personal Data Protection Bill 2023 (2023 Bill). The 2023 Bill was tabled before the lower house of the Parliament (i.e. Lok Sabha) on 3 August 2023, and is now slated to be debated.
As a quick recap, the Personal Data Protection Bill 2019 was withdrawn by the Ministry of Electronics and Information Technology (MeitY) in August 2022 and in November 2022, MeitY released a much leaner draft Digital Personal Data Protection Bill 2022 (2022 Bill) for public consultation. While largely similar to its predecessor in many respects, the 2023 Bill addresses a few key industry concerns that were raised during the public consultations. We briefly discuss certain significant changes and key highlights as below.
Key Highlights of the 2023 Bill
- Legislative scope: The 2023 Bill will apply to personal data collected from data principals (i.e., individuals to whom the personal data relates to) within India if collected: (i) in digital form; and (ii) in non-digital form and digitized subsequently. It continues to have an extraterritorial applicability which will extend to processing of digital personal data outside India, if such processing is in connection with an activity related to offering goods or services to data principals within India. A prominent deviation, however, is that the 2023 Bill excludes 'profiling' of data principals within India from its extra-territorial scope.
- Grounds for processing of personal data: According to the 2023 Bill, personal data can only be processed on the basis of consent of data principal or for certain legitimate uses (e.g., where personal data is provided voluntarily, for provision or issuance of subsidies, benefits, etc. by the State, fulfilling legal obligations, compliance with judgment/ decree, responding to medical emergency, certain employment purposes and so on). Where the basis is consent, such consent will have to be procured in the prescribed manner. Additionally, there are conditions for processing data for legitimate uses.
- Obligations of data fiduciaries: In contrast to the 2022 Bill, the 2023 Bill primarily requires the data fiduciary to be responsible for compliance and prescribes corresponding penalties. Data processors' obligations which were outlined in the 2022 Bill (e.g., implementation of technical measures) have been dropped. Notably, data fiduciaries can engage data processors only under a valid contract. Data fiduciaries are also required to implement appropriate technical and organisational measures, ensure an effective mechanism for grievance redressal, report personal data breaches to the Data Protection Board of India and the impacted individuals, etc.
- Additional obligations for significant data fiduciaries: Similar to the preceding versions of the proposed data protection law, the 2023 Bill provides for classification of data fiduciaries as 'Significant Data Fiduciaries' by the Central Government based on identified factors. Such Significant Data Fiduciaries are required to comply with additional obligations such as appointment of a data protection officer residing in India, appointment of an independent data auditor, undertaking of data protection impact assessments and such other measures as may be prescribed.
- Additional obligations in relation to processing of data of children or persons with disability: The 2023 Bill mandate data fiduciaries to obtain 'verifiable consent' from parents before processing personal data of children (i.e., any individual below 18 years of age) or person with disability who has a legal guardian. Further, the 2023 Bill casts a duty on the data fiduciary to not undertake behavioral tracking/ targeted advertising which is 'likely to cause any detrimental effect on the well-being of a child'. Additionally, the age of children may be lowered for only those processing activities of a data fiduciary, which are deemed verifiably safe by the Central Government.
- Oversight and enforcement: The Central Government will establish a Data Protection Board of India (Board), which will be responsible for determining non-compliances under the legislation and for imposing penalties. The Board will be an independent body operating digitally. Every order made by the Board will be enforceable akin to a decree made by the civil court. Any person aggrieved by any order or direction of the Board may prefer an appeal before the Telecom Disputes Settlement and Appellate Tribunal within a period of 60 days from the receipt of such order/direction.
- Cross-border transfer of personal data: In a significant departure from the 2022 Bill, the 2023 Bill provides that the Central Government may restrict the transfer of personal data by a data fiduciary for processing to such country or territory outside India as may be notified. However, it has been clarified that such power will not override any law that provides for a higher degree of protection for or restriction on transfer of personal data by an entity.
- Exemptions: Certain additional exemptions have been provided under the 2023 Bill such as implementation of scheme of compromise or arrangement or merger or amalgamation and for the purpose of ascertaining the financial information and assets and liabilities of any person who has defaulted in payment of a loan. In addition, the Central Government (by notification within 5 years) may exempt certain categories of data fiduciaries such as startups from certain obligations.
- Enhanced financial penalties: Similar to the 2022 Bill, penalty of up to INR 250 crores (approximately, USD 30 million) has been prescribed for failure to take reasonable security safeguards to prevent personal data breach. However, the 2023 Bill removes the upper limit of INR 500 crores (approximately, USD 60 million) which could have been imposed in each instance of a significant non-compliance, as was mentioned in the 2022 Bill.
- Miscellaneous powers of the Central Government: A completely new provision in the 2023 Bill provides that upon a reference by the Board in writing and in the interest of general public, the Central Government can block a data fiduciary's platform. Further, the Central Government may require the Board and any data fiduciary or intermediary to furnish such information as it may call for.
Comment
The overall look and feel of the 2022 Bill has been retained. The 2023 Bill remains a principle-based legislation as its predecessor. There is status quo in relation to key aspects such as the absence of any categorization of personal data into sensitive personal data and critical personal data. Additionally, most of the high financial penalties have been retained in the 2023 Bill for effective deterrence for non-compliance. There is still no definite preparation time which has been prescribed in the 2023 Bill.
For the business fraternity, provisions for cross-border transfer of data with introduction of a negative list, exemption for certain categories of data fiduciaries including start-ups from compliances, etc., are significant to note. With the 2023 Bill reaching the floor of the Lok Sabha, one more step has been taken towards India finally implementing its much-awaited data protection law.
The content of this document do not necessarily reflect the views/position of Khaitan & Co but remain solely those of the author(s). For any further queries or follow up please contact Khaitan & Co at [email protected]
The content of this document does not necessarily reflect the views / position of Khaitan & Co but remain solely those of the author(s). For any further queries or follow up, please contact Khaitan & Co at [email protected].
