Digital Personal Data Protection Bill 2023 introduced in Parliament

Union Communications, Electronics and Information Technology Minister Ashwini Vaishnaw introduced Digital Personal Data Protection Bill, 2023, in the Lok Sabha on Thursday.

Opposition members strongly opposed the introduction of the bill and said that the bill violates the fundamental right to privacy. They demanded that the bill should be sent to the standing committee for scrutiny. They said the government had withdrawn a bill on data protection last year and the new bill needs more scrutiny.

Vaishnaw said that it is not a money bill and all issues raised by the opposition will be answered during the debate. The bill provides for the processing of digital personal data in a manner “that recognises both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes”.

The first Personal Data Protection Bill was introduced in 2019 in Parliament. A Committee of Parliament, after thorough consideration, recommended changes to it, citing feedback from stakeholders and various agencies. Consequently, the Bill was withdrawn in August last year. In November last year, the government published a new draft Bill, called Digital Personal Data Protection Bill 2022, and floated it for consultation and feedback.

The current bill comes after the government received more than 21,000 comments from the public and held consultations with 46 sector organisations, associations, and industry bodies.

Commenting on the introduction of the new Data Protection Bill, Software Freedom Law Centre, commonly known as SFLC — a Delhi-based legal non-profit organisation, said, “The Digital Data Protection Bill, 2023 has been introduced as a financial bill. The government has been given a lot of powers under the bill and there is no sufficient legislative guidance provided regarding these. Section 43 A of the IT Act which provided a remedy to aggrieved persons to get compensation has been deleted.”

It added, “However, the bill does not provide for compensation to be granted for data principals whose privacy has been violated and has suffered a loss. Deemed consent that had raised red flags earlier has been reworded but principally remains the same. Data Principals have been saddled with duties and penalties prescribed for acting in violation of these. Cross-border data flow has been changed from whitelisting to blacklisting regime which is a welcome change.”

SFLC.in also argued, “However, such data transfer restrictions are permitted in the case of specific laws in existence. A problematic provision is a clause added in the bill for blocking a computer resource which could be used for blocking websites and applications. Although the consultation process took a long time, the Government does not seem to have considered the inputs received from stakeholders and recommendations from the JPC.”

— Written with inputs from ANI