SynopsisIndia is in the final stages of enacting a privacy legislation that will protect the personal data of its citizens. A glimpse into what will change, and for whom, after the Bill is signed into law.
India is in the final stages of enacting a privacy legislation that will protect the personal data of its citizens.
A parliamentary panel that studied the Personal Data Protection Bill, 2019, submitted final suggestions on Thursday, widening its scope to regulate other key aspects of the digital economy. The government is likely to present the Bill in the Budget session of Parliament.
What will the legislation, once passed, mean for an average Internet user, an emerging business, children below 18 years of age and the government itself?
ET attempts to provide a glimpse into the changed scenario.
The Average Internet User
The Bill aims to protect internet users and keep their data private. It compels companies and the government to seek consent while collecting data. It recommends that the collected data be limited to a specific purpose, minimise the quantum of data sought from users and store most of it within the country.
It lays down strict rules for firms that collect individual data and confers rights on citizens to obtain personal data, correct, erase, update and port the data to other companies. It also gives them the right to restrict or prevent disclosure of personal data. The recommendations empower individuals to hold companies accountable if their personal data is misused or breached.
“A robust data protection law is critical to safeguard the privacy of Indian citizens while driving India’s success in the digital economy,” said Debjani Ghosh, president of IT industry association Nasscom.
A Government Official
The government will be able to exempt its own agencies from legal oversight without sufficient checks and balances. This means various government agencies will have the power to collect and process personal data without consent or by applying other legal safeguards.
The exemption gives wide-ranging powers to a government official and increases the risk of state surveillance. The panel has suggested that the head of government departments should not be made directly responsible for a data breach.
“If I am a government officer, I am going to have immense powers to access personal data of Indians without any fear or accountability. It enhances the scope of surveillance. It may help the government provide better services…but the downside is loss of digital rights,” said cyber law expert Pavan Duggal.
An Emerging Data Business
The panel recommends the promotion of a digital economy.
This will not only increase compliance costs to meet regulatory requirements but also hinder startups from collecting data beyond a specific objective, as the Bill contains many provisions around data minimisation and purpose limitation.
“Google started as a search engine and Amazon as a bookseller. They forayed into new businesses by looking into the data they had. Startups solve a problem by looking into user data and find new problems to solve and enter new markets. By limiting data collection, the whole business model of startups will change,” said Nikhil Narendran, partner at law firm Trilegal.
A Child Browsing The Internet
No child under the age of 18 is allowed to be tracked, profiled, monitored or subjected to targeted advertising online, according to the proposal. It also broadens the scope of these restrictions to include all data fiduciaries, even discarding the concept of a guardian data fiduciary.
It also removes the consent clause for platforms that provide counselling or child protection services to process this data. Instead, it leaves this mandate to the incoming Data Protection Authority. The recommendations are also silent on a specific mechanism of age verification.
The Bill hopes to restrict companies from accessing a child’s data or mine it for profit. The data protection rules for children could, however, end up robbing them of agency if parents are allowed to decide on their behalf.
The requirement for parental consent would work in favour of the democratisation of access to digital services, said Lalitesh Katragadda, founder of Indiehood and part of a government panel on Non-personal Data Governance Framework. “There is a concern that parents will restrict their children from watching something, but the argument there is that this is already happening in the absence of any control…but if you allow tagging and family controls, we will democratise access to digital,” Katragadda said.
Share the joy of reading! Gift this story to your friends & peers with a personalized message. Gift Now