Eye on colleges, hospitals, Centre looks to get own house in order ahead of data protection rules

“There are so many public colleges and hospitals that are in far flung areas, and many of them are operating on rudimentary technology. But, they do handle a lot of personal data on a daily basis. We have to carefully accommodate these institutions. We discussed a lot on these accounts while framing the rules,” a senior government official said, requesting anonymity.

The data protection Act has an exemption clause for the government and its agencies, however, it is unlikely that it could be used for institutions like colleges and hospitals.

The IT Ministry did not respond to a request for comment.

There are other things that have held up the rules as well. For instance, the law said that entities that deal with the personal data of children – individuals below the age of 18 – would have to seek consent for processing their data from their parents or guardians. However, the government soon realised that it could be difficult to prescribe a particular mechanism or technological intervention to gather such consent, and is understood to have given up on the idea.

Now, the IT Ministry is expected to leave it to the discretion of the companies on how they want to seek such consent under the upcoming data protection rules.

The law has received pushback from the civil society, and Opposition. The Niti Aayog, the government’s main think tank, has also criticised some provisions in the law that could potentially dilute the Right to Information (RT) Act, The Indian Express had earlier reported.

Another major point of contention has been the wide ranging exemptions that the law offers to the government’s agencies. According to Section 17 (2) (a) of the data protection law, “The provisions of this Act shall not apply in respect of the processing of personal data — by such instrumentality of the State as the Central Government may notify, in the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these…”

The law requires companies to gather users’ personal data through a consent-based mechanism, even as it allows some relaxations to that end for certain “legitimate uses”. The penalty for not being able to take enough safeguards for preventing a data breach could go as high as Rs 250 crore.