Govt tables data protection Bill, exemptions for Centre unchanged

Exemptions for the central government and its agencies remain unchanged. The Central government will have the right to exempt “any instrumentality of the state” from adverse consequences citing national security, relations with foreign governments, and maintenance of public order among other things.

Opposition MPs, while protesting the introduction of the Bill in Parliament, raised concerns around government-exemption provisions. Congress MP Manish Tewari said that there was a distinction in the way the Bill applied to different entities.

“It applies with full force to non government entities, and the entire government is going to be exempt from it,” Tewari said. NCP MP Supriya Sule opposed the Bill saying that it was a “complete insult and hurts the federal structure of India”.

Rajeev Chandrasekhar, Minister of State for Electronics and IT, told The Indian Express that the government needs certain exemptions because it deals with various issues including terrorism, law and order, and public health emergencies. “In such a situation, there have to be carve outs so that the government can efficiently do its work,” he said, explaining the need for exemptions.

The Bill also states that if an entity is penalised in more than two instances, the central government– after hearing the entity – can decide to block their platform in the country. This is a new addition to the measure, which was not present in the 2022 draft.

Experts said that the proposal could add to the pre-existing online censorship regime already administered under Section 69 (A) of the Information Technology Act, 2000. The highest prescribed penalty has been capped at Rs 250 crore for not having enough safeguards against data breaches.  Chandrasekhar said that the blocking under the Bill would be different from that under the IT Act, 2000.

“It is a very different formulation compared to the IT Act, under which you end up taking down content when it violates various laws, including national security. There is still a certain subjectivity to it, that’s why there’s a review committee etc. Here, there has to be a violation of the law at least two times, and in the event that somebody is gaming the system… Even if it is a large company, the government reserves the right to block them,” he said.

The control of the Central government in appointing members of the Data Protection Board – an adjudicatory body that will deal with privacy-related grievances and disputes between two parties – is learnt to have been retained as well. The Chief Executive of the board will be appointed by the central government, which will also determine the terms and conditions of their service.

Chandrasekhar said that the blocking under the Bill would be different from that under the IT Act, 2000. “It is a very different formulation compared to the IT Act, under which you end up taking down content when it violates various laws, including national security. There is still a certain subjectivity to it, that’s why there’s a review committee etc. Here, there has to be a violation of the law at least two times, and in the event that somebody is gaming the system… Even if it is a large company, the government reserves the right to block them,” he said.

The control of the central government in appointing members of the Data Protection Board – an adjudicatory body that will deal with privacy-related grievances and disputes between two parties – is learnt to have been retained as well.

Chandrasekhar said that the board will have to prove its credibility over time and that the government will be judged by the same barometer as everyone else. “The law applies to the government equally as it applies to others. If there is a breach, the government will be accountable for it. It does not matter whether the board is appointed by us,” he said.

The Bill, while laying down consent norms for entities’ collecting personal data of individuals, also allows for a leeway for certain “legitimate uses,” both by the government itself, and private entities.

As per the final version, the Centre can process data of citizens without expressly seeking their consent for national security reasons and to offer other services such as subsidies,  benefits, certificates, licence or permit. Private companies have been afforded the privilege to deal with employment-related matters, including corporate espionage.

It has also addressed two key long standing demands of the industry – by allowing relaxations around the age of consent for children, and by significantly easing cross-border data flows, both of which was reported by The Indian Express earlier.

The government could notify entities as “significant data fiduciaries,” after considering factors such as the volume of personal data they possess, the risks they could pose to electoral democracy, and their impact on national security and public order, among other things. Social media platforms like Facebook, YouTube and WhatsApp are likely to be clubbed under this category. These entities are required to appoint a data protection officer for grievance redressal and carry out periodic data protection impact assessments.

Many of the rights proposed to be made available to individuals, including the ability to demand for an erasure of their personal data, could get suspended  if their data has to be processed for enforcing a legal claim, and during investigations by agencies, among other things.