Exemptions for start-ups in data Bill have ‘sunset’ clause; penalties may go up later

Entities that fail to take “reasonable security safeguards” to prevent personal data breaches will be fined as high as Rs 250 crore. If an entity fails to notify users and the Data Protection Board about a data breach, the fine could go as high as Rs 200 crore. The maximum penalty that could be imposed on an entity has been capped at Rs 500 crore per instance of violation.

However, the government “reserves the right to increase it (the penalty), modify it, as the case may be down the road,” Chandrasekhar said. “The fines were brought in to signal that we will use financial penalties as the way to create a culture among data fiduciaries of no misuse and protecting consumers’ data. This is the initial number of Rs 500 crore, and the government reserves the right to increase it, modify it, as the case may be down the road,” he said.

Since regulations around technology issues are constantly evolving, Chandrasekhar said that the magnitude of penalties and other provisions will be periodically reviewed by the Centre and the Data Protection Board — the proposed body to enforce provisions of the Bill.

“It is for the Data Protection Board and the Government of India to periodically review penalties. A part of the design of this Bill is that this is constantly evolving. The consent manager architectures may evolve, the penalties may evolve, the types of rules and regulations that guide a lot of this will continue to evolve. So, given that is the basic design principle of this, it is quite clear that even the penalty numbers will keep changing as we see the need for it,” he said.

In the previous version of the Bill, which was withdrawn by the government in August, the penalty proposed on a company for violation of the law was Rs 15 crore or 4 per cent of its annual turnover, whichever was higher. The reason behind hiking the absolute amount in the revamped draft Bill was that the government did not want to adopt criminal prosecution against offenders, Chandrasekhar said.

“We want to decriminalise this issue and bring it into the civil space. We want to use financial penalties as the way to punitively impose punishment on those who violate consumers’ and citizens’ rights,” he said.

The Bill also says that the central government could notify private entities that will be exempt from adhering to some of its provisions. Chandrasekhar explained that the measure has been proposed because the government does not want early stage start-ups to be “burdened” by the Bill. He also clarified that such exemptions will only be given to entities “for a particular period of time” and in a “transparent” manner.

“This particular exemption is agnostic in terms of what sectors the start-ups could be from. But there will be a sunset on this exemption. So, for example, the government could exempt start-ups that have fewer than a particular number of users, and the moment they cross that threshold, then the exemptions will not apply,” Chandrasekhar said.