Data protection Bill likely to come up before Cabinet today

“The Cabinet is expected to take up the Digital Personal Data Protection Bill, 2022 on Wednesday and once it gets the approval, the Bill will be tabled in the upcoming Parliament session,” a senior government official said, requesting anonymity.

The Bill is a key pillar of an overarching framework of technology regulations the Centre is building which also includes the Digital India Bill — the proposed successor to the Information Technology Act, 2000; Indian Telecommunication Bill, 2022; and a policy for non-personal data governance.

The fresh draft was released after the government withdrew an earlier version from Parliament last August after nearly four years of being in the works, where it went through multiple iterations including a review by a Joint Committee of Parliament (JCP), and faced pushback from a range of stakeholders including tech companies and privacy activists.

The Indian Express earlier reported that in a move that could further liberalise conditions for data transfer, the proposed new law could allow global data flows by default to all jurisdictions other than a specified negative list of countries where such transfers would be restricted.

The draft which was released for public consultation said that the Centre will notify countries or territories where personal data of Indian citizens can be transferred. Sources said this is likely to be amended with the Bill allowing cross-border data flows to all geographies with an official blacklist — of countries where transfers would be restricted.

This change is seen as a move to ensure business continuity for enterprises and to place India as a crucial part of the global data transfer network – an important element of trade negotiations the country is currently exploring with key regions such as the European Union.

A provision on “deemed consent” in the draft Digital Personal Data Protection Bill, 2022, could also be reworded to make it stricter for private entities while allowing government departments to assume consent while processing personal data on grounds of national security and public interest. The Bill could also incorporate a provision to ensure it does not come in conflict with pre-existing regulations issued by other Departments or Ministries, this paper earlier reported.

The Bill has been criticised by privacy activists for offering wide-ranging exemptions to the Centre and its agencies, and diluting the role of the data protection board.

“The new Bill makes sure that consumer rights to data protection are captured as rights. Data fiduciaries’ obligations are light and easy to comply with so that it does not slow down innovation, the economy, and India’s position as a safe destination for data processing for the world’s citizens. It also ensures that the government’s governance objectives based on data governance are met,” Rajeev Chandrasekhar, Minister of State for Electronics and IT told this paper earlier.