Last-Minute Changes To Data Protection Bill: Should We Worry?

The Digital Personal Data Protection Bill, 2023, scheduled for discussion in Parliament tomorrow, has witnessed last-minute changes that are raising eyebrows. The changes include:

• The government will now notify countries where data cannot be transferred, instead of countries where it can be transferred.
• Data fiduciaries will no longer need consent to transfer personal data to another entity for data processing.
• The central government can pass a written order directing the blocking of a data fiduciary after hearing, if recommended by the board.
• The centre can ask the board and any data fiduciary or intermediary to furnish information it wants.
• No suit, prosecution, or other legal proceedings can be filed against the central government, the board, the chairperson, or members of the board.

CONCERNS REMAIN DESPITE CHANGES

Despite these changes, concerns raised by the opposition and activists since November last year remain unresolved. The opposition alleges that they have not even been shown a draft of the bill, while activists say this bill endangers the Right to Information Act by restricting its scope.

The legislative business list describes the Bill's purpose as providing a framework for processing digital personal data while recognizing individuals' right to data protection and the need for lawful data processing.

A COMMITTEE OF EXPERTS AND THE BILL'S JOURNEY

In 2017, a Committee of Experts on Data Protection chaired by Justice BN Srikrishna was set up by the Union government to address data protection issues.

In July 2019, the Personal Data Protection Bill, 2019, was introduced in Lok Sabha and referred to a Joint Parliamentary Committee, which submitted its report in December 2021.

However, the Bill was withdrawn from Parliament in August of the following year.

In November 2022, the Ministry of Electronics and Information Technology released the Draft Digital Personal Data Protection Bill, 2022, for public feedback.

ANALYSTS AND OPPOSITION RESPONSE

Analysts and activists assert that the Bill fails to adequately address data protection concerns and instead facilitates data processing by state and private entities. The Opposition accuses the government of bypassing parliamentary procedures.

CONCERNS OVER CORPORATES AND GOVERNMENT CONTROL

Worries persist about corporates and public sector undertakings being left outside the scope of this law, especially those holding significant personal data. Critics claim the bill grants amnesty to big tech under the guise of data fiduciaries.

The issue of surveillance and accountability also arises, with activists demanding an independent data protection board. However, since the government controls the board's appointment and removal of the chairperson and members, concerns arise about potential government influence over its functions.

It remains to be seen whether the bill will be passed by Parliament tomorrow. However, the concerns raised by the opposition and activists suggest that the bill needs to be further amended before it can be considered a comprehensive and effective law on data protection.