How private will citizens’ data remain under the new data privacy bill?

The government finally tabled the Digital Personal Data Protection Bill (DPDPBill) in Lok Sabha amid demands that it be referred to a parliamentary panel for scrutiny as it involves issues of Right to Privacy and that the government should not rush the bill.

The government has vehemently denied that the bill was being included as a ‘money bill’, and insisted it was a ‘normal bill’. In case of a normal bill, it is referred to the Joint Parliamentary Committee (JPC) for final scrutiny.

The apprehension of the opposition was that if on passage in the Lok Sabha, the bill is termed as a money bill, and is certified by the Lok Sabha Speaker, then the Rajya Sabha can only recommend non-binding changes to it, ultimately getting it passed.

Incidentally, a copy of the Presidential order classifying the bill as a money bill has been posted on Twitter by an opposition leader.

So, is the government lying? Why is it camouflaging a non-finance bill, as a finance bill? What is the crushing hurry the government seems to be in?

Government sources have defended their stand saying the President’s assent had been sought as funds will be earmarked under the proposed law from the Consolidated Fund of India The work on the data protection bill started after the Supreme Court ruled that the Right to Privacy is a fundamental right.

The government had in August last year withdrawn the personal data protection bill, which was first presented in late 2019 and issued a new version of the draft bill in November 2022.

In the digital age, our lives can increasingly be reduced to various data points such as what we post on social media, food we order, cabs we take, purchases we make, our bank accounts, our mobile numbers, people we match with on dating profiles etc.

These data points, when collated, can create a comprehensive profile of an individual. Thus, it is essential that access and use of our information is regulated to ensure that the information we provide is not misused.

The SC, while stating that informational privacy is an important facet of the right to privacy under the fundamental right to life, emphasised that the Union Government should examine and put in place a robust regime for data protection Like its previous avatars, the draft bill failed to include any provisions which would enable the reform of the surveillance architecture in India.

Any exemptions sought by government agencies in using personal data should be granted only if they fulfil the standards of legality, necessity, and proportionality. It is essential that government collection and processing of citizen data is regulated to prevent misuse.

The bill which was introduced in Parliament moots the creation of a Data Protection Board of India and provides protection to the Centre, the board and its members, on “action taken in good faith”.

In reality provisions under the bill enable the Centre to block access to content in the interest of the general public on getting reference in writing from the board.

The bill has relaxed penalty norms compared to the proposal made in the draft DPDP that was circulated for public consultation in November 2022.

Under the schedule, a maximum of Rs 250 crore and a minimum of Rs 50 crore can be imposed on entities violating the norms.