The Ministry of Electronics and Information Technology (Ministry) has issued a Bill, titled ‘The Digital Personal Data Protection Bill, 2022’. (“the Bill”). The Ministry has invited feedback from the members on the Bill.
Background: Currently, data protection in India is governed by the Information Technology Act 2000 and Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (‘the SPDI Rules’) . But the Digital Data Protection Bill, once enacted, will have significant implications on all organisations operating in India. The purpose of this Act shall be to provide for the processing of digital personal data in a manner that recognizes the right of individuals to protect their personal data and the need to process personal data for lawful purposes
Key Highlights of the Bill are as under:
- Digital Personal Data Protection Act, 2022 (“the Act”). shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint.
- Some of the important definitions are as below:
- Board means the Data Protection Board of India established by the Central Government for the purposes of this Act.
- Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data.
- Data Principal means the individual to whom the personal data relates and where such individual is a child includes the parents or lawful guardian of such a child.
- Data Protection Officer means an individual appointed as such by a Significant Data Fiduciary under the provisions of this Act.
- Personal data means any data about an individual who is identifiable by or in relation to such data.
- Applicability of the Act – The provisions of this Act;
- shall apply to the processing of digital personal data within the territory of India where:
- such personal data is collected from Data Principals online; and
- such personal data collected offline, is digitized.
- shall also apply to processing of digital personal data outside the territory of India, if such processing is in connection with any profiling of, or activity of offering goods or services to Data Principals within the territory of India.
- Provisions pertaining to Notice and Consent
- Personal data of a Data Principal shall be processed only for a lawful purpose for which consent has been given or deemed to have been given and shall be in accordance with the provisions of this Act and Rules made thereunder.
- On or before seeking consent of a Data Principal, a Data Fiduciary shall give an itemised notice to the Data Principal which shall contain a description of personal data sought to be collected and the purpose of processing of such personal data.
- Request for consent shall be presented along with the contact details of a Data Protection Officer or any other person who is authorised by the Data Fiduciary to respond to any communication from the Data Principal for this purpose
- Data Principal shall have the right to withdraw his/her consent at any time for processing of personal data. Such withdrawal of consent shall not affect the lawfulness of processing of the personal data based on consent before its withdrawal.
- Deemed Consent – A Data Principal is deemed to have given consent to the processing of personal data, if such processing is necessary under any law or in accordance with the conditions prescribed in the Act.
- Obligations of the Data Fiduciary : In accordance to the Bill the Data Fiduciary shall:
- be responsible for complying with the provisions of this Act in respect of any processing undertaken by it
- make reasonable efforts to ensure that personal data processed by or on behalf of the Data Fiduciary is accurate and complete
- protect personal data in its possession or under its control by taking reasonable security safeguards to prevent personal data breach
- notify the Board and each affected Data Principal, in such form and manner as may be prescribed, if any breach of personal data occurs
- cease to retain personal data, when retention is no longer necessary for legal or business purpose
- have in place a procedure and effective mechanism to redress the grievances of Data Principals
- The Bill prescribes various rights of the Data Principal inter alia; Right to information about personal data Right to correction and erasure of personal data Right to grievance redressal and Right to nominate
- The Bill also lists down various instances wherein the obligations of the Data Fiduciary may be exempted e.g. processing of data for enforcing any legal right or claim, processing of data by any court or tribunal or such other body for performance of any judicial or quasi-judicial function
- The Central Government may notify any Data Fiduciary or class of Data Fiduciaries as Significant Data Fiduciary on the basis of an assessment relevant factors as specified
- The Significant Data Fiduciary shall appoint a Data Protection Officer who shall represent the Significant Data Fiduciary under the provisions of this Act and shall be based in India.
- The Central Government shall notify such countries or territories outside India to which a Data Fiduciary may transfer personal data, in accordance with such terms and conditions as may be specified.
- Chapter 5 of the Bill deals with Compliance Framework of the Act and in accordance to the same:
- The Central Government shall establish the Data Protection Board of India (“Board”)and appoint the Chief Executive who will be entrusted with the management of the affairs of the Board.
- The Board shall determine non-compliance and impose penalty under the provisions of this Act and perform such functions as the Central Government may assign to the Board.
An appeal against any order of the Board shall lie to the High Court, no civil court shall have the jurisdiction to entertain any suit or take any action.
Source category: Others
Attachments
- /2022/136_Notice_-_Public_Consultation_on_DPDP_2022_1.pdf
- /2022/136_The_Digital_Personal_Data_Potection_Bill,_2022_0.pdf
Comments are closed