Laws Governing Data Privacy in India

Data protection is defined by the Storage Networking Industry Association as the “process of safeguarding important data from corruption, compromise or loss.” Data privacy, whereas, is a “branch of data management that deals with handling personal data in compliance with data protection laws, regulations, and general privacy best practices.” Right to privacy has been held as a basic fundamental right that forms an intrinsic part of Article 21 of the Indian Constitution in the landmark case of K.S. Puttaswamy v. Union of India. With an ever-increasing number of data users today, the right to data privacy has now become an essential need. 

In India, certain provisions of the Information Technology Act of 2000, and the Information Technology (Intermediaries Guidelines) Rules, 2021 govern data privacy and intermediaries.

Post the Puttaswamy Judgement in 2017, a committee was formed under Justice B.N. Srikrishna which submitted its report on “Data Protection Framework” to the Government. The draft Personal Data Protection Bill, 2018 was a result of this report. The Bill was revised by the Parliament and named the Personal Data Protection Bill, 2019 which provided for data privacy and establishment of a Data Protection Authority. The Joint Parliamentary Committee provided its report on the Bill in 2021. However, this Bill was withdrawn in August 2022, after which the Personal Data Protection Bill, 2022 was introduced.

The 2022 Bill has 30 provisions and espouses seven principles, namely:-

(1)Usage of personal data by organizations in a lawful manner

(2)Purpose limitation

(3)Data minimization

(4)Accuracy of personal data

(5)Storage limitation

(6)Prevention of breach of personal data

(7)Accountability for data processing.

Under the proposed Bill, individuals have the right to access information, right to consent processing of their data and withdraw consent for the same, right to demand erasure and correction of data collected by the fiduciary, and right to nominate and individual on their behalf, in the event of their death.

The European Union’s General Data Protection Regulation (GDPR) is regarded as the toughest privacy and security law in the world, and the gold standard for data privacy laws of other countries. A comparison of the 2022 Bill with the GDPR shows areas where the Indian legislation can be improved.

The GDPR applies to personal data stored in physical or digital form, while the Bill applies to personal data stored in digital form alone. While the Bill uses ‘her’ to refer to an individual in certain places, the GDPR has used the expression “natural persons.” As per the Bill, ‘consent managers’ are accountable towards the Data Principal. The GDPR, on the other hand, has provisions for controllers and data protection officers. In both legislations, the personal data can be processed only after consent of the Data Principal. While the Bill specifies that the purpose has to be lawful too, the GDPR allows data collection without consent if it is in the interest of the public. Both the legislations set out obligations of the data fiduciary and specifies liabilities in case of breach.

The Bill is majorly criticized for granting excess power to the Central Government. It also does not explicitly mention the “right to be forgotten” of an individual, rather it is brought under the “right to erasure.” The Bill has provisions which would weaken the RTI Act. Though there are obligations specified for the data fiduciary, it does not include the preparation of a privacy policy design. The Bill classifies individuals below 18 years as children, which is more than the threshold of 16 years followed in other global data privacy legislations.

Another significant flaw with the legislation is that it provides for penalties, both monetary and imprisonment, without specifying the offence particularly. Parallelly, the hefty penalties would also have the effect of deterring the startup culture in India. While it is appreciable that free cross-border flow of digital personal data is allowed rather than mandating data localization by the Bill, complete silence on the regulatory approval mechanism for it, is a lacuna. The Internet Freedom Foundation, an Indian digital liberties organization, critiques that the Bill does not pass the tests of legality, legitimacy and proportionality, and the principles set out in the Puttaswamy case.

With the Information Technology Act and Rules currently ensuring data privacy of Indians, and no other existing data privacy legislation, it is prudent to expedite the conversion of the Personal Data Protection Bill, 2022 into an Act. When it materializes as a proper legislation, even though with flaws, future amendments can be made to improve the Act and attain the gold standard set by the General Data Protection Regulation, in line with the fundamental rights guaranteed by the Indian Constitution.