The Lok Sabha passed the Digital Personal Data Protection (DPDP) Bill, 2023 by a voice vote even as the Opposition was in an uproar over the violence in Manipur. The DPDP Bill will now be placed before the Rajya Sabha for their consideration.
The bill aims to “safeguard” citizens’ data even as it proposes to impose a penalty of up to Rs. 250 crores on entities who misuse the data or fail to protect individuals’ digital data. This is the third version of the bill which was a result of the Supreme Court’s suggestion for the need for a data privacy law in its 2017 Puttaswamy judgment on the right to privacy.
The bill was introduced in the Parliament’s Monsoon Session last week and taken up for consideration today. Addressing concerns over the wide range of exemptions given to the Centre, Union Minister of Electronics, Information and Technology (MeitY) Ashwini Vaishaw said there were reasonable safeguards and accountability in the proposed law.
The bill gives the Centre the right to exempt “any instrumentality of the state” from adverse consequences on national security grounds or that of relations with foreign governments, and maintenance of public order, among other things.
The Centre controls the appointment of the Data Protection Board (DPB) – an adjudicatory body dealing with privacy-related disputes and issues. The Centre will also appoint the Board’s Chief Executive who will also determine their terms and conditions of service. The Telecom Disputes Settlement and Appellate Tribunal (TDSAT), which is headed by a judicial member, will hear appeals against decisions passed by the DPB’s.
“If there is a natural disaster like an earthquake, will the government have time to seek consent for processing their data or have to act quickly to ensure their safety? If the police are conducting an investigation to catch an offender, should their consent be taken,” Vaishnaw submitted addressing concerns over the bill.
The minister submitted that the bill was along the lines of the European Union’s general data protection regulation (GDPR) – considered to be one of the strongest privacy and security laws in the world. While the EU’s GDPR had 16 exemptions, the Indian law had four, Vaishaw added.
On the alleged dilution of the Right to Information Act, 2005 the minister said the bill was drafted in accordance with principles laid out in the Supreme Court’s 2017 Puttaswamy judgment. “The harmonisation between RTI and personal data has been done in the Bill,” Vaishnaw said.
Several Opposition party leaders opposed the bill, even as many party leaders extended support with caveats and recommendations.
Parties like YSR Congress Party (YSRCP), Telugu Desam Party (TDP), Shiv Sena, and Biju Janata Dal (BJD) supported the DPDP Bill, 2023 while lending their support with some caveats and recommendations. However, BJP MP Sarmistha Sethi broke ranks and criticized the Bill for its adverse impact on press freedom and dilution of the Right to Information (RTI) Act, 2005.
Bahujan Samaj Party (BSP) leader Ritesh Pandey raised concerns over the government’s power to censor and questioned the independence of the Data Protection Board of India which will comprise of members drawn from the Centre.
There are fears that the repetitive use of the phrase “as may be prescribed” may allow the Executive to frame important laws and rules behind closed doors and out of the gaze of public scrutiny, Pandey said addressing the house.
Telugu Desam Party (TDP) MP Jayadev Galla expressed concern about the autonomy given to the Data Protection Board and amendments in the RTI Act. AIMIM leader Syed Imtiaz Jaleel questioned the Centre’s powers to exempt certain government and private entities from the Bill, and the possibility of privacy violations resulting from this.
On Sunday evening, the Editor’s Guild of India expressed “deep concern” over the legislation and the impact it may have on the “press freedom” while urging its reconsideration by a Parliamentary Committee.