The Digital Personal Data Protection Bill, 2023, has been passed by the Rajya Sabha. The Bill was supported by Members of Parliament from the NDA (National Democratic Alliance), the Biju Janata Dal, and the YSR Congress Party, after most Opposition MPs staged a walkout.
The key provisions of the Bill include establishing norms for digital data processing by firms, creating an adjudicatory mechanism for dispute resolution, and setting up a Data Protection Board of India. Minister of Electronics and Information Technology, Ashwini Vaishnaw, stated that these provisions would be implemented over the next six to ten months, with the possibility of it occurring sooner.
However, the Bill has drawn criticism for the wide range of exemptions it grants to the Union government. These exemptions raise concerns about potential surveillance, as the Bill largely exempts all instrumentalities of the State from certain requirements. On the other hand, private industry players have praised the Bill for reducing stringent requirements that were present in earlier drafts.
Amar Patnaik, a BJD MP, generally supported the Bill but noted that it did not refer to the term “informational privacy,” which was prominently featured in the 2017 K.S. Puttaswamy vs Union of India Supreme Court judgment that prompted the drafting of a data protection legislation.
The Internet Freedom Foundation expressed disappointment with the version of the Bill that has been passed, stating that it prioritizes facilitating the processing of personal data by state and private actors rather than protecting the right to privacy of Indian citizens.
Overall, the passage of the Digital Personal Data Protection Bill, 2023, represents a significant step in India’s efforts to regulate data processing and enhance data protection, but there are ongoing concerns and debates about the balance between privacy and other interests, such as security and business innovation.
