The Ministry of Electronics and Information Technology, after deliberating on various aspects of digital personal data and its protection, has formulated the Digital Personal Data Protection Bill 2022, inviting on 18 November feedback from the public on the draft. The government will not make the submissions public but hold them in a fiduciary capacity to enable individual citizens to submit feedback without fearing for their security.

Why Digital Personal Data Protection Bill 2022

The purpose of the draft bill is to provide for the processing of information technology-made personal data in a manner that recognizes both the right of individuals to protect their personal data and the need to process personal data for lawful purposes and for matters connected therewith or incidental thereto.

The draft bill employs plain and simple language to facilitate ease of understanding and is available on the ministry’s website along with an Explanatory note that provides a brief overview of its provisions, which is available here (click/tap on the link).

The Digital Personal Data Protection Bill frames out the rights and duties of the citizen on the one hand and the obligations to use collected data lawfully of the data fiduciary on the other. The bill is based on the following principles of a data economy:

The bill will establish a comprehensive legal framework governing digital personal data protection in India. The bill provides for the processing of digital personal data in a manner that recognises the right of individuals to protect their personal data, societal rights and the need to process personal data for lawful purposes.

The feedback on the draft bill in a chapter-wise manner may be submitted on the form on this website (linked) by 17 December 2022.

fiduciary (adjective): involving trust, especially in a situation where a person or company controls money or property belonging to others

Assuring privacy: A long-drawn process since 2019

On 27 July, Minister of State for Electronics & Information Technology Rajeev Chandrasekhar assured citizens through a written reply to a question in the Lok Sabha that privacy was a fundamental right as declared by the Supreme Court. The minister said that the government had introduced “The Personal Data Protection Bill, 2019” in the parliament during the winter session in the said year. It was then referred to a joint committee of parliament that tabled its report in Sansad on 16 December 2021. The report and the bill were then under examination.

Further, Section 43A of the Information Technology Act, 2000, and the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011, already provides safeguards for sensitive personal data or information collected, the minister said. The rules mandate that body corporate including social media platforms must provide policy for privacy and disclosure of such information, he said. Further, Section 72A of the IT Act provides for punishment for disclosure of information in breach of the lawful contract.

Section 43A of the law also provides for compensation to be paid to the affected users by the body corporate for failure to protect sensitive personal information causing a wrongful gain or wrongful loss to any person.

Furthermore, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, notified under the Information Technology Act, 2000 requires that the intermediary shall publish the rules and regulations, privacy policy, and user agreement for access or usage of its computer resource by any person.