Decoding Draft 'Digital Personal Data Protection Bill': Know How It Highlights 'Privacy Principles & Individuals' Rights'

The Indian government introduced the draft of the Digital Personal Data Protection Bill 2022 on November 18 to regulate digital personal data. The bill recognises both the need to process personal data for lawful purposes and the right of individuals to protect their data.

As per the official statement from Union Minister for Railways, Communications, Electronics and Information Technology, Ashwini Vaishnaw, the portal for public views/comments on the bill is open till mid-December. The public, in general, can raise queries, pose questions, and express their views on the draft bill before the given deadline.

During the monsoon session of the parliament, the previous Data Protection Bill was repealed. The ministry has now revised and renamed it as Personal Data Protection Bill, highlighting the protection of individuals' data and laws around it.

The government has also brought several new provisions in this bill, which takes India to the global stage in terms of the safety and security of users in cyberspace. The most important inclusions in the draft bill are tech companies and social media.

Key Focus On User's Data

According to the draft, the entity that collects users' data must cease to retain personal data. It adds that an entity should remove the mediums or means by which personal data can be associated with the Data Principals (individuals whose personal data it is). The draft bill also directs businesses not to retain the users' data if it's not necessary for business or legal purposes.

If the draft bill is converted into an act, the entity which processes the personal data of a Data Principal would be bound to make sure that the Data Principal has given consent for the same by the act's provisions.

The draft bill reads, "A business or individual may process the personal data of a Data Principal only by the provisions of this Act and Rules, for a lawful purpose for which the Data Principal has given or is deemed to have given her consent by the provisions of this Act."

While talking with The Logical Indian, Cyber Lawyer and Certified Data Auditor Pathik Muni mentioned, "The bill is much more 'simplified' and 'stripped down compared to the earlier versions. It sticks to the key aspects of Personal Data Protection articulating core privacy principles, individuals' rights and organizational obligations succinctly."

Rights & Duties Of Data Principal

Following the draft bill, data principals would have four rights to invoke with a Data Fiduciary (an entity that will decide the mediums or means and purpose(s) of processing personal data).

The four rights are- the right to information, right to correction and erasure of the Personal Data in the Data Fiduciary's custody, right of grievance redressal, and right to nominate (as to who will have the right to act on behalf of the DP in case of death or incapacitation).

The draft also highlights the duties of a Data Principal. Essentially, the Data Principal must ensure nothing false or fraudulent is shared with Data Fiduciary, or else a high volume penalty can be imposed on Data Principal.

Set Of Rules For Children's Data

There is also a set of additional obligations for a Data Fiduciary regarding processing a child's personal data. The Data Fiduciary, before processing children's data, should obtain their parents' consent under the act's provisions.

The Data Fiduciary should also not undertake such processing of personal data that is likely to threaten the child's protection, as may be prescribed. It shall also not undertake tracking or behavioral monitoring of children on social media for targeted advertising. Failure to comply with the provisions will lead to heavy penalties, the draft bill mentions.

Also Read: 'Make In Odisha Conclave' Generates Investment Proposals Worth Rs 10.5 Trillion With 10 Lakh Job Opportunities