Protecting data

The revised data protection Bill, which is open for public consultation till December 17, has 30 clauses compared to over 90 of the earlier version that was withdrawn three months back following objections. Cutting down the text gives a positive resonance of clarity and decisiveness. An elaborate list of dos and don’ts on how to treat personal data has been chalked out for data fiduciaries, or the entities which collect and manage it. The Digital Personal Data Protection Bill 2022 proposes the right of a user to know exactly what data is being collected, how it is managed and also processed. Companies can use the data only for the precise purpose they obtained it. They also cannot store the data perpetually by default. It has to be deleted when firms no longer need to hold that data.

The revamped Bill will apply to businesses operating in the country and to any entity processing the data of Indian citizens, impacting how tech giants process and transfer it. After a 2019 Bill had alarmed companies by proposing stringent restrictions on cross-border data flows, the new regulation allows transfer with ‘certain notified countries and territories’. The soft stand on data localisation requirements is a major victory for tech companies. The draft legislation also seeks to create a new layer of digital governance through a regulator, mandating notification of data breach to it and each user. The penalties are hefty, up to Rs 250 crore for failing to take safeguards, and Rs 200 crore for not notifying a breach.

The Centre will have powers to exempt state agencies from punitive action in the interests of national security. There are duties prescribed for the users too. They must provide authentic information while claiming the rights to erase or correct data, not register a false complaint, nor give incorrect information or impersonate. Fines can go up to Rs 10,000. Given the complexities involved, it’s a draft that ticks many right boxes. Where it lacks is in leaving out a number of crucial details, which may find a place in the subsequent revision of the text of the rules.