As the Digital Personal Data Protection Bill (DPDP) stands passed by Parliament on Wednesday, legal experts are divided on aspects of privacy awarded to Indian citizens and its wider implications for the IT industry.
Rajya Sabha Member and lawyer Sirgapoor Niranjan Reddy said the Bill is in an easy language and illustrations provided by the government are very useful. However, he pointed out that exemptions for start-ups "may have to be conditioned", as that can be misused, especially in the case of data mining start-ups.
Parliament on Wednesday approved the Bill that introduces several compliance requirements for the collection and processing of personal data and provisions for up to Rs 250 crore penalty for any data breach.
Shardul Amarchand Mangaldas and co-partner Hemant Krishna feel the implementation of the DPDP will give control to citizens and businesses over collecting and processing data.
"With the strides made by AI, personal data can be processed with unprecedented velocity and sophistication. Ironically, despite the volume and variety of personal data in India, citizens have not had sufficient control over their data due to the absence of a proper privacy framework, and businesses have struggled to find legitimate ways to collect and process personal data. That is all set to change when the DPDP Bill becomes law," Krishna said.
Advocate Rajat Kumar Kaushik has a different point of view, wherein he feels the bill has not imbibed recommendations from the general consultation in 2022.
"The presented bill appears to have miserably failed to acknowledge and inculcate the recommendations made by the general public during the public consultation from November 2022 onwards. The Bill states that the Union Government will select all its members and exempts the government instrumentalities from data processing," he said.
Kaushik feels the bill "fails to place any safeguard to protect the State's citizens from over-surveillance".
"The DPDPB also grants the withdrawal of consent given to the usage of personal data. However, the provisions of the bill do not provide any remedy if the same data had already been made public before the withdrawal of the consent," Kaushik noted.
He added that the Bill has given enormous control to the Union Government and appears to act in favour of the government rather than the people whose privacy it was meant to protect.
Risk advisory partner at Deloitte India Manish Sehgal said, "Data protection bill, once enacted will enhance the privacy cognizance of Indian citizens by empowering them with their privacy rights through transformative accountability measures to be adopted by enterprises. Driving robust protection and security measures, effective privacy policies and grievance redressal are the layered requisites towards its compliance".
HJA and Associates LLP managing partner Jitender Ahlawat said the bill's effects on technology companies and the broader IT industry are complex.
"The bill can potentially change how businesses operate, increase the costs associated with following regulations, and impact how data is handled. Following these rules, which involve protecting data and following proper procedures, could be difficult for companies, especially smaller ones," he said.
He added that the requirement to keep data within the country affects how companies work across borders, which might lead to changes in how things are done.
"Striking a balance between protecting personal information and encouraging new technologies is extremely important. The bill shows that India is determined to handle data securely. However, it's up to the industry to work together and find a way to respect people's privacy while still allowing technology to advance," Ahlawat noted.
Sourabh Deorah, CEO and co-founder of HRTech start-up Advantage Club, said the Bill ensures the right of privacy for citizens as technology becomes "an even greater force in our lives".
The Bill is undoubtedly a forward-thinking legislative approach, said Matthew Foxton, India regional president and executive vice-president, of branding and communications at IDEMIA.
"In an interconnected world driven by data, safeguarding personal information and maintaining the trust of individuals is paramount. The imperatives of data security and privacy must loom large as India is set to lead the digital revolution in identity and payments," he said.
Industry body Nasscom welcomed the development, saying the bill is a leap for India to establish a robust framework for personal data protection, building the nation as a trusted data destination.
Nasscom president Debjani Ghosh said, "The passage of the data protection bill by both the houses of Parliament is a landmark moment...we appreciate the consultative approach that engaged all relevant stakeholders at each phase in defining the digital data protection bill and is really looking forward to India having its own data protection law".
EY India cybersecurity consulting leader Murali Rao noted that implementation complexities in the bill could be challenging for organisations while complying with the requirements.
"Ensuring verifiability of parental consent for processing personal data of children, building a mechanism for obtaining and recording consent of Data Principals through a consent manager, complying with the Data Principal’s rights to erasure, undertaking accountability for the data processors pursuant to processing on behalf of Data Fiduciaries," he said.
Induslaw Partner Shreya Suri said the Bill is a positive and much-needed step for India and will also help position India as a viable jurisdiction for data adequacy arrangements with other progressive nations.
"Given the rapid developments in relation to the passing of this Bill, it can be expected for it to be enacted and implemented as law sooner than originally anticipated. The data fiduciaries can consider proactively looking at the transition implementation," Suri said.
