Lok Sabha Passes Digital Personal Data Protection Bill

In a significant development, the Lok Sabha has successfully passed the Digital Personal Data Protection Bill, 2023, despite disruptions from the opposition related to the Manipur issue. The bill, introduced by the Ministry of Information Technology, aims to establish a comprehensive framework for the processing of digital personal data. It seeks to balance the rights of individuals to protect their personal data while allowing for lawful processing.

Under the provisions of the bill, companies and institutions will be held accountable for non-compliance and inadequate measures to prevent data breaches. Additionally, they will be required to cease retaining user data if its retention no longer serves the original business purpose.

Manish Sehgal, a Partner in Risk Advisory at Deloitte India, emphasized the bill's potential impact, stating that it will empower Indian citizens with privacy rights and promote accountability among enterprises. The legislation is expected to bolster protection and security measures, incorporating effective privacy policies and mechanisms for addressing grievances.

Hemant Krishna, a Partner at Shardul Amarchand Mangaldas & Co., highlighted the transformative nature of the bill, asserting that it will revolutionize the processing of personal data in the digital age. Krishna emphasized the shift towards granting citizens more control over their data and providing businesses with legitimate means to collect and process personal information.

Notably, the bill places strong emphasis on safeguarding the well-being of children. Processing of personal data that could potentially harm a child's well-being is strictly prohibited.

Compared to the draft proposal circulated for public consultation in November 2022, the bill introduces relaxed penalty norms. The proposed monetary penalties range from ₹50 crore to a maximum of ₹250 crore for significant breaches of the provisions outlined in the bill.

The bill also includes provisions to protect officials from legal proceedings when acting in good faith to enforce its provisions. It grants the central government and the board immunity from legal actions arising from their actions in line with the bill.

One of the bill's notable features is the authority granted to the Centre to block access to content in the interest of the general public, subject to a written reference from the board.

Rajeev Chandrasekhar, the Minister of State for Electronics and IT, lauded the bill's passage as a significant step towards safeguarding citizens' rights, fostering an innovative economy, and enabling the government's lawful access during national security and emergency situations. Chandrasekhar highlighted the bill's potential to curb misuse and exploitation of personal data by online platforms, thus ushering in lasting behavioral changes and imposing substantial consequences for violations.

Despite the disruptions during its passage, the Digital Personal Data Protection Bill, once enacted, is poised to reshape data processing practices in India, securing privacy rights and promoting responsible data usage in the digital landscape."