Personal data protection Bill likely to be tabled in Budget Session

Legislation seeks to provide a legal framework for the personal data of Indian citizens, and how it can be used by organisations for different purposes.

The Ministry of Electronics and Technology is pushing to table the Personal Data Protection Bill in the upcoming Budget Session of the Parliament, two top officials have told Business Standard.

"There is very little work left to be done. The Law Ministry has gone through it the last couple of weeks and they will be giving it a final okay in a day or two post which we will take it to the Cabinet. Once the Cabinet approves it, the Bill will be taken to the Parliament," said a government official on condition of anonymity.

Another senior official also confirmed that the Ministry is "on track" to introduce the Bill in the Budget Session, which begins on January 31 and ends February 13. He agreed that the timeline was "ambitious," but the Ministry wants to bring the revised Bill in the public eye.

The Bill seeks to provide a legal framework for the personal data of Indian citizens, and how it can be used by organisations for different purposes. While it will be applicable across domains, a large part of the debate around the draft legislation has focused on how big technology companies like Google, Amazon or Facebook use customer data.

The first draft of the Bill was presented to MeitY in July by a Committee set up under former Supreme Court Judge BN Srikrishna. After an outcry over the lack of public consultation about the provisions of the Bill, MeitY invited feedback on the proposed legislation and received over 400 responses from industry bodies, companies and government departments.

The need for a comprehensive data protection law in India has been acknowledged by the government and industry since a long time. Recent reports of citizen data being misused to influence elections has renewed the call as India heads into general elections in a few months.

Last year, data consultant Christopher Wylie revealed that UK-based data analytics firm Cambridge Analytica harvested Facebook profiles of voters to swing United States Elections and the Brexit vote, prompting these governments to launch investigations into Facebook's data practices. Wylie also claimed Cambridge Analytica had worked with two of India's largest political parties in some capacity.

While lauded for being a step in the right direction, industry associations, civil society and companies have also raised concerns about the Bill.

Some of the provisions that have not gone down well with the industry include mandating storage of citizen data in servers located in India, putting the onus of proving that an individual has consented to the use of their data in different ways on businesses, and criminal liability.

Another issue that businesses have is that the Bill allows a person to withdraw consent for processing any of their personal data collected by a person or entity who will decide how personal data collected will be processed or acted upon.  

This could impact businesses like retail, aviation, hospitality and so on running loyalty programmes, who will have to seek explicit consent from the user if they want to customer details for accumulating points and offering a service.

"It (the Bill) is too premature in my view. The draft Bill needs a lot more work. There are some very vague provisions that may lead to even a "kirana" (grocery) store requiring compliance under the proposed bill," said Pratibha Jain, partner at law firm Nishith Desai Associates.