Centre withdraws Personal Data Protection Bill, industry disappointed

Comprehensive framework to come in alignment with contemporary digital laws

After four years of deliberations, the government on Wednesday withdrew the Personal Data Protection (PDP) Bill, 2019, which is to be replaced with one that has a “comprehensive framework” and is in alignment with “contemporary digital privacy laws”.

According to the statement shared by Electronics and IT Minister Ashwini Vaishnaw, the government withdrew the Bill because the Joint Parliamentary Committee (JPC) had recommended 81 amendments to it, which has 99 sections. The JPC had made 12 recommendations.

“The Joint Parliamentary Committee’s report on the Personal Data Protection Bill had identified many issues that were relevant but beyond the scope of a modern digital privacy law,” Minister of State for Electronics and Information Technology (MeitY) Rajeev Chandrasekhar said on Twitter.

“This will soon be replaced by a comprehensive framework of global standard laws including digital privacy laws for contemporary and future challenges and catalyze PM Narendra Modi’s vision of India Techade,” Chandrasekhar said.

The PDP Bill was introduced in the Lok Sabha on December 11, 2019. It was later referred to the JPC, which tabled its report in the Lok Sabha on December 16, 2021.

The report stirred a debate after it proposed a single law for dealing with both personal and non-personal datasets and mandating a complete local storage of data. The Bill had alarmed big tech, and several advocacy players had stated it gave sweeping powers to the government in certain segments. Various industry stakeholders are disappointed.

“We suspect a lack of agreement between two factions within the government has led to the scrapping of the Bill,” a person familiar with the matter said.

He said: “One faction is pushing for a specific personal data protection Bill and another is pitching for a broad-based one.”

Amol Kulkarni, director (research), CUTS International, said: “This is a setback not only for big tech or the corporate world but also for individuals and consumers and privacy-first organisations that had worked hard on engaging with the government and consumers and other stakeholders.”

Some large tech firms are in wait-and-watch mode.

“It’s like going back to the drawing-board,” said Rama Vedashree, chief executive officer, Data Security Council of India.

Seeing the developments since Justice Srikrishna submitted his report in 2018, this outcome was a given, she said. A lot of time and effort has been invested in the past five years, and “we need to expedite enacting a comprehensive data privacy law in consultation with industry”.

Apar Gupta, executive director, Internet Freedom Foundation, said the decision had rendered unavailing 10 years’ effort.

“The withdrawal causes uncertainty and indecision when such a Bill is urgently needed.”

“The existing draft and the JPC recommendations were concerning but the withdrawal should have been matched with a commitment on the floor of the house as to when a new Bill will be introduced,” he said.

When asked if this meant there would be another round of consultation or if the reintroduced Bill would be based on the JPC report, Gupta said: “The JPC feedback may result in material alteration not only in acceptance but also in rejection thereby public consultation is essential to maintain the public trust as well as increased foresight on a better data protection bill which will come through scrutiny and input from experts.”

Kumar Deep, country manager, ITI Council, said: “We have participated in all consultative processes during the framing of the PDP Bill, 2019, and are eager to continue our engagement. We are certain that the government will consider all the views once the consultation on the framework begins and look forward to participating.”

Salman Waris, managing partner at TechLegis Advocates & Solicitors, said: “It was a bad draft from the inception. There was a huge pushback from civil society and with the 81 amendments proposed, including one to the title itself, it made sense to do away with the draft than have a loosely-worded piece of legislation. However, it’s a pity it has been done at this advanced stage, and after such a huge lapse of time. Nearly three years of deliberations were wasted.”