New Delhi: The ministry of electronics and information technology is discussing rules under the IT Act for personal and sensitive data even as it finalises a draft of a new data protection bill, two people familiar with the matter said.
“There is a consideration to bring in a set of rules to monitor the transfer, sharing and storage of personal and sensitive data rules under the IT Act,” one of the people added, asking not to be named.
Under section 87 of the IT Act, the central government may, by notification in the Official Gazette and in the Electronic Gazette, make rules to carry out the provisions of the law, which itself is in the process of being updated after nearly two decades.
Also read: AAP set to form government in Gujarat, claims Arvind Kejriwal, cites 'IB report'
The rules may define what constitutes personal and sensitive data, and how it can be shared, stored, managed and transferred. It may also touch upon cross-border data transfers, that have so been a point of contention for many in the industry. “With the new CERT-In policy, the government already states that data will have to be brought on a case by case basis as sought by the government,” the person cited above said.
The government’s new data protection bill will “soon be uploaded for public consultation,” a second person said, asking not to be named. The new draft may do away with a centralized data protection authority and introduce an appellate mechanism instead, HT earlier reported.
{{/usCountry}}The government’s new data protection bill will “soon be uploaded for public consultation,” a second person said, asking not to be named. The new draft may do away with a centralized data protection authority and introduce an appellate mechanism instead, HT earlier reported.
{{/usCountry}}According to this person, given that the consultation may take time, the Bill may not be introduced in the winter session of parliament.
Solicitor general Tushar Mehta told the Supreme Court last week that the new Bill will likely be introduced in the “next session” of parliament. The submission was made during a petition challenging controversial privacy policy to be enforced by mobile messaging service WhatsApp.
Interestingly, section 87 of the IT Act was invoked by the government to bring intermediary guidelines last year that finally provided for a mechanism to regulate over the top platforms, make social media firms more accountable and brought digital media websites under the ambit of section 69(A) of the IT Act, which grants the government takedown powers over websites.
The government during the monsoon session of Parliament withdrew the data protection bill, 2021 which had been in the works for the last four years, as the government works to introduce a “comprehensive framework” for cyberspace.
Also read: 30 Delhi government school principals to learn leadership at Cambridge
“Personal Data Protection Bill has been withdrawn because the Joint Parliamentary Committee recommended 81 amendments in a bill of 99 sections. Above that it made 12 major recommendations,” IT minister Ashwini Vaishnaw said. “Therefore, the bill has been withdrawn and a new bill will be presented for public consultation.”
According to the the supplementary list of business in the Lok Sabha, IT minister Aashwini Vaishnaw said the move to withdraw the bill was for for the “protection of the digital privacy of individuals relating to their personal data, to specify the flow and usage of data, to create a relationship of trust between persons and entities processing the data, to protect the rights of individuals whose data are processed, to create a framework for organisational and technical measures in processing of data, to lay down norms for social media platforms, cross-border transfer and accountability of entities processing data”.