The parliamentary standing committee on communications and information technology has pulled up the IT ministry for the delay in drafting rules under the contentious Digital Personal Data Protection (DPDP) Act, 2023, and for not specifying a timeline for rolling out the Digital India Bill.
In a report tabled in the Lok Sabha on February 8, the committee, headed by Shiv Sena (Shinde) member of Parliament (MP) Prataprao Jadhav, asked the ministry of electronics and information technology (MeitY) to prioritise the drafting of DPDP rules and to ensure that the process is completed within the prescribed period of six months.
The DPDP Act was notified in the gazette on August 11, 2023 but has not been enacted yet. In October, IT Minister Ashwini Vaishnaw had said that the DPDP Rules were almost ready and would be released soon for public consultation. On December 20, minister of state for IT Rajeev Chandrasekhar said the draft DPDP Rules would be released for consultation in the next two days so they could be notified in the first week of January. Vaishnaw had said that the draft rules would undergo at least a 45-day-long public consultation.The rules, once notified, would need to be placed before Parliament for its approval. Vaishnaw had said that appointment to the Data Protection Board would happen after parliamentary approval for the notified rules. It now looks impossible for this to happen ahead of the 2024 general elections.
The committee in its report said, “The Ministry has merely outlined the established practice for rule-making without providing clarity on its expected finalization. The Committee would like to draw attention of the Ministry to the established norms, which provide that rules under an Act should be framed within six months of its commencement.”
{{/usCountry}}The committee in its report said, “The Ministry has merely outlined the established practice for rule-making without providing clarity on its expected finalization. The Committee would like to draw attention of the Ministry to the established norms, which provide that rules under an Act should be framed within six months of its commencement.”
{{/usCountry}}“The Committee expected that since the data protection law was notified on August 11, 2023, the Rules in this regard should now be nearing completion. However, the Committee observe that the lack of properly framed rules has prevented the notification of essential components of the data privacy law, including the Data Privacy [Protection] Board, which is mandated to investigate privacy breaches and impose penalties as outlined in the Act,” it said.
The committee said that the ministry should “draw up simple rules under the law, which are easy to understand and administer”
It also asked the ministry to a devise a mechanism to ensure that the exceptions given for the government to process personal data without consent for certain “legitimate uses” (such as national security reasons, or to provide/issue subsidies, benefits, services, certificates, licenses and permits) are neither misused nor allowed to become a norm.
“[T]he Committee had expressed concern regarding the potential misuse of these exceptions. Therefore, the Ministry was urged to establish a mechanism that prevents these exceptions from becoming the norm and ensure that they are employed only in exceptional situations. ... the Committee note that the Ministry is aware about its potential misuse of these exceptions. However, the Committee find that the Ministry has not outlined any specific in this regard,” the report said.
The panel said it wants the ministry to take “concrete action” to ensure that “default consent settings are designed to extend benefits to data principals, especially digitally illiterate individuals”.
The report also asked the ministry to hold awareness campaigns to make the public aware of “alternative remedies in cases of harm caused by civil wrongs violating their rights”, and to establish a helpline number or an online AI-based chatbot “to provide guidance to affected individuals especially post enactment of DPDP Act, 2023”.
It also said that it wants the ministry to “expedite” amendments to the Information Technology Act, 2000, and other related acts so that all acts are harmonised with the DPDP Act.
Stressing on the need to replace the “outdated” IT Act 2000, the panel asked MeitY to “promptly conclude the framework for the Digital India Bill and expedite its enactment without unnecessary delays.”
Minister Rajeev Chandrasekhar had first mentioned that the government was looking to replace the IT Act with the Digital India Act in April 2022.
The ministry had held two public consultations on the “Principles of the draft Digital India Bill” in March and May 2023, in Bangalore and Mumbai, respectively. A third session was scheduled for Delhi but was cancelled.
“Upon reviewing the action taken notes of the Ministry, the Committee observes the lack of specified timeline for rolling out the Digital India Bill. There is no indication of the Government introducing the Act in the upcoming Session of Parliament. The Committee, reiterating their earlier recommendation strongly urge the Ministry to promptly finalize the draft of the Digital India (DIA) Bill without any further delay,” the panel’s report said.