Speculation rife around release of draft data protection bill

Union IT minister was slated to hold a press conference on Wednesday and an official familiar with the matter said the conference would focus on the new draft. However, the briefing was cancelled

There was strong speculation that Union ministry of electronics and information technology (Meity) is likely to introduce the new and latest version of the data protection bill on Wednesday, which has been in the works since 2017.

Union ministry of electronics and information technology, Ashwini Vaishnaw. (Raj K Raj/HT Photo)

Union minister for Meity, Ashwini Vaishnaw was slated to hold a press conference at 3pm on Wednesday on “issues related to the ministry,” according to a press statement. An official familiar with the matter said that the conference would focus on the new draft. The press conference, however, was cancelled hours after being announced.

Union minister of state for electronics and information technology Rajeev Chandrasekhar on Wednesday shared his past tweets with the hashtag #PersonalDataProtectionBill, triggering conversation about the changes in the new draft which was expected to be out today.

This came a day after the minister shared a news report about technology giant Google agreeing to pay $392 million in a privacy case over charges that it misled users into believing that their location tracking had been switched off on their devices. “This type of “misuse” of customer data violates #Privacy n #DataProtection expectations. India’s #DigitalDataProtection bill will put a stop to this - & ensure that any Platform/Intermediary that does this will face punitive & financial consequences,” had tweeted.

The bill is being redrawn after being withdrawn in Parliament by the government during the Monsoon session.

According to the supplementary list of business in the Lok Sabha, Vaishnaw said the move to withdraw the bill was for the “protection of the digital privacy of individuals relating to their personal data, to specify the flow and usage of data, to create a relationship of trust between persons and entities processing the data, to protect the rights of individuals whose data are processed, to create a framework for organisational and technical measures in processing of data, to lay down norms for social media platforms, cross-border transfer and accountability of entities processing data.

The bill, as approved by a Parliamentary Joint Committee, proposed to set up a data protection authority, frame policies for non-personal data, including anonymised data under the same legislation, define significant social media platforms based on a threshold of users, decide penalties for data fiduciaries for failing to comply with the country’s first ever data protection law and governance of cross border transfer of data were some of the provisions of the bill. It also proposed to define sensitive, critical and personal data, and insist on data localisation.

The government set up a committee under justice BN Srikrishkna to draft the first version of the bill in 2017. The Puttuswamy judgment further reaffirmed the same year that privacy was a fundamental right. In 2018, the Sriksrishkna Committee submitted a 176-page report, the first draft version of the bill. The version was revised and introduced in Parliament with leeways for the government in 2019. Immediately after, the JPC was set up in 2019 after parliamentarians were divided over several provisions of a law that is meant to put a legal shape to the Right to Privacy and will have far-reaching impact on industry. It was given at least four extensions before it finally submitted its report.

Several MPs dissented against the final report which was tabled in December last year. The contentious clauses of the bill include age-gating of content and access for children, as social media firms such as Facebook and Twitter will have to appoint guardians of data, even as platforms dealing with just children’s data will have to register themselves and giving a wide berth to the government. The suggested framework would also have had wide reaching repercussions for governments, industry stakeholders and social media companies, such as Twitter, Facebook and WhatsApp.