Earlier this year, the ministry of electronics and information technology (MeitY) sought public feedback on the draft rules for the implementation of the Digital Personal Data Protection Act. At present, stakeholder feedback is being considered, and the final rules await imminent enforcement. Thus, it is important to understand the effectiveness of the institutional framework of the Data Protection Board (DPB) established under the Act and operationalised through the rules.
DPB, an enforcement and adjudicatory body, will receive complaints from individuals and references from the government, conduct inquiries, and impose penalties on organisations failing to comply with the Act’s provisions. The draft rules prescribe the operational procedures for the implementation of the Act, but it is limited by the design envisaged under the Act. The lean institutional design and narrow scope of powers will constrain what the rules can achieve. Yet, there are three key aspects that can enhance the performance of DPB that can be brought about through the rules.
First, the effective functioning of DPB requires designing an institution with adequate independence and functional autonomy, sufficient expertise and capacity, and necessary accountability measures. Institutional independence is based on several factors, but a great deal can be achieved through how its members are selected and appointed. The proposed rules empower the Union government to establish a selection committee to recommend DPB members, including its chairperson. The committee selecting the chairperson will be led by the Cabinet Secretary and have the secretaries of legal affairs and MeitY as well as two government-appointed experts. Similarly, the selection committee for DPB members will be headed by the MeitY secretary and have the secretary of legal affairs and two government-nominated experts. The composition of such selection committees is often skewed towards serving Union government officials. While the involvement of the executive is inevitable, a lack of diversity in the selection committee can result in partisan and biased appointments. A more diverse selection committee could include members from the legislative, judiciary, civil society, and other stakeholder groups. This would align better with principles of impartiality and ensure the much-needed diversity of stakeholder perspectives. There are enough examples of this, such as the selection committees for members and chairs of the Competition Commission of India and the Central Information Commission, among others. Institutional independence is vital for public trust and effective governance, and the selection and appointment processes are foundational to this.
Second, the need for transparency in appointments, as well as the proceedings and functioning of DPB, cannot be overstated. The selection committees will evaluate candidates based on qualifications in data governance, dispute resolution, information technology, and the digital economy, as required by the Act. They will assess the integrity and practical experience of candidates too. To ensure transparency, the committee’s recommendations and a brief justification of each candidate’s eligibility should be made public. Predictability and certainty in dispute resolution will guide stakeholder decisions on approaching DPB. It will also allow the study of trends, effectiveness, and critically analyse DPB’s performance. One way to ensure this is to impart maximum transparency to the resolution process. This can be done by publishing orders and findings of DPB and their reasoning and rationale. Periodic guidance on complex issues relating to data privacy and how DPB may respond to concerns relating to any emerging technology would be invaluable but is potentially outside the scope of the board’s current design. The rules could also provide for the disclosure of minutes of meetings to promote transparency in the decision-making process.
{{/usCountry}}Second, the need for transparency in appointments, as well as the proceedings and functioning of DPB, cannot be overstated. The selection committees will evaluate candidates based on qualifications in data governance, dispute resolution, information technology, and the digital economy, as required by the Act. They will assess the integrity and practical experience of candidates too. To ensure transparency, the committee’s recommendations and a brief justification of each candidate’s eligibility should be made public. Predictability and certainty in dispute resolution will guide stakeholder decisions on approaching DPB. It will also allow the study of trends, effectiveness, and critically analyse DPB’s performance. One way to ensure this is to impart maximum transparency to the resolution process. This can be done by publishing orders and findings of DPB and their reasoning and rationale. Periodic guidance on complex issues relating to data privacy and how DPB may respond to concerns relating to any emerging technology would be invaluable but is potentially outside the scope of the board’s current design. The rules could also provide for the disclosure of minutes of meetings to promote transparency in the decision-making process.
{{/usCountry}}Third, DPB should not suffer delays in appointments and resolution of complaints. Delayed appointments in the statutory bodies affect enforcement of the law and impede policy decisions. They also lead to backlog of appeals and complaints from the public, resulting in a trust deficit and erosion of confidence in the institutional grievance redressal mechanism. To ensure this doesn’t happen, it would be useful for the rules to stipulate that appointments with respect to any future vacancy should be made prior to the date of the vacancy to maintain smooth operation of the board.
There is considerable potential for improving the institutional design of DPB through the draft rules to create a more independent, transparent, and reliable body. Institutions responsible for protecting core fundamental constitutional values, such as the right to privacy, must be independent to ensure effectiveness and credibility, and strengthen the trust of civil society, the market, and industry.
Gangesh Varma and Yaqoob Alam work with Technology and Policy Practice at Saraf and Partners, a law firm. The views expressed are personal.