Data Protection Bill, 2019

• Private Companies and State agencies has vast amount of data. There is no legal framework for data protection. Even the individuals dont know that their data is being used. Thus, there was a need for legislation which was also said by K S Puttaswamy case, 2018 that held Right to Privacy (Art 21) to be a Fundamental Right.
• Against this backdrop B N Srikrishna Committee (on Data Protection) prepared Personal Data Protection Bill, 2018 to MEITy. It deals with the guidelines for collection, storage, and processing of personal data, consent of individuals, penalties & compensation and a code of conduct.

Terms

• Data is the large collection of info about Data Principal (individuals) stored in a computer.
• Data is collected and handled by Data Fiduciaries (like FB). Fiduciary controls how and why the data is processed.
• Data Processing is analysis of data to collect patterns, turn raw data into useful. This is done by a 3rd party Data Processor (like Cambridge Analytica).
• The physical attributes of data, where data is stored, where it is send and where it is turned into something useful are Data Flows. It determine who has the access to data, who profits off it, who taxes and who owns it.
• Data Localisation is the act of storing data on any device physically present within the borders of the country.

Provisions of the Data Protection Bill, 2019

• It requires all Fiduciaries to store copy of all personal data in India.
• Bill trifurcates the data and mandates the storage in India depending on the type of data

1. Personal Data: Identifies the individual like Name, address etc.
2. Sensitive Personal Data:passwords, financial data, Health data, sex life, sexual orientation, biometric data, genetic data, transgender status, intersex status, caste or tribe, and Religious or political belief or affiliation. Such data can be processed only with explicit, informed, clear & specific consent of person. This is to be stored only in India. It can be processed abroad only in certain conditions including approval of Data Protection Agency (DPA).
3. Critical Personal Data: Anything that Govt may deem critical. Like Military or National Security Data. Both stored and processed only in India.

• Bill removes the requirement of data mirroring (personal data). Individual consent is required for data transfer.
• Fiduciaries must provide Govt non personal data when demanded. It includes anonymised data like traffic patterns, demographic data.
• It requires Social media companies to develop their own user verification mechanism.
• Data Protection Authority of India (DPAI) to be set up (headed by a Chairperson and <= 6 whole time members) to monitor and enforce provisions of the Act.
• Adjudicating Officers in the DPA. Adjudicating decisions can be appealed in the appellate tribunal. Appeals from the tribunal will go to Supreme Court.
• Each Company will have a Data Protection Officer (DPO) for auditing, grievance redressal, maintenance etc.
• It proposes Purpose Limitation and Collection Limitation clause which limit the collection of data to what is needed for clear, specific and lawful purposes.
• It grants individuals right to data portability and ability to access and transfer one's own data.
• It legislates on the Right to be Forgotten, right to restrict or prevent continuing disclosure of personal data. This has roots in EU law of GDPR (General Data Protection Regulation).
• Bill also states Penalties: Minor violations (5 crore or 2% of turnover) and Major (15 crore and 4% turnover).

Advantages of Data Protection Bill, 2019

1. Data Localisation can help law Enforcement agencies. Much of cross border data transfer is governed by individual bilateral mutual legal assistance treaties.
2. Instances of cyber attacks and surveillance will be checked. Recent Pegasus incident on Whatsapp.
3. Fake news which leads to lynching, national security threats can be monitored now.
4. Ability to tax Internet giants.
5. It will help to enforce data sovereignty.

Disadvantages of Data Protection Bill, 2019

1. The Bill focuses on consent of the person but it also gives powers to Government to dilute these provisions for Govt agencies.
2. The powers given to Govt makes the gains from K S Puttaswamy case (Right to Privacy as a part of life and liberty) meaningless.
3. Recent incidents of Israeli spyware Pegasus and Google alerting 500 Indian users regarding "government backed" phishing attempts, the Indian government has still not provided answer.
4. Even the B N Srikrishna has used "Orwellian" and "Big brother" in response to removal of safeguards for Govt agencies.
5. It said that the dangers to privacy is from state and non state actors both and hence the exemptions should be "narrow" and for use in "limited circumstances".
6. DPAI is selected by a panel filled with Govt nominees disregards the fact that Govt agencies are also regulated under the Act; they are major collector and processor of data themselves.
7. Even if data is stored in India, encryption keys may be out of the reach of national agencies. The terms National Security are open ended.
8. FB, Google fear that this data localisation norms will have a domino effect in other countries.
9. It may backfire India's own startups attempting for global presence