by Ayush Krishna Tripathi

In our rapidly evolving digital landscape, we find ourselves immersed in the digital world more than ever before. Within this context, the ruling government presented a groundbreaking legislation in parliament known as the Digital Personal Data Protection Bill. This bill has sparked extensive debates and discussions about its significance and transformative potential for every Indian citizen who exists as a digital participant on the internet.

Across various platforms and numerous companies, a multitude of data fiduciaries have been amassing personal data from individuals not only in India but worldwide. Unfortunately, this personal data has often been exploited for proprietary business models and algorithms, all without the informed consent or awareness of the individuals whose data is collected. The year 2017 marked a turning point when the Supreme Court recognized the right to privacy as a fundamental right. This realization emerged from years of neglect during the United Provinces Alliance (UPA) government, which disregarded the rights of citizens and led to the creation of extensive databases without considering individual data protection.

To address these concerns, the NDA government took action, creating a legislative framework that safeguards citizens’ rights, fosters an environment for innovation, and enables startups to thrive. Despite earlier efforts to establish a digital framework for personal data protection in 2018-19, the process faced challenges due to complex frameworks created by the selection committee, imposing burdens on startups.

The Digital Personal Data Protection Bill is designed to define the rights and responsibilities of citizens and establish lawful parameters for data collection and usage. This legislation governs the use of personal data, outlining the rights and responsibilities of both users and businesses. It strives to facilitate voluntary reporting of data breaches by companies and seeks to ensure the processing of digital personal data respects individual rights while serving legitimate purposes. The bill also empowers the creation of a data protection board responsible for addressing complaints related to data breaches. Furthermore, the board committee possesses the authority to remove or block content affecting public interests.

The bill mandates that personal data may only be processed for lawful purposes, with the explicit consent of the individual concerned or under circumstances where consent is implied.

The Digital Personal Data Protection Bill rests on six core principles that underpin the data economy. The first principle emphasizes the safeguarding and transparency of the collection and usage of personal data for citizens of India. The second principle focuses on data collection solely for lawful purposes, with data retained only as long as necessary to fulfill those purposes. The third principle underscores the importance of collecting only relevant data from individuals, serving well-defined purposes. The fourth principle emphasizes data protection and accountability, necessitating the recording of responsibility for every piece of data. The fifth principle stresses data accuracy, ensuring the overall quality of the data collected. Lastly, the sixth principle lays down regulations for reporting data, maintaining transparency and accountability.

In the realm of data breaches, the revised Digital Personal Data Protection Bill introduces a provision for penalties of up to ₹250 crore for each data breach. Union Minister Rajeev Chandrasekhar shared this significant development. Furthermore, the bill incorporates provisions for the protection of children’s data. Individuals under the age of 18 are considered children, and entities must obtain guardian consent for data processing. The proposed norms also allow for the center to specify an age threshold above which data fiduciaries can process data, provided it is done in a secure and verifiable manner.

The Digital Personal Data Protection Bill of 2023 represents a landmark step towards securing citizens’ digital rights, fostering responsible data practices, and protecting the privacy and interests of individuals in the digital age.