Draft of new Digital Data Protection Bill released; Government proposes penalty of up to ₹500 crore; first in India to use 'she/her' pronouns for all genders

Draft of new Digital Data Protection Bill released; Government proposes penalty of up to ₹500 crore; first in India to use 'she/her' pronouns for all genders

The draft is open for public comment till December 17.

Three months after withdrawing a previous bill, the Government of India released the draft of a new comprehensive Digital Data Protection Bill on 18 November.

The draft of the bill is now up for public consultation and is expected to be presented in the next session of parliament. The measure, aimed at protecting digital personal data, seeks to allow transfer of data outside India, and provides for penalties regarding data breaches.

Violations of the provisions proposed under the draft Digital Personal Data Protection Bill 2022 might attract penalty amount to up to ₹500 crore. The draft personal data protection bill in 2019 proposed a penalty of ₹15 crore or 4 per cent of the global turnover of an entity.

The draft proposes to set up a Data Protection Board of India, which will carry on functions as per the provisions of the bill.

"If the Board determines at the conclusion of an inquiry that non-compliance by a person is significant, it may, after giving the person a reasonable opportunity of being heard, impose such a financial penalty as specified in Schedule 1, not exceeding rupees five hundred crore in each instance," the draft said.

A graded penalty system for data fiduciary that will process the personal data of data owners in accordance with the provisions of the Act has also been proposed. The same set of penalties will be applicable to the Data processor – an entity that will process data on behalf of the Data Fiduciary.

Further, a penalty of up to ₹250 crore has been proposed in case the Data Fiduciary or Data Processor fails to protect against personal data breaches in its possession or under its control.

The Personal Data Protection Bill, 2019 was introduced in the Lok Sabha in December 2019 by then IT Minister, Ravi Shankar Prasad. The bill sought to provide protection of personal data of individuals and also establish a Data Protection Authority for the same.

The bill was referred to the Joint Committee of the Houses for examination. The Committee submitted a report on the same to the Lok Sabha in December 2021.

Subsequently, the Central government moved to withdraw the bill pursuant to the new recommendations made by the Joint Committee of Parliament

Union telecom and IT minister Ashwini Vaishnaw had said that the joint Parliamentary committee which went through the original draft suggested 88 amendments to a bill of 91 sections, which led the government to decide that there was "no option" but to withdraw the original bill completely.

According to him, a lot of changes that had taken place owing to the Covid pandemic leading to newer learnings, had to be incorporated in the laws.

He said in a statement that "81 amendments were proposed and 12 recommendations were made towards comprehensive legal framework on digital ecosystem."

Non-profit Internet Freedom Foundation (IFF) had said that the Data Protection Bill 2021 gave large exemptions to government departments, prioritised the interests of big corporations, and did not adequately respect people's fundamental Right to Privacy.

Around a dozen of industry bodies had written to Vaishnaw that implementation of the proposed Data Protection Bill, as recommended by a Parliamentary panel, will significantly degrade India's business environment and reduce foreign investment inflows.

Use of 'she/her' pronouns for all genders

The Digital Personal Data Protection Bill's "interpretation" provision clarifies that the pronouns "her" and "she" in the proposed legislation have been used for an individual, irrespective of gender, thus becoming the first law in India to use she/her pronouns while referring to all genders.

The Union Minister for Electronics & Information Technology Ashwini Vaishnaw said that the idea was in furtherance of the Prime Minister's philosophy of women empowerment.

"We have attempted in the philosophy of women's empowerment that Prime Minister Narendra Modi Ji's government works, we have attempted to use the words she and her in the entire bill, instead of he and him and his. So, this is an innovative thing which has been attempted in the bill," he said while speaking to the press.

The law has been drafted with the aim to provide for processing of digital personal data in a manner that recognizes the right of individuals to protect their personal data along with the need to process personal data for lawful purposes.

According to a statement issued by Vaishnaw, the bill was deliberated in great detail by the Joint Committee of the Parliament (JCP). Hence, considering the report of the JCP, the 2019 bill was withdrawn and instead, the present new one introduced.