Personal Data Protection Bill Likely To Propose Jail Term For Executives Or Penalty Of Up To Rs 15 Crore For Data Misuse

The Personal Data Protection Bill is likely to propose a penalty of up to Rs 15 crore or 4% of the global turnover of a company it violates norms.

Company executives may even be jailed for up to three years, if they “knowingly re-identify de-identified data” of citizens as well as customers or process these in violation of the norms laid down by the Bill, which is expected to be tabled in Parliament during the ongoing Winter Session for final approval.

As per the provisions of the Bill, all internet companies would have to mandatorily store critical data of individuals within the country, though they may be permitted to transfer sensitive data overseas after explicit consent of the data owner to do so only for purposes permissible under law.

The Bill mandates entities in the business of data processing to register with the government as a data fiduciary for the purpose of data processing and the government would have the right to direct all data fiduciaries to share non-personal data for better targeting of service, policy making or relief work.

The Bill has exempted processing of personal data in case of national security issues or court order etc.

According to the Bill, any data which can identify an individual has been defined as personal data. While all entities will need to obtain explicit consent of the data owner, in some cases like security of the state, providing relief in case of a medical emergency, detection of unlawful activity or whistleblowing, an explicit consent may not be required.