Union Cabinet Approves Personal Data Protection Bill; Law To Impact Multinational Companies Operating In India

The Union Cabinet headed by Prime Minister Narendra Modi is likely to give its approval to the Personal Data Protection Bill.

“We will not be able to share any more details about the Bill as it will be introduced in the Parliament soon,” Union minister Prakash Javadekar told reporters in a briefing immediately after the union cabinet meeting.

After it becomes law, it is expected to spell out a framework, which would include processing of personal and private data by public and private entities, among others.

Union Telecom and Information Technology Minister Ravi Shankar Prasad had recently informed the Upper House that the Bill would be introduced very soon in Parliament.

The Ministry of Electronics and Information Technology (MEITY) is expected to move the Bill in the union cabinet shortly.

The proposed law may have a considerable impact on multinational corporations (MNCs) operating in India, whether with or without a physical presence, due to its data localization requirements and cross-border data transfer restrictions.

It may be recalled that in April 2018, the Reserve Bank of India (RBI) had issued a data localization directive, mandating all authorized payment system operators and banks to store payment systems data only in India. This had led to various ambiguities in the requirements as well as industry pushback on the strict requirements imposed, especially by global payment companies.

Recently, data privacy came under scrutiny after it was revealed that some WhatsApp users in India were spied upon by the Israel-based tech firm NSO developed Pegasus spyware which violated the Right To Privacy of 1,400 users across the world, including 121 Indian journalists and activists.

Recently, the opposition had also sought the central government's reply from Prasad if the government has made unauthorized use of the spyware.

Toeing the European Union's General Data Protection Regulation (GDPR), the central government had introduced a draft personal data protection bill in 2018 to regulate the use of individual's data by the government as well as private companies.

The draft bill, which was titled The Personal Data Protection Bill, 2018, was prepared by an expert group headed by former Supreme Court judge B N Srikrishna. Norms on collection, storage and processing of personal data, consent of individuals, penalties and compensation, code of conduct and an enforcement model is likely to be a part of the law.