Digital Personal Data Protection Bill 2023 finally introduced in Lok Sabha, amid Opposition furore

The eagerly anticipated Digital Personal Data Protection Bill, 2023, has finally been presented in the Lok Sabha by Union Minister of Information Technology, Ashwini Vaishnaw.

The main objective of the DPDP Bill is to enable the processing of an Indian citizen’s digital personal data in a manner that respects both individuals’ right to safeguard their personal information and the necessity to process such data for legitimate purposes.

Several members of Congress, including Gaurav Gogoi, Manish Tewari, Shashi Tharoor, Adhir Ranjan Chowdhury, along with NCP MP Supriya Sule, TMC MP Saugata Roy, and RSP MP NK Premachandran, expressed opposition to the introduction of the DPDP Bill, 2023.

First introduced in 2022
A preliminary version of the bill was initially made public by the Ministry of Electronics and Information Technology (MEITY) in November 2022. The draft legislation went through multiple rounds of consultations, during which various stakeholders were invited to provide their feedback.

Despite its introduction in Parliament, the DPDP Bill faced some controversy. Congress MP Manish Tewari raised questions about its classification as a financial bill. However, Minister Vaishnaw clarified later in the Lower House that it is, in fact, a general bill.

India has witnessed several iterations of data protection bills over the years. In 2017, a committee of experts, led by retired Supreme Court Justice BN Srikrishna, was assigned the task of drafting a data protection bill. Subsequently, in 2019, the Personal Data Protection Bill was presented in Parliament but was referred to a Joint Parliamentary Committee for further assessment.

The government had previously withdrawn an earlier version of the data protection Bill from Parliament, despite undergoing extensive development, iterations, and scrutiny by a Joint Committee of Parliament. The withdrawal was prompted by opposition from various stakeholders, including tech companies and privacy activists. In 2022, IT Minister Ashwini Vaishnaw withdrew the Personal Data Protection Bill, citing the need for a more comprehensive legal framework.

Opposition protests, says government completely exempt from provisions
Using their right to protest the introduction of proposed laws, Opposition members expressed their opposition to the Bill and insisted that it should be officially referred to a Parliamentary panel for more in-depth discussions. They also called for the Bill to be referred to a Joint Committee of Parliament. The concerns raised by the Opposition MPs revolved around the extensive government exemptions included in the Bill, and they expressed worries about the possible weakening of the Right to Information Act, 2005.

In response to the concerns raised by Opposition members, IT Minister Ashwini Vaishnaw asserted that the issues raised did not pertain to the government’s legislative competence. He assured that the government was open to a comprehensive discussion on the Bill, addressing all the allegations brought forward by the Opposition MPs.

During the discussion on the Bill in Parliament, there were notable objections from various MPs. AIMIM MP Asaduddin Owaisi called for a division, indicating a demand for a formal vote on the matter. Congress MP Gaurav Gogoi urged for the Bill to be referred to a Joint Parliamentary Committee for further examination and evaluation.

Congress MP Manish Tewari raised concerns about the Bill’s disparate treatment of different entities. He pointed out that the Bill applied rigorously to non-government entities, while granting extensive exemptions to the entire government.

TMC’s Sougata Roy opposed the introduction of the Bill, highlighting that the final version differed significantly from the original proposal put forward the previous year.

Some highlights of the new Digital Personal Data Protection Bill, 2023
The proposed Digital Personal Data Protection Bill is a critical component of the broader technology regulations framework being developed by the Centre. This framework includes the Digital India Bill, which is intended to replace the Information Technology Act, 2000, the draft Indian Telecommunication Bill of 2022, and a policy governing non-personal data.

The scope of the proposed law encompasses the processing of digital personal data within India, as well as data processing conducted outside the country if it involves offering goods or services to, or profiling individuals in India.

The Bill proposes the establishment of a data protection board that will handle cases related to violations of its provisions, including data breaches. It also includes broad exemptions for the Central government and its agencies, which has been a point of contention for Opposition MPs and privacy activists.

Data fiduciaries, referring to entities collecting personal data, would be required under the Bill to ensure data accuracy, maintain data security, and delete data once its intended purpose has been fulfilled.