Tag: Personal Data Protection Bill

Steps towards data protection law in India

17. June 2022

At present, there is no comprehensive data protection law in India. The relevant provisions are governed by several laws, regulations and court decisions, including the Information Technology Act 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011.

Following the inclusion of privacy as a fundamental right in Article 21 of the Indian Constitution on August 24th, 2017, a Personal Data Protection Bill (PDPB) was formulated and introduced in the Lower House of the Parliament on December 11th, 2019. The PDPB was intended to constitute the first comprehensive data protection law in India.

The PDPB was pending consideration of the Parliament for a long time. On November 22nd, 2021, the Indian Joint Parliamentary Committee (JPC) responsible for reviewing the PDPB issued its report on the proposed law. Back then, the Indian Parliament was expected to table JPC’s final report and consider the bill on December 21st, 2021, ahead of the end of its legislative session on December 23rd, 2021. Once passed by both houses of the Parliament and approved by the president, the PDPB was then to be enacted as legislation.

However, as it has recently become known, new regulations may soon be introduced to replace the proposed PDPB, which was scrapped in favor of a total overhaul after data localization and data mirroring requirements raised concerns among business stakeholders. In addition, the Indian Government is expected to commence work on a new law to replace the Information Technology Act 2000, which would entail new guidelines for data governance and cybersecurity as part of a ‘Digital India Act’.

This would be a major, and long overdue, step towards a modern data protection law that takes into account both economic interests and individual rights, as well as integrates into the progressive legal development worldwide.

Category: Data Protection · India · Personal Data
Tags: , , , , ,

Final steps towards the first data protection law in India

10. December 2021

To this date, there is no comprehensive law on the protection of personal data in India. The need for such a law was already expressed in 2017, when the Constitutional Bench of the Supreme Court of India confirmed that privacy is a fundamental right enshrined in Article 21 of the Constitution. This led to the creation of an extensive Personal Data Protection Bill 2019 (PDPB), which we have already reported on several times. It is currently pending consideration of the Indian Parliament.

The PDPB aims to ensure the protection of personal data of individuals and to establish a data protection authority for this purpose. To review and, if necessary, amend the PDPB, a Joint Parliamentary Committee (JPC) has been formed on the demand of opposition members. On November 22nd, 2021, the JPC issued its report on the proposed law, which is meant to be the basis for further discussions in the Parliament.

Initially, it was expected to present the report together with the PDPB at the start of the Winter Session of the Parliament, which began on November 29th, 2021. However, most recently it has become known that the JCA was granted a last (so far the sixth) extension of time to submit its report to resolve disagreements among committee members. As a result, the Parliament is likely to table the final report and subsequently consider the proposed law along with possible clarifications on December 21st, 2021, ahead of the end of its current legislative session on December 23rd, 2021. Once passed by both houses of the Parliament and approved by the President, the PDPB is then to be enacted as legislation.

Category: Data Protection · India · Personal Data
Tags: , , , , ,