Comments to the Joint Parliamentary Committee (JPC) on the Personal Data Protection Bill 2019 introduced in the Lok Sabha on 11 December 2019
65 Pages Posted: 30 Apr 2020
Date Written: March 3, 2020
Dvara Research is an independent Indian not-for-profit research institution guided by our mission of ensuring that every individual and every enterprise has complete access to financial services. Our work seeks to address challenges for policy and regulation in India given the waves of digital innovation sweeping financial services, focussing on the impact on lower income individuals in the country. The regulation and protection of consumer data has been a core area of our recent research.
In this document, we present our comments on the Personal Data Protection Bill 2019 (the Bill), introduced in the Lok Sabha in December 2019, and referred to the JPC on the Bill. Our feedback on the Bill is presented in this document in two sections.
Section I presents seven overarching concerns with the Bill, with detailed analysis and recommendations to address these concerns constructively. 1. User protections must be strengthened for the Bill to genuinely guarantee data privacy for Indians. 2. Changes to the institutional design of the DPA could limit its independence, accountability and effectiveness. 3. Immense powers and exemptions for the State will severely limit the effectiveness of the new regime. 4. Fair and reasonable processing should be an overarching obligation on data fiduciaries and data processors 5. “Harm” should not be condition on which rights and obligations depend in the Bill. 6. The Bill should not include provisions relating to the sharing of Non-Personal Data. 7. The Bill should contain transitional provisions to create certainty about its implementation.
Section II presents a comprehensive Chapter-wise analysis of the provisions of the Bill against the previous draft Personal Data Protection Bill, 2018 (the previous Bill), flagging new issues arising from changes as well as persisting concerns.
This response continues our engagement with the public consultation process on India’s new data protection regime since 2017.2 We are deeply concerned that aspects of the latest draft of the Bill could endanger users’ data protection and hamper the growth of a free and fair digital economy.
We urge the JPC to engage with our recommendations to create an effective, consumer-friendly data protection framework for India’s unique context. We welcome any opportunity to present these views or respond to questions and comments on our research to the JPC.
Keywords: Personal Data Protection Bill, India, Response
JEL Classification: G
Suggested Citation: Suggested Citation