Global technology industry body IT has pushed for significant controls and exemptions to the government under the proposed Digital Personal Data Protection Bill 2022, which could make it difficult for companies to invest in data centers and data processing activities in India.
ITI represents global technology majors like Google, Microsoft, Meta, Twitter, Apple etc.
“The bill grants significant control to the executive branch of the Government of India (Government of India) and represents detailed rule-making authority to set aside procedures that have not yet been defined.
The GOI has also been given broad exemption from the application of the Bill, which may make it difficult for companies to invest in data centers and data processing activities in India,” ITI said in its submission.
What does the government’s proposal say
The Ministry of Electronics and IT has prepared the draft Digital Personal Data Protection (DPDP) Bill 2022 and invited comments on it till January 2.
The draft DPDP exempts data fiduciaries notified by the government from several compliance burdens, such as provisions relating to informing an individual about the purpose of data collection, collection of children’s data, risk assessment around public order, data Appointment of auditor etc.
The Bill proposes to exempt data fiduciaries notified by the government under the “right to information regarding personal data” from sharing details of data processing with data principals.
what is the stand of the government
Minister of State for Electronics and IT, Rajeev Chandrasekhar has said that exemption for the government will be only in special circumstances like maintaining public order, emergency, pandemic, national security etc.
However, the industry body has supported the bill on various points such as allowing data to be stored outside India, delineation of roles and responsibilities of entities that determine the purposes and means of processing personal data (data fiduciaries), and Entities that process personal data only on the instructions and under contract (data processor) etc.
“The Digital Personal Data Protection Bill represents the cornerstone of India’s comprehensive digital ecosystem.
ITI considers this an important moment for India to demonstrate global leadership in developing robust and consistent data security standards that enable innovation and facilitate cross-border trade,” said Kumar Deep, ITI India Country Director. Said on Monday evening.
ITI has suggested the government to remove the concept of “consent manager” or “consent manager platform” as it is unclear as to how data fiduciaries, consent managers and data principals should interact with each other.
The industry body said data breach notification rules are currently too broad, requiring each data breach to be notified to both the Data Protection Board (DPB) and each affected data principal. It has recommended that only those violations which are likely to materially affect the rights of the affected citizen should be reported to the Board.
The DPB is proposed to work on and implement the provisions of the Bill. It will also have the power to punish data fiduciaries, data principals, etc.
In the matter of protecting children’s data, ITI wants the government to reconsider imposing a comprehensive ban on tracking, behavioral monitoring and targeted advertising, and to limit restrictions to only instances of children’s data processing that clearly cause significant harm can deliver.
“Even where well-intentioned, such broad restrictions can potentially deprive children and young people of access to useful content and may make it difficult for companies providing services to children to block inappropriate advertising or harmful content.” For example, such a prohibition could disrupt the availability of materials related to mental health support services to youth in need, ITI said.
(with PTI inputs)