Digital Personal Data Protection Act

Why is This Important?

NITI Aayog, the government’s principal think tank, has voiced objections to certain provisions of the Digital Personal Data Protection Act 2023. In particular, it has expressed concerns about amendments suggested to the Right to Information (RTI) Act of 2005.

Overview of Today’s Article

• Explanation of the Digital Personal Data Protection Act (DPDPA) 2023
• Key Features of the DPDPA
• Concerns Regarding DPDPA Raised by NITI Aayog

What is the Digital Personal Data Protection Act (DPDPA) 2023?

The DPDPA is a comprehensive law focused on privacy and data protection, outlining protocols for the processing, storage, and security of personal data.

It acknowledges the rights of individuals, termed data principals, to safeguard their personal data during lawful processing activities.

This legislation represents the culmination of a seven-year effort that began with the Supreme Court of India’s ruling in the K.S. Puttaswamy case in 2017, which established the right to privacy as a constitutional right in India.

The DPDPA includes provisions on consent, legitimate data usage, breaches, and the responsibilities of data fiduciaries and processors, as well as individual rights regarding their data.

The law does not extend to paper records unless they have been digitized, nor does it cover data collected for personal, artistic, or journalistic purposes.

Non-compliance can result in fines ranging from Rs 10,000 for individuals to Rs 2.5 billion for organizations.

Implementation of the law is pending, as necessary rules for its enforcement have yet to be established.

Key Features of the DPDPA

• Applicability:
  • The act applies to all types of data associated with an individual, including names, addresses, ID numbers, and behavioral information such as location, web history, and preferences.
  • However, it excludes data that individuals or third parties have made publicly accessible.
  • This means that information shared with consent is protected, while data indexed by search engines or social media platforms is not covered.
• Data Processing Definition:
  • The act outlines how data is collected, recorded, structured, stored, shared, or processed automatically.
  • This data can be processed in India or abroad, unless explicitly prohibited, and applies to all companies providing goods or services in India, regardless of their headquarters.
• Responsibilities of Specific Entities:
  • Data fiduciaries are entities, including businesses and organizations, that interact with individuals to collect, modify, and delete data as requested.
    • They must clarify the purpose of data collection, its retention duration, and potential uses.
  • Significant Data Fiduciary (SDF):
    • Companies handling large volumes of data may be classified as SDFs and are required to:
      • Appoint an Indian data protection officer,
      • Conduct third-party audits,
      • Carry out data protection impact assessments.
  • Data Processors:
    • These are third-party businesses that manage data on behalf of fiduciaries, which may include cloud service providers or those involved in KYC, fraud detection, and credit rating services.

What Data Protection Laws Exist in Other Countries?

European Union Model:
The General Data Protection Regulation (GDPR) establishes a comprehensive framework for the protection of personal data. In the EU, the right to privacy is recognized as a fundamental right aimed at safeguarding an individual’s dignity and their control over the data they generate.

United States Model:
Unlike the EU’s GDPR, the US lacks a unified set of privacy rights or principles that comprehensively govern the use, collection, and disclosure of data. Instead, there is limited regulation specific to various sectors. The approach to data protection differs between the public and private sectors. Government activities and authority regarding personal information are clearly defined through broad legislation such as the Privacy Act and the Electronic Communications Privacy Act. In the private sector, some specific regulations apply, but they are not as extensive.

China Model:
Recent Chinese legislation on data privacy and security includes the Personal Information Protection Law (PIPL), which took effect in November 2021. This law grants new rights to Chinese data principals and aims to prevent the misuse of personal data. Additionally, the Data Security Law (DSL), implemented in September 2021, mandates that business data be categorized by levels of significance and introduces new limitations on cross-border data transfers.

Concerns Regarding DPDPA Raised by NITI Aayog

The DPDP Bill suggested an amendment to Section 8(1)(j) of the RTI Act, which would prevent the disclosure of personal information about public officials, even when justified for the greater public interest.

During inter-ministerial consultations, NITI Aayog advised the Ministry of Electronics and Information Technology (MeitY) to refrain from passing the proposed law in its current state, as it could undermine the RTI Act.

This provision faced criticism from opposition parties and civil society activists during the consultation phase and when the Bill was discussed in Parliament.

Nevertheless, MeitY decided to maintain the proposed modifications to the RTI Act despite NITI Aayog’s objections.

The government argued that the right to privacy is a fundamental constitutional right in India and should also extend to government officials.

Explore our Books: https://apnipathshala.com/product-category/books/

Explore Our test Series: https://tests.apnipathshala.com/