The Personal Data Protection Bill, 2019 (the “Bill”) has proposed some remarkable development in regards with data protection laws in India. In this piece, we discuss the changes that the Hon’ble Joint Parliamentary Committee on Personal Data Protection Bill could consider while deliberating on the Bill.

Clause 12: Grounds for Processing Data Without Consent

In case of processing of data without consent under clause 12, a notice that such data was processed along with the grounds on which the data was processed should be provided to the data principal. Once this notice is served on the data principal, the data principal should have the option to appeal against the decision before the Data Protection Authority (“DPA”) in case the data principal is of the opinion that the processing was not in accordance with the proposed Data Protection Act. This will ensure that there are check and balances in case the data is processed without consent. Additionally, the clause should include a requirement that the State should erase the data after the circumstances in which such data was processed cease to exist.

Clause 20: Right to be Forgotten

Clause 20 of the Data Protection Bill envisages that data principals can exercise their right to be forgotten by filing an application to an Adjudicating Officer of the proposed Data Protection Authority. The Adjudicating Officer would consider the rights of the data principal in preventing the continued disclosure of personal data vis-à-vis the right to freedom of speech and right to information. In its current form, the right to be forgotten is severely limited since the exercise of this right would involve approaching the Data Protection Authority for adjudication, rather than making a request to the data fiduciary as is the case in the European Union under the General Data Protection Regulation (“GDPR”).

To make this right meaningful, it is suggested that there should be an option to approach an officer appointed by the data fiduciary (“Privacy Officer”). An appeal from the decision of the Privacy Officer can be made to the DPA. Additionally, there should be a timeline prescribed for the Privacy Officer to decide the application for the right to be forgotten. For example, under GDPR, the term “without undue delay” is used. Similarly, this clause should be modified to include a timeline of say three (3) months or provide that the applications under this clause will be decided without undue delay.

Clause 35: Power of the Central Government to Exempt any Agency

In terms of clause 12 of the Data Protection Bill, 2019, there are numerous grounds provided for processing of data by the Government without the consent of the data principal. Additionally, clause 35 gives power to the Central Government to exempt certain agencies from the application of the requirement of the Bill. The grounds on which such exemption can be granted are extremely broad. Firstly, the ground that such exemption can be given for “preventing incitement to the commission of any cognizable offense relating to the commission of any cognizable offence relating to sovereignty and integrity of India, the security of the State, friendly relations with foreign States, public order”. The word public order is difficult to define and can have a wide connotation. Therefore, we suggest that the word “public order” should be deleted from clause 35(i) and clause 35(ii). Secondly, in our opinion, the power to exempt any agency should be given to the Data Protection Authority, based on the Central Government. Thirdly, any such exemption from the provisions of the proposed Data Protection Act should be for a maximum period of three (3) months, and this should only be extended after the Data Protection Authority analyzes and records reasons outlining the necessity of such an extension.

This post has been contributed by Ms. Vaneesa Agrawal.

[DISCLAIMER:  This article is for academic purpose and is solely to provide readers with general information regarding developments in Indian law. The information contained herein does not constitute legal or a professional advice.]