Data Privacy And Protection Laws In India
Author: LawSphereX
Category: Constitutional & Human Rights
Published:
Updated:
DATA PRIVACY AND PROTECTION LAWS IN INDIA
Prashik Rajendra Rakshe, ILS Law College, Pune
ABSTRACT
With reference to the Digital Personal Data Protection Act of 2023, this paper investigates past and present data protection and privacy regulations in India. India’s constitution defines privacy as the cornerstone of all else and a basic right to life. Processing personal data has legal basis from the Information Technology Act, 2000 and the 2011 Privacy Rules. But the Fourth Industrial Revolution and India’s explosive digital economic expansion called for a more all-encompassing legal framework. Passed in August 2023, the first crosssectoral personal data protection law in India, the DPDPA, Excluding nondigital data, data used for personal or domestic reasons, and data made public under legal obligations, this brief 33-page law addresses personal data gathered in digital and later digitised non-digital forms.
Data fiduciaries have to keep security under the DPDPA and build efficient grievance redressal systems. It specifically enables cross-border digital personal data transfer, excluding movements to nations with central government restrictions. The Act also creates the Data Protection Board, a specialist adjudicatory and enforcement body with non-compliance sanctioning authority. The DPDPA still has various difficulties and ambiguity even with improvement. Two main questions are possible issues processing children’s data and the lack of data portability and right to be forgotten clauses. The law defines a child as anyone under 18 and needs parental permission for data processing, which can make implementation difficult and lower digital anonymity. The study explores how the DPDPA affects online gaming and finance holistically.
The DPDPA’s strict data protection standards may conflict with financial services’, hence increased data protection should be used. The Act requires online gaming data retention, transparent permission, and legitimate processing of personal data, especially for children’s data. An accurate balance of user protection and innovation, the DPDPA promotes digital governance in India. Effective Act application depends on well-stated data portability, deletion rights, harm control, and children’s data processing standards. Regulators, corporations, and stakeholders must work together to protect digital data in India. Keywords: Data, Privacy, Personal Data Protection, Data Localization, Compliances.
INTRODUCTION
The Indian Parliament enacted the Digital Personal Data Protection (DPDP) Act, 20231 in the beginning of August 2023. After more than five years of discussion and approval, the new law is the first in India to deal with the protection of personal data in all government sectors. The main topic of discussion in this essay is whether or not a “good” statute was produced during this apparently never-ending period of deliberation.
In more detail, the issue is whether the law provides sufficient protection for personal data and whether it appropriately balances “the right of individuals to protect their personal data” with “the need to process such personal data for lawful purposes” The paper's approach to responding to this issue starts with summarising The main characteristics of the legislation are examined and compared to previous versions, including the latest official measure presented by the government in Parliament in 2019. Subsequently, the latter portion of the paper analyses the DPDP Act from two separate perspectives. Initially, it elucidates several aspects of this legislation that may provide difficulties, thereby enhancing our comprehension of its impact on consumers, businesses, and the Indian government.
Furthermore, it places the act within the framework of the discussions and advancements that have taken place in the past five years or so. The third portion focuses on making predictions regarding the primary elements that are expected to shape the future development of India's data privacy regulations. The legislation that has been presented to Parliament is in its second iteration, the Act of 2023 being the fourth in total. In 2018, a committee of qualified individuals wrote a preliminary version and released it for public comment. Subsequently, the government's version of the law was presented to Parliament in 2019 and became the Personal Data Protection law, 2019. This version underwent scrutiny from a legislative committee, which released its report in December
2021. But the administration ultimately opted against moving forward with this measure, and
in November 2022 they released a revised draft for public comment. The draft Digital Personal Data Protection Bill, dated 2022, was the name given to this new document. This draft differs significantly from the previous iterations, as can be seen. The law that would be passed in 2023 would be based on this proposal. However, it also includes a few additional clauses that are
1 Digital Personal Data Protection Act, No. 18 of 2023, India Code (2023).
important to the concerns this study aims to address. In the case of Justice K. S. Puttaswamy and Others v. Union of India and Others2, the Supreme Court of India rendered a major ruling in 2017. These four drafts weren't the result of this decision. According to the ruling, the right to informational privacy is an integral part of the fundamental right to life in India, as does the right to privacy. However, neither the decision nor the guidelines for its application established a precise definition of the limits of the right to informational privacy or the means by which rights would be protected. This led to the passage of the Personal Data Protection Bill, 2019, the government's initial attempt at a law, through Parliament in December of 2019. This specific version was widely circulated and promoted data protection laws that would be applicable to all economic sectors.
The Data Protection Institution (DPA), an all-encompassing data protection institution, would oversee the implementation of this rule. The bill that was approved in 2019 contained a preventive framework. Organisations that gather personal information have to comply with several regulations, such as giving individuals notice and obtaining their consent, storing accurate information securely, and using the information only for the purposes mentioned in the notice. Businesses were also mandated to give customers the ability to access, remove, and transfer personal data, and to destroy it if the purpose for which it was obtained had been satisfied. Businesses were required to maintain additional security measures, establish grievance redress mechanisms, apply “privacy by design” standards, and comply with transparency requirements.
Lastly, this measure includes the creation of a brand-new organisation known as “consent managers. ” These individuals functioned as middlemen to obtain consent from individuals and provide it to companies. The bill divided personal information into many categories and required higher security standards for “sensitive” and “critical” personally identifiable data. Additionally, some businesses would be labelled as “significant data fiduciaries,” and they would be subject to extra regulations. These responsibilities included data impact evaluations, data audits, and registration in India. In addition, the bill limited the amount of specific kinds of data that might be transferred over international boundaries based on localization. It was authorised for the Department of Public Administration to impose penalties on businesses that broke these
2 K.S. Puttaswamy & Ors. v. Union of India & Ors., (2017) 10 SCC 1 (India).
regulations. An additional section of the legislation aimed to criminalise any activity involving the deanonymization of individuals from anonymized databases. Furthermore, the 2019 legislation contained a clause granting the government jurisdiction over non-personally identifiable data. It enabled the government to request certain non-personal data from private organisations and require them to provide it to the government on the terms it defined. Among the recommendations a comprehensive, cross-sectoral framework built on rights for individuals or consumers (referred to as “data principals”) and preventive obligations for corporations (referred to as “data fiduciaries”) was incorporated into the law that was established in 2019. For the most part, this regulatory framework was adapted from the 2018 Srikrishna Committee draft law. Justice B. N.
Srikrishna, a retired Supreme Court judge, chaired this committee, which was formed by the Ministry of Electronics and Information Technology in July 2017 to aid in the development of data protection guidelines. Nonetheless, the recommendations put out by this group were based on noteworthy regulatory developments that had occurred during the committee's period of activity. The European Union's (EU) implementation of the General Data Protection Regulation (GDPR) was the most important of them. Although the bill of 2019's wide preventive framework was a welcome move, its enormous scope presented challenges. As a result, several significant compliance requirements were established, which would have affected all sizes of firms involved in the economy. Furthermore, it recommended the creation of a DPA with broad regulatory and supervisory authorities.
These regulations would have given greater clarification on the considerable compliance requirements currently present in the measure. There was a good chance that there would have been either excessive or insufficient oversight because the law was new and there had never been any prior experience implementing a data protection regulation of this type. The DPDP Act is based on the draft that the government provided with the purpose of taking a completely different approach to the regulation of data protection, which was enacted by the government in November 2022. The next section decomposes the act's main provisions. WHAT IS DATA PRIVACY AND DATA PROTRECTION ?
Data privacy in India pertains to the entitlements and anticipations of individuals concerning the obtaining, utilisation, and dissemination of their personal data by organisations. It empowers individuals to have control over their personal data, allowing them to provide consent to how their data is used and protecting it from misuse or unauthorised access. Since the Supreme Court's landmark ruling in 2017, Data privacy has received a lot more attention in India since the right to privacy was formally acknowledged as a basic right in the Justice K. S. Puttaswamy (Retd. ) v. Union of India case3. This decision made clear how important it is to create a strong legal framework to protect private information and identity.
In India, data protection refers to putting security policies and safeguards in place to protect personal information against breaches, unauthorised access, and other security concerns. The primary objective is to protect personal information's accuracy, accessibility, and confidentiality through the application of organisational and technical safeguards. The foundation for protecting personal data in India was laid by the Information Technology Act of
2000 (IT Act)4 and the Information Technology (Responsible Security Practices and Procedures
and Sensitive Personal Data or Information) Rules of 2011. Several laws require organisations that handle sensitive personal data to implement strong security measures to prevent data breaches. Establishing a robust data protection framework is made possible in large part by the Personal Data Protection Bill, 2019 (PDPB). Global standards such as the European Union's General Data Protection Regulation (GDPR) have an impact on the methodology. It seeks to strike a compromise between defending people's right to privacy and attending to the justifiable worries of governments and corporations. INDIA'S LAWS PERTAINING TO DATA PRIVACY AND PROTECTION India's strategy for data protection and data privacy has evolved over time, encompassing a range of legal and regulatory frameworks aimed at safeguarding personal information and upholding individuals' right to privacy.
The key legislations in India that deal with data privacy and data protection include the Information Technology Act, 2000 (IT Act)5, the Information Technology Rules, 2011, and the Personal Data Protection Act, 2023 (PDPB)6. Each of these laws was implemented in the year 2000. The subsequent paragraphs provide a comprehensive examination of these regulations, focusing on the specific sections that relate to data protection and data privacy.
3 Ibid.
4 Informa)on Technology Act, 2000, No. 21 of 2000, India Code (2000).
5 Ibid.
6 Supra Note 1.
In 2000, India enacted its inaugural comprehensive legislation, referred to as the Information Technology Act. This legislation encompassed all aspects of digital communication and ecommerce, including the safeguarding of data. Although the Information Technology Act encompasses a broad range of topics, several parts are especially crucial for safeguarding personal information and privacy. Section 43A7 is a crucial element of data protection under the Information Technology Act. Corporate entities handling sensitive personal data or information are obligated to have “reasonable security practices and procedures” to protect the data in question. If a business entity fails to adequately protect confidential personal information, leading to unjustified financial loss or gain, the corporate entity is legally obliged to provide compensation to the affected individual.
This section is crucial in the event of a data security breach as it outlines the basis for compensation and specifies the legal responsibility for ensuring the care and maintenance of data security. If a corporation fails to establish and uphold adequate security policies and procedures, resulting in harm or benefit to an individual, the corporation is legally required to provide compensation to the affected party as a form of damages. Section 72A8 addresses the unauthorised disclosure of material that goes against a valid contract. Those who, due to a commercial or professional relationship, have access to personal data and disclose it without the individual's consent shall be subject to criminal penalties, as specified by this law requirement. This section highlights the importance of preserving confidentiality and the legal consequences of unauthorised information disclosure.
Any individual who, while carrying out their responsibilities or fulfilling their obligations under this legislation, has legally obtained access to any material containing personal information and reveals such information without the consent of the individual in question or in violation of any lawful agreement, shall be subject to imprisonment for a period of up to three years, or a fine of up to five lakh rupees, or both. Rule 4 specifies the responsibilities that data fiduciaries, who are firms that handle data, must undertake in order to comply with approved security policies and standard operating procedures. In order to accomplish this, it is imperative to have a thoroughly documented
7 Information Technology Act, 2000, Section 43A (India 2021).
8 Information Technology Act, 2000, Section 72A (India 2021).
information security strategy, together with policies that are commensurate with the nature of the data and the associated risks. The law states that a legal entity or an individual acting on behalf of a legal entity, who processes sensitive personal data or information in the course of their business activities, must establish a privacy policy. This policy should include a clear and easily accessible statement outlining the practices and policies related to data and information, as well as procedures for handling sensitive personal data or information. Rule 5 pertains to the acquisition of consent from data principals, who are identifiable individuals whose data is being processed. Prior to gathering and analysing sensitive personal information, companies must obtain written authorization from individuals in order to adhere to this requirement.
Furthermore, the consent must be explicitly given for the specific purpose of data collection and must be based on adequate information. “The law states that when personal data or information is being collected, the organisation or individual representing it must obtain consent from the individual whose data is being collected for the purpose of processing that data. ” The guidelines for the disclosure of Sensitive Personal Data or Information (SPDI) are specified in Rule 6, which is accessible at this location. The stipulation mandates that the sharing of Sensitive Personal Data or Information (SPDI) can only occur with the consent of the individual whose data is involved, save in specific circumstances, such as legal obligations or the safeguarding of national security interests.
As per the law, the entity or individual representing it must only reveal sensitive personal data or information for the specific purposes it was gathered for and with the consent of the individual whose data it is, or as specified by the law. The Personal Data Protection Bill, 2019 (PDPB) is a comprehensive legislation designed to build a strong framework for safeguarding personal data in India. The bill incorporates several innovative concepts and regulations, drawing inspiration from global benchmarks like the General Data Protection Regulation (GDPR) implemented by the European Union. Chapter II discusses the concepts that are relevant to the handling of personal data. The PDPB establishes principles for data processing. These principles encompass the restriction of purposes, the reduction of data, and the requirement of accountability.
Collecting personal information is mandatory for certain, legal purposes and must not be utilised for any objectives outside the intended scope.
As to the legal requirements, “Personal data must be handled in a just and reasonable manner that upholds the privacy of the individual, and should only be gathered for specific, transparent, and lawful reasons. ” Data principals are afforded several rights under Chapter III, specifically designated as “Rights of Data Principals. ” These rights encompass the entitlement to access, rectify, delete, transfer data, and be completely forgotten. People are given the authority to exert control over their own personal information and to pursue legal solutions if it is mishandled. The primary individual of a data set has the right to view and obtain a copy of the personal data that pertains to them. Chapter IV discusses the responsibilities of data fiduciaries. This chapter delineates the responsibilities of data fiduciaries.
These responsibilities encompass the execution of measures to safeguard data, the conduct of evaluations to evaluate the impact of data protection, and the designation of data protection officers for roles that entail substantial data processing activities. As per Section 21, a data fiduciary has a legal duty to ensure that the handling of personal data is conducted securely and in compliance with the provisions of this Act. The Indian Data Protection Authority The primary role of the The Digital Personal Data Protection Board (PDPB) is to establish the Data Protection Authority of India, an autonomous body tasked with overseeing adherence to the bill, enforcing data protection rules, and handling grievances.
The Act declares that the Data Protection Authority is empowered to enforce the terms of this Act, conduct investigations into complaints, and ensure adherence to data protection standards. The Digital Personal Data Protection Act (PDPB)9 incorporates measures for imposing penalties and providing compensation in cases of breaches of data protection regulations. The measures are detailed in Chapter VIII. This paper provides a detailed explanation of the procedures for managing complaints and the penalties that are enforced for failure to comply. According to Section 74, t he Authority has the power to levy a penalty for breaches of this Act, which cannot exceed ₹5 crore or 2% of the total global turnover of the previous fiscal year, whichever is greater.
9 Supra Note 1.
ANALYZING THE INDIA DIGITAL PERSONAL DATA PROTECTION ACT 2023
India will get its very first data privacy regulation according to the 2023 act, which was passed in 2023. Before any processing of personal data can take place, it is necessary to obtain agreement from the individual, and the legislation does provide for a limited number of exceptions that are outlined in detail. In addition to the right to nominate, it gives customers the ability to access, correct, update, and delete their personal information. Additionally, it establishes additional safeguards for the processing of data pertaining to children. In the case of enterprises, it necessitates the implementation of security protections, as well as the creation of purpose constraints and responsibilities to provide notice of data collection and processing. The establishment of systems for the resolution of complaints is mandated by the law for businesses.
Moreover, the DPB would be responsible for handling complaints and grievances, and it will have the authority to impose penalties for those who do not comply with the legislation. The result is that India now has a regulatory framework for the protection of personal data for the very first time. Businesses that collect data will eventually establish minimal standards of behaviour and compliance as a result of the presence of the law, which will gradually lead to the formation of these standards. The method that the government takes towards adopting and enforcing the law will be the most crucial variable in this respect. For instance, the question of whether the implementation will be concentrated on enterprises that rely heavily on data or whether it will be implemented across the economy will be an important thing to consider.
There are, however, certain worries regarding various elements of the law and their potential to undermine the safeguards that appear to be provided in it. These concerns range from open questions regarding the implementation of the law to problems over the law's provisions. In the first place, the exceptions that have been carved out for consent give the state a large amount of power and elevate the state's imperatives to a different level than those of private businesses. This may be perfectly acceptable in certain situations, such as during times of emergency or natural catastrophes; nonetheless, the legislation expands the scope of situations that fall into this category. For instance, Section 7(b)10 of the law gives the government the ability to circumvent consent requirements in situations where a beneficiary of government
10 The Digital Personal Data Protection Act, 2023, Section 7(b).
services has already given their assent to receive any other benefit from the state. In addition to the possibility that this will make it simpler for the government to obtain the personal information of beneficiaries who are getting government services, it also opens the door for the government to collect databases. This is due to the fact that in order for government agencies to be able to make full use of the potential offered by this rule, they would need to be exempted from purpose constraints, which stipulate that personal data must be deleted once the purpose for which it was collected has been fulfilled. One other illustration of this is the way in which the state is granted exemptions for the purposes of conducting investigations, prosecuting criminals, and ensuring national security.
Section 17(1)(c)11 of the law exempts the requirements of notice and consent, among other things, for the purposes of processing for “prevention, detection, investigation, or prosecution of any offence or contravention of any law. ” This exemption applies to processing for the purposes of processing. Section 17(2)(a)12 thereafter gives a blanket exception from the entire law to any government agency that the government may notify, in the interests of sovereignty, security, integrity, public order, and preventing incitement. This is completely understandable, but it is important to note that this exemption is not applicable to all government agencies. Section 17(2)(a) is just an indication of the aim of Parliament to ensure that some state agencies are completely exempt from the application of the data protection law. This is because Section 17(1)(c) already exists.
The existence of provisions such as these results in the formation of a distinct category of activities that are not subject to the standards for data privacy. One of the most troublesome aspects of the situation is that the Indian state is not subject to many of the restraints that private entities are. This is especially problematic in situations where there is no urgent need for such an exception. Furthermore, the discretionary rule-making powers that the government possesses in accordance with the law have the potential to, in certain circumstances, undermine the protections that are granted by the law. For instance, the government has the authority to declare, in accordance with Section 17(5)13, that any provisions of this legislation would not apply to any firm or class of enterprises for the first five years after the law was enacted. The
11 The Digital Personal Data Protection Act, 2023, Section 17(1)(c) (2023).
12 The Digital Personal Data Protection Act, 2023, Section 17(2)(a) (2023).
13 The Digital Personal Data Protection Act, 2023, Section 17(5) (2023).
timing of the execution of this exception is not specified, nor is there any direction regarding the manner in which this provision is to be utilised. An hopeful interpretation of this provision would suggest that it could be utilised to provide new businesses or industries that are just getting started some time to comply with the legislation. On the other hand, a provision for this has already been provided in Section 17(3)14, which offers limited exclusions to new businesses and other industries that the government may notify. In light of this, Section 17(5) has the potential to be utilised in a manner that is contrary to the objectives of the proposed legislation. The statute merely restricts the government's ability to provide these exemptions for a period of five years in the beginning, which is something that should be emphasised once more.
The length of time that these exemptions can be in effect is not capped in any way by this provision. In a similar vein, the government possesses some unguided rule-making capabilities that allow it to exclude firms from some standards for the handling of children's data. Certain standards for the same are specified in Sections 9(1)15 to 9(3)16, which include, among other things, the requirement of parental agreement and the prohibition of profiling. For any business or category of businesses, the government has the authority to exempt them from the provisions of Sections 9(1) to 9(3) “subject to such conditions, as may be prescribed,” as stated in Section 9(4). Once more, this clause does not specify the grounds on which this exception will be granted, the manner in which the conditions are to be decided, or any other relevant information.
Due to the absence of adequate guidance, this rule is likewise susceptible to being implemented in an inappropriate manner. Despite the fact that there are other clauses in which the government has the authority to prescribe conditions and set substantive rules, the examples that were mentioned above offer almost little guidance. This is especially problematic when compared to the principles of Indian administrative law, which stipulate that legislation should not give the authority in charge of executing them an excessive amount of discretion that is not guided by any specific guidelines. In the event that they are utilised in an inappropriate manner, such legal provisions have the potential to violate the Constitution of India. Finally, there are issues with the way the DPB was designed.
In addition to the fact that the board is an autonomous organisation with a restricted mission, the government will establish
14 The Digital Personal Data Protection Act, 2023, Section 17(3) (2023).
15 The Digital Personal Data Protection Act, 2023, Section 9(1) (2023).
16 The Digital Personal Data Protection Act, 2023, Section 9(3) (2023).
procedures for the selection and appointment of its respective members. In spite of the fact that the legislation specifies the requirements that must be met by members, it does not specify the number of members that must be on the board and only needs one of them to be an expert in the law. This final item presents a challenge because one of the primary functions of the board is to issue penalties and directives for those who do not comply with the regulations. In addition, the chairperson of the DPB has the authority to provide permission to any member of the board to carry out “any of the functions of the board and conduct any of its proceedings. ” It is possible that the chairman will not give permission to the legal member of the board to carry out the procedures that would lead up to the imposition of a penalty.
Additionally, this architecture does not successfully maintain an internal separation of roles between the members who are conducting inquiries and the chairperson within the organisation. Due to the fact that the chairperson is the one who appoints members to conduct inquiries, it is possible that they will not carry out this job in an impartial manner in every instance. Because of this, the Data Protection and Data Privacy Act (DPDP Act) is the first law to provide data privacy protections; yet, certain elements within the law have the potential to effectively undercut the benefits of the law if the government does not act in accordance with them in the most meticulous manner possible.
CONCLUSION
The Digital Personal Data Protection Act, 2023is the initial implementation of legal regulations for safeguarding personal data, following a lengthy period of discussion and negotiation spanning over five years. The level of protection for individuals' personal data privacy will be defined by the regulatory advancements and institutional frameworks that emerge in the next years. Although the new law establishes the necessary structure, it falls short in guaranteeing the actual attainment of data privacy. The topic of whether the previous versions of the bill would have effectively enhanced privacy protection is a subject that remains debatable percent However, the changes in the provisions of the law throughout time demonstrate the government's shifting approach to safeguarding personal privacy.
Undoubtedly, the current iteration of the law significantly reduces expenses for Indian enterprises compared to previous versions, which is a welcome development. In light of such factors, the legislation itself is modest and pragmatic. I appreciate this. However, there are certain cases where this is indeed the case, which can potentially harm individuals' rights to privacy. The allocation of significant discretionary authority to the central government over substantive issues implies that the extent to which individuals' right to privacy is safeguarded will largely hinge on the government's level of commitment.