Digital Personal Data Protection Act, 2023

The Ministry of Electronics and Information Technology set up a committee to study issues related to data protection. The committee was chaired by retired Supreme Court judge Justice B. N. Srikrishna. The committee submitted the draft version of Personal Data Protection in July 2018. [21] The report was modified several times later by the Government of India and after receiving the approval of central cabinet the draft legislation was tabled in the Parliament of India on 11 December 2019.[22]

The Bill aims to:[23]

to provide for protection of the privacy of individuals relating to their personal data, specify the flow and usage of personal data, create a relationship of trust between persons and entities processing the personal data, protect the fundamental rights of individuals whose personal data are processed, to create a framework for organisational and technical measures in processing of data, laying down norms for social media intermediary, cross-border transfer, accountability of entities processing personal data, remedies for unauthorised and harmful processing, and to establish a Data Protection Authority of India for the said purposes and for matters connected there with or incidental thereto.

It provided for extensive provisions around collection of consent, assessment of datasets, data flows and transfers of personal data, including to third countries and other aspects around anonymized and non-personal data. [24]

The revised 2019 Bill was criticized by Justice B. N. Srikrishna, the drafter of the original Bill, as having the ability to turn India into an “Orwellian State".[lower-alpha 1][25] In an interview with Economic Times, Srikrishna said that, "The government can at any time access private data or government agency data on grounds of sovereignty or public order. This has dangerous implications.”[25] This view is shared by a think tank in their comment number 3.[26]

Fresh criticism on the international level comes from an advisor to a group proposing an alternative text.[27] A moderately critical summary is available from an India scholar working with an American co-author.[28]

The role of social media intermediaries is being regulated more tightly on several fronts. The Wikimedia Foundation is hoping that the PDP bill will prove the lesser evil compared with the Draft Information Technology [Intermediary Guidelines (Amendment) Rules] 2018.[29][30]

Forbes India reports that "there are concerns that the Bill gives the government blanket powers to access citizens' data."[31]

Jaiveer Shergill, a prominent Supreme Court Lawyer has shared the pitfalls and gaps of the current version of the draft bill. There are serious loopholes of how the bill is unable to identify the scope of governmental bodies in distinguishing who has access to the personal data of the citizens and missing state bodies to monitor the personal data.[32]

The bill after being tabled was referred to the JPC which was chaired by Meenakshi Lekhi. Later received criticism from stakeholders, opposition and experts the bill was withdrawn from the Parliament of India on 3 August 2022.[33]

The Digital Personal Data Protection Bill, 2023 is the draft version of the Digital Personal Data Protection Act, 2023, initially the government has released its the Digital Personal Data Protection Bill, 2022 on 18 November 2022 for public consultation till 2 January 2023 and approved the revised version of the earlier draft which was released for public consultation making it the Digital Personal Data Protection Bill, 2023.[34][35]

• On 18 November 2022, the Digital Personal Data Protection Bill, 2022 was released for public consultation, the deadline for receiving comments was 17 December 2022
• On 17 December 2022, the Ministry of Electronics and Information Technology has extended the deadline for receiving public comments till 2 January 2023
• On 5 July 2023, the cabinet has approved the Digital Personal Data Protection Bill, 2023 which is the revised version of the bill which was put up for public consulation earlier.[6]

• On 3 August 2023, the revised version of the Digital Personal Data Protection Bill, 2022 which is the Digital Personal Data Protection Bill, 2023 was introduced by Ashwini Vaishnaw, Minister of Electronics and Information Technology in Lok Sabha.

• On 7 August 2023, the bill was passed by Lok Sabha.[36] The bill was then introduced and passed in the upper house of the Indian Parliament Rajya Sabha on 9 August 2023.[37]

• On 11 August 2023, Draupadi Murmu, President of India has given assent to the Digital Personal Data Protection Bill, 2023 which made it the Digital Personal Data Protection Act, 2023.[10][11]

The Digital Personal Data Protection Act, 2023 has relaxed data localisation requirements when compared to the earlier attempted legislation PDP Bill, 2019 and permits cross-border data flow to certain countries and territories as may be notified by the central government. Unlike the earlier bills, the present legislation does not prescribe local storage or localization requirements. However there is a restriction on this, only the countries that are notified by the central government under this Act are allowed to do so under the regulations. Regarding on what basis the countries are notified and other data processing related details are yet to be announced by the Data Protection Board of India.[42]

The Act is only applicable to the data collected digitally and when offline data gets digitized. Not having the applicability on offline personal data was criticized as there is no framework on how such data is handled.

The statement of objects and purpose of the DPDPA-2023 state that it is to “provide for the processing of digital personal data in a manner that recognizes both the right of individuals to protect their personal data and the need to process personal data for lawful purposes, and for matters connected therewith or incidental thereto”.[43][44]

As it replaces information security with the right of an individual to control their own data privacy, the Act confuses the idea of informational privacy and leaves much to be desired. Since the need for such legislation was first stated in the Right to Privacy verdict, it appears that the DPDPA-2023 as it was enacted in this state differs from the original idea of what the law could have been.[45]

The exemptions to the Government were criticized by the opposition and experts stating that the Right to privacy verdict is a fundamental right as per the supreme court's verdict and this exemptions don't ensure the satisfaction of the right to privacy.[46]

However Rajeev, MoS has countered that these exemptions are for such incidents where a disaster or terrorist activity occurs and government should be able to access such personal data to rescue people in disaster situations, and identify people behind a terrorist activity. The MoS also has confirmed that the government is also under the obligation of protecting the personal data it has, the only exemption is, it can access that data in events concerning "national security".

The Digital Personal Data Protection Act, 2023 requires data fiduciaries to obtain verifiable consent from a legal guardian before processing the personal data of a child (below 18 years). This would necessitate verifying the age of all users signing up for digital services to determine if they are minors and obtain parental consent. However, this verification process may compromise anonymity in the digital space, as it requires providing proof of age.[47] In the UK and USA, individuals above 13 years can give consent and EU has it at 16 and few members EU states have it even at 13.

Critics argue that the age of consent at 18 years disregards developmental differences, neglecting the distinction between the consent capacity of a toddler and a teenager. Additionally, it could lead to unequal internet access. Moreover, the necessity for parental agreement might hinder children of their autonomy. These restrictions contravene India's obligations under the Convention on the Rights of the Child.[47]