PERSONAL DATA PROTECTION BILL

• The government of India has withdrawn the Personal Data Protection Bill from Parliament as it considers a “comprehensive legal framework” to regulate the online space to boost innovation in the country through a new bill.
• The Personal Data Protection Bill, 2019 was introduced in Lok Sabha by the Minister of Electronics and Information Technology, on December 11, 2019.
• Commonly referred to as the “Privacy Bill”, it intended to protect individual rights by regulating the collection, movement, and processing of data that is personal, or which can identify the individual.

Challenges:

• Many contend that the physical location of the data is not relevant in the cyber world as the encryption keys may still be out of reach of national agencies.
• National security or reasonable purposes are open-ended and subjective terms, which may lead to intrusion of the state into the private lives of citizens.
• Technology giants like Facebook and Google are against it and have criticised the protectionist policy of data localisation as they are afraid it would have a domino effect in other countries as well.
• It had been opposed by social media firms, experts and even ministers, who said that it had too many loopholes to be effective and beneficial for both users and companies.
• Also, it may backfire on India’s own young startups that are attempting global growth, or on larger firms that process foreign data in India.

Reason for withdrawl:

• The Joint Committee of Parliament analyzed the Personal Data Protection Bill, 2019 in detail.
• 81 amendments were proposed and 12 recommendations were made towards a comprehensive legal framework on the digital ecosystem.
• Considering the report of the JCP, a comprehensive legal framework is being worked upon.
• Hence, it is proposed to withdraw.
• The Bill was also seen as being too “compliance intensive” by startups of the country.
• The revamped bill will be much easier to comply with, especially for startups.
• The tech companies questioned a proposed provision in the Bill called Data Localisation.
• Under data localisation, it would have been mandatory for companies to store a copy of certain sensitive personal data within India, and the export of undefined “critical” personal data from the country would be prohibited.
• The activists had criticised that it would allow the central government and its agencies blanket exemptions from adhering to any and all provisions of the Bill.
• The bill had faced major push back from a range of stakeholders including big tech companies such as Facebook and Google, and privacy and civil society activists.

Way Forward

• The data should be stored in a region that is trusted by the Indian government, and that data should be accessible in the event of a crime.
• The government may also consider allowing cross-border data flows only to “trusted geographies”.

SOURCE: THE HINDU,THE ECONOMIC TIMES,MINT