What is Personal Data Protection Bill? Why did government withdraw it after 4 years of work? - Read here

New Delhi: The government on Wednesday (August 3, 2022) sprung a surprise as it spiked the much-debated and contentious Data Protection Bill from Parliament, which had alarmed big technology companies such as Facebook and Google. The government said it will come out with a "set of fresh legislations" that will fit into the comprehensive legal framework. "The government will bring a set of new legislation for a comprehensive legal framework for the digital economy," IT Minister Ashwini Vaishnaw said. 

"We have started the drafting of the new bill, which is in good advanced stages," minister Ashwini Vaishnaw said, saying the draft release was "very close".

"Personal Data Protection Bill has been withdrawn because the Joint Committee of Parliament (JCP) recommended 81 amendments in a bill of 99 sections. Above that it made 12 major recommendations. Therefore the bill has been withdrawn and a new bill will be presented for public consultation," the IT minister said in a tweet. 

Personal Data Protection Bill has been withdrawn because the JCP recommended 81 amendments in a bill of 99 sections. Above that it made 12 major recommendations.
Therefore the bill has been withdrawn and a new bill will be presented for public consultation. — Ashwini Vaishnaw (@AshwiniVaishnaw) August 3, 2022

The IT Minister noted that media protection from Big Tech and revamping IT intermediary rules would form part of the comprehensive framework. The government will soon begin consultations with stakeholders.

What is Personal Data Protection Bill? 

The Personal Data Protection Bill was then introduced in India's parliament on December 11, 2019. It set the rules for how personal data should be processed and stored, and lists people's rights with respect to their personal information. The Bill sought to establish a Data Protection Authority in the country for the protection of digital privacy of individuals.  

The Bill was first drafted by an expert committee headed by Justice BN Srikrishna in 2018. The central government introduced a draft of the Bill in 2019 in the Lok Sabha, which was referred to the Joint Parliamentary Committee in December 2021 and was later tabled in Parliament after six extensions.

Notably, the latest version of the bill included both personal and non-personal data under its ambit, which would be dealt with by a Data Protection Authority.

Why was Personal Data Protection Bill withdrawn? 

The 2019 Bill was deliberated in great detail by the JCP, which proposed 81 amendments and 12 recommendations for a comprehensive legal framework for the digital ecosystem, as per the official statement circulated to Lok Sabha members on Wednesday. 

"Considering the report of the JCP, a comprehensive legal framework is being worked upon. Hence, in the circumstances, it is proposed to withdraw 'The Personal Data Protection Bill, 2019' and present a new bill that fits into the comprehensive legal framework," the statement said.

Additionally, the bill was criticised by privacy experts as it was seen as being more in favour of the government rather than protecting privacy, which the Supreme Court held as a fundamental right in 2017.

The withdrawn Bill had proposed restrictions on the use of personal data without the explicit consent of citizens. It had also sought to provide the government with powers to give exemptions to its probe agencies from the provisions of the Act, a move that was strongly opposed by the opposition MPs who had filed their dissent notes.

Why didn’t the government scrap the Bill earlier?

In an interview with an English news daily, Ashwini Vaishnaw explained why it took the government this long to scrap the bill. “After the JCP presented the report, it took us a few months. That was the only time we could have even started on a new draft or think what to do with it (old draft). Our intent is absolutely crystal clear. What we are doing is basically in line with what the Supreme Court has told us to do," said Vaishnaw.

"I fully understand that there has been a delay in this, but the subject was too complex. We could have withdrawn it, let’s say, four months back, but we needed a little bit of deliberation before biting the bullet,” he added.

Personal Data Protection Bill likely to be replaced by more than one bill?

The government would hold a wide public consultation before putting the new legislation to Parliament, sources said. According to sources, the Bill could be replaced by more than one bill, dealing with privacy and cyber security and the government may bring the new set of bills in the Winter Session of Parliament.

The government circulated among members a statement, containing reasons for withdrawal of the Bill, which was introduced on 11 December 2019 and was referred to the Joint Committee of the Houses for examination. The report of the JCP was presented to Lok Sabha in December 2021.

Meanwhile, after the Bill was withdrawn, Minister of State for IT Rajeev Chandrashekhar tweeted that this will soon be replaced by a comprehensive framework of global standard laws including digital privacy laws for contemporary and future challenges and catalyse Prime Minister Narendra Modi's vision.

He said the JCP report on the Personal Data protection bill had identified many issues that were relevant but beyond the scope of a modern Digital Privacy law. "Privacy is a fundamental right of Indian citizens & a Trillion-dollar Digital Economy requires Global std Cyber laws," he said in another tweet.

The JCP report had also proposed to specify the flow and usage of personal data, protect the rights of individuals whose personal data are processed, as it works out the framework for the cross-border transfer, accountability of entities processing data, and moots remedies for unauthorised and harmful processing.

(With agency inputs)