India: Govt tables data bill in parliament with penalties as high as $30mn for violators

The world’s second-largest data market, India on Thursday (August 3) moved a step closer to having its major privacy bill, which had been in-the-making for the last five years.

India’s IT minister Ashwini Vaishnaw tabled the Digital Personal Data Protection (DPDP) Bill, 2023 in the parliament a year after an older version of the draft was withdrawn following criticism from tech giants.

Provisions of the bill

Add WION as a Preferred Source

Named as the Digital Personal Data Protection Bill, this proposed law aims to grant significant decision-making authority to the Central government.

This authority encompasses the ability to exempt specific data-handling entities, such as startups, from certain regulations, if deemed necessary. Additionally, it permits the processing of children's data, provided the responsible entity demonstrates sufficient protective measures.

Under the proposed law,the government will also have the power to identify countries where the transfer of individuals' personal data is prohibited, a change from the previous bill draft that suggested allowing data transfers to "notified countries and territories."

Severe penalty of as much as $30 million

The bill mandates that the public must provide accurate personal information and refrain from impersonating others. Failure to adhere to these responsibilities may result in penalties for individuals, ranging up to $121 (10,000 Indian rupees).

For data-handling entities that violate the law, fines could be as high as $30 million (250 croreIndian rupees).

The bill outlines the provision of appealing decisions made by the data protection board to the Telecom Disputes Settlement and Appellate Tribunal within a 60-day timeframe.

Tight regulations around user data

The bill specifiesthat entities collecting user data must obtain explicit consent from users. Consent requests should be communicated in clear and simple language.

Watch:"Data Protection Bill is much needed in our current scenario,"says Rahul Matthan, Partner, Trilegal

Users also retain the right to revoke their consent at a later time. Moreover, the bill introduces a provision for establishing a mechanism to address grievances, utilising consent managers to assist users in giving, managing, reviewing, and withdrawing their consent.

Voluntary disclosure of a breach

The introduced bill also brings forth the idea of companies making voluntary disclosures in the event of a data or security breach, coupled with an alternate dispute resolution system aimed at alleviating the load on the judicial system.

A senior official from the government was quoted by Economic Times as saying, “If a company makes a mistake, they have the option of voluntary disclosure, it's like the plea bargain provision in the US law.”

WATCH WION LIVE HERE