Data Protection Bill: Implications Of Wide Exemptions To Government

Advocates have expressed concern over the new Digital Personal Data Protection Bill, 2023, over the "massive power" and wide-ranging exemptions given to the Union government.

The government introduced the bill in the Lok Sabha on Thursday after years of negotiations. This is the fourth time that the government has tried to bring in a law regarding citizens' data privacy, years after the Supreme Court held it to be a fundamental right under the Constitution.

While the bill has seen several changes from its 2022 version, it has received mixed reactions from advocates, with criticism over the powers of the central government to seek any information, block access to content, and compromise the independence of the Data Protection Board of India.

"The bill is a remarkable step forward, as for the first time, India has decided to regulate the data economy ecosystem," Senior Advocate Pavan Duggal told BQ Prime. "But it also has several challenges crying to be answered."

According to the bill, the central government may ask the Data Protection Board and any data fiduciary to provide information. At the same time, the government or any entities exempted under the Act will not be accountable for any misuse of data.

"Here, the government has been given massive power," Duggal said. "The entities that are exempt under this new law can collect public data and use or misuse it without any accountability."

"It also provides that whatever the government does under this law, it cannot be held liable for it under any circumstance. Hence, a virtual immunity has been granted to it, and that is a disturbing issue," he said.

Advocate Vrinda Bhandari concurred and said that the wide-ranging exemptions given to the government were problematic. "Using broad grounds of public order, all instrumentalities of the government may seek exemptions."

The government also has the power to exempt any class of data fiduciaries, including startups, from most of the provisions of the Act. This power could be exercised without procedural safeguards, according to Bhandari.

The bill states that the Data Protection Board will be set up by the central government for the purpose of imposing penalties, directing data fiduciaries in cases of data breaches, and addressing grievances.

However, the government will hold the power to take decisions on its composition, selection process, terms and conditions of appointment, and removal procedure.

"Since the appointment of the board would be done by the government, it would mean that the board is more likely to not be as independent as we are anticipating it to be," Duggal said.

Bhandari highlighted that the board's independence was essential since it regulates and ensures compliance with the Act. She termed the government's retention of the power to appoint the Chairperson and members without a selection committee in place "extremely worrying".

The bill also gives the central government the authority to block access to content based on the board's advice. Hence, the government could block any information from computer sources in the public interest.

"Under this, the government can give absolutely any direction to block content, which could prejudice the rights of some data stakeholders," Duggal said. "These issues should be dealt with in a holistic manner."

However, before implementing the block, the government will provide the data fiduciary with an opportunity to present their case and will record the reasons for the decision in writing.

The government can then issue an order to any agency under its jurisdiction or any intermediary to block access to the specific information associated with that data fiduciary, according to the bill.