A SPECIAL PRIMER ON DATA PROTECTION BILL 2021

Whose Protection Is It Anyway?

The Joint Parliamentary Committee, constituted to look into the Personal Data Protection Bill, 2019, laid its Report in Parliament on 16th December 2021. Here’s a summary of important amendments proposed by the Committee, and highlight the standout issues that are likely to have the most far-reaching effects.

RENAMING

Earlier named the ‘Personal Data Protection Bill, 2019’, this draft legislation has now been titled the ‘Data Protection Bill, 2021’ in light of the fact that its scope has been expressly broadened to include the regulation of non-personal data (“NPD”), including anonymised personal data, as well. This is likely to affect the proprietary rights and commercial interests of businesses, due to mandatory sharing/ disclosure provisions associated with NPD.

STATE EXEMPTIONS

The scope of this legislation has been limited to regulation of private entities and businesses alone, by exempting State functions and functionaries from application of different provisions, taking away from a ‘horizontal application’ of this legislation as mandated in Puttaswamy.

SOCIAL MEDIA PLATFORMS AND STATUTORY MEDIA REGULATORY AUTHORITY

There are recommendations that all social media platforms which do not act as intermediaries should be treated as publishers and held accountable for the content they host, especially from unverified accounts on their platforms, and that no social media platform should be allowed to operate in India unless the parent company handling the technology sets up an office in India. However, notably, no specific provisions relating to these have been introduced in this Bill. It is also recommended that a statutory media regulatory authority, on the lines of the Press Council of India, may be set up for the regulation of content on all media platforms, whether online, print or otherwise.

CHILDREN’S PERSONAL DATA

The mandates earlier relating only to ‘guardian data fiduciaries’ must now be complied with by every data fiduciary. This includes implementing measures such as age verification, and refraining from profiling, tracking or provided targeted advertisements to those below 18 years of age. On the other hand, any data fiduciary processing children’s data will also have to comply with the additional obligations imposed on significant data fiduciaries, such as appointing a Data Protection Officer, maintaining records, conducting audits and preparing Data Protection Impact Assessments.

RIGHTS OF A DECEASED DATA PRINCIPAL

An additional data principal right has been introduced, which empowers the data principal to decide how his or her data has to be dealt with in case of casualty/death.

RIGHT TO DATA PORTABILITY

The new Bill states that ‘trade secret’ cannot be a ground to deny data portability requests, and that such a request can only be denied on the ground of technical infeasibility. Notably, protection of trade secrets/ confidential information is an international Treaty commitment made by India under the TRIPS Agreement (Article 39), and hence, denying protection to trade secrets would mitigate against India’s international commitments.

RIGHT TO BE FORGOTTEN

The existing ‘right to restrict continuing disclosure’ has been supplemented with the ‘right to restrict continuing processing’. Interestingly, the right to be forgotten is still not equated with the right to erasure (as in the GDPR).

AVAILABILITY OF ALGORITHMS

A new category of information must be made available in order to ensure transparency, i.e., algorithms or method used by various entities for processing of personal data to demonstrate its fairness. However, algorithms and processing methods constitute proprietary business information and requiring mandatory disclosure of the same would mitigate against companies’ intellectual property rights. Further, ‘fairness’ is a competition law concern that can be suitably addressed through competition laws, and should not form a part of this Bill.

DATA BREACH REPORTING

‘Data Breach’ will now include ‘non-personal data breach’, i.e. ‘any unauthorized including accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to non-personal data that compromises the confidentiality, integrity or availability of such data’. However, non-personal data breach is essentially an issue that should be dealt with under property law/ Intellectual Property law. A time period of 72 hours has been prescribed for reporting of a personal data breach.

DATA PROTECTION OFFICER (‘DPO’)

The Committee has recommended that the DPO should be a senior level officer in the State or key managerial personnel in relation to a company being (i) the Chief Executive Officer or the managing director or the manager; (ii) the company secretary; (iii) the whole-time director; (iv) the Chief Financial Officer; or (v) such other personnel as may be prescribed. The DPO must be based in India.

LIABILITY OF DIRECTORS

The Bill introduces liability of an independent director and a non-executive director of a company as well, but only if it is shown that the acts of omission or commission by the company had occurred with his knowledge or with his consent attributable to him or where he had not acted diligently.

CROSS-BORDER TRANSFER TO BE ALLOWED ONLY IN CONSULTATION WITH THE CENTRAL GOVERNMENT IN ALL CASES

Any contract/Intra-Group scheme for transfer of sensitive personal data is to be approved by the DPA only in consultation with the Central Government. It is further stipulated that the contract/ intra-group scheme shall not be approved even after the consent of the data principal has been obtained, if the object of such transfer is against public policy or State policy. This inclusion provides unbridled power in the hands of the Central Government to access and restrict contracts/ intra-group schemes. ‘State policy’ has been conflated with ‘public policy’ without being separately defined anywhere. The transfer pursuant to a determination of adequacy of any country/ entity by the Central Government has been supplemented with the addition requirement that such sensitive personal data shall not be further shared with any foreign government of agency unless such sharing is approved by the Central Government. Finally, the DPA has been mandated to consult with the Central Government before allowing transfer of any sensitive personal data for any specific purpose.

GOVERNMENT - AUTHORIZED AGENCY TO TEST AND CERTIFY COMPUTER HARDWARE AND SOFTWARE

The DPA has been tasked with the monitoring of a Governmentauthorized agency to test and certify the integrity and trustworthiness of hardware and software on computing devices. Notably, regulation of digital devices is the subject matter of other Guidelines already; this legislation was intended to be technology agnostic and hence its expansion to regulate hardware devices is misplaced.

QUANTUM OF PENALTY

Significantly, the PDP Bill 2019 was backed by large sanctions of penalty upto INR 5 crore/ 2% of worldwide turnover for some provisions, and upto INR 15 crore/ 4% of worldwide turnover for other provisions. These penalties of INR 5 crore/ 15 crore were also specifically made applicable to contravention of the respective provisions by the State. Instead, this new Bill provides that the Government will determine the quantum of penalties in all cases. No system of checks on the exercise of this power by the State have been prescribed in the legislation.

NO LIABILITY ON STATE

Instead of attributing liability to the head of department/authority/body of the State proven to have committed an offence under this Act as done by the PDP Bill 2019, this new Bill provides instead, that an in-house enquiry shall be conducted by the Head of Office of the concerned data fiduciary and the person or officer concerned responsible for such offence shall be liable to be proceeded against and punished. Of course, an in-house inquiry conducted by the head of the same department alleged to have committed an offence signals a clear conflict of interest.

MEMBERS OF DPA SELECTION COMMITTEE NOMINATED BY GOVERNMENT

While ostensibly meant to be an ‘independent’ body, the inclusion of additional members to constitute part of the Selection Committee for the DPA are the Attorney General of India and experts to be nominated by the Central Government.

DPA TO BE BOUND BY DIRECTIONS OF THE CENTRAL GOVERNMENT UNDER ALL CASES AND NOT JUST ON QUESTIONS OF POLICY

This amounts to complete control over the DPA by the Central Government through issuing directions in all cases. The DPA can no longer be said to function independently of the Government. There is a clear conflict of interest as the State is also required to be bound by the provisions of this legislation, as it is bound to guarantee the fundamental right to privacy of the individual as upheld in Puttaswamy

Key Apex Court Judgments

2021 was no less than a decade old backlog of cases that the Judiciary would have otherwise needed to combat with. Here are some of the key judgments that the Apex Court came up with even during the pandemic times. With virtual court hearings in full swing, the Judiciary played its role high and hearty. Have an interesting read through.

LAXMIBAI CHANDARAGI V. THE STATE OF KARNATAKA AN INDIVIDUAL’S DECISION, NOT THE FAMILIES’

Empowering the choice 2 adults have when it comes to marrying each other, the apex court made it clear as to no consent is mandatory or necessary in any form from either of the families if the adults are willing to enter a wedlock. Their mutual consent is of utmost importance and validity.

DEVILAL V. STATE OF MADHYA PRADESH 18 IT IS. LOUD & CLEAR.

Clearing away any apprehensions whatsoever, the Supreme Court emphasized that even if the accused were guilty but less than 18 years of age, the matter must be dealt with the Juvenile Justice Board. Above 16 years and below 18 years of age does not dilute the purpose of a Juvenile Justice Board in any form.

THE CHIEF ELECTION COMMISSIONER OF INDIA V. MR VIJAYABHASKAR YES, FREEDOM OF PRESS IS FOR COURT HEARINGS AS WELL.

The Court supported the reportage of press as far as court proceedings are concerned, including oral observations by Judges are concerned. “Article 19(1) (a) covers freedom of press. Freedom of speech and expression covers freedom to cover court proceedings too... Now people are more digital oriented and hence look to internet for information. Hence it would do no good to prevent a new medium to report proceedings. constitutional bodies will do better than complain about this,” the Court said.

SATBIR SINGH V. STATE OF HARYANA GUIDELINES, FOR THE DOWRY DEATH TRIALS

Not just the crime, not the criminal, but one should also keep in mind the legislative intent to tackle the social evil of dowry deaths. The Court therefore has laid down guidelines for Dowry Death trials and their hearings in lower courts.

Laws in the Making

COVID19 would have caused a pause in the smooth functioning of the legislative fabric of the nation, but it has quite well bounced back into action with both the upper and lower houses struggling to their best to function smoothly and create a smooth passage of laws. Here’s a select few.

THE GENERAL INSURANCE BUSINESS (NATIONALISATION) AMENDMENT BILL, 2021

The General Insurance Business (Nationalisation) Amendment Bill, 2021 was introduced in Lok Sabha on July 30, 2021. The Bill seeks to amend the General Insurance Business (Nationalisation) Act, 1972. The Act was enacted to nationalise all private companies undertaking general insurance business in India. The Bill seeks to provide for a greater private sector participation in the public sector insurance companies regulated under the Act.

THE FARM LAWS REPEAL BILL, 2021

The Bill repeals the three farm laws passed by Parliament in September 2020. These are: (i) the Farmers (Empowerment and Protection) Agreement on Price Assurance and Farm Services Act, 2020, (ii) the Farmers’ Produce Trade and Commerce (Promotion and Facilitation) Act, 2020, and (iii) the Essential Commodities (Amendment) Act, 2020. Note that, in January 2021, the Supreme Court had stayed the implementation of the three farm laws.

THE NATIONAL COMMISSION FOR HOMOEOPATHY (AMENDMENT) BILL, 2021

The National Commission for Homoeopathy (Amendment) Bill, 2021 was introduced in Lok Sabha on August 9, 2021. It amends the National Commission for Homoeopathy Act, 2020. The 2020 Act replaced the Homoeopathy Central Council Act, 1973. The 1973 Act set up the Central Council of Homeopathy for regulating homoeopathic education and practice. The 2020 Act replaced the Council with a national commission for regulating homoeopathic education and practice. Note that the 1973 Act was to be repealed on a date notified by the central government.

THE CONSTITUTION (127TH AMENDMENT) BILL, 2021

The Constitution (One Hundred and Twenty-Seventh Amendment) Bill, 2021 was introduced in Lok Sabha by the Minister of Social Justice and Empowerment, Dr. Virendra Kumar, on August 9, 2021. The Bill amends the Constitution to allow states and union territories to prepare their own list of socially and educationally backward classes.

THE TAXATION LAWS (AMENDMENT) BILL, 2021

The Taxation Laws (Amendment) Bill, 2021 was introduced in Lok Sabha by the Minister of Finance, Ms. Nirmala Sitharaman, on August 5, 2021. The Bill amends the Income Tax Act, 1961 (IT Act) and the Finance Act, 2012. The 2012 Act had amended the IT Act to impose tax liability on the income earned from the sale of shares of a foreign company on a retrospective basis (i.e., also applicable to the transactions done before May 28, 2012). The Bill proposes to nullify this retrospective basis for taxation.

THE LIMITED LIABILITY PARTNERSHIP (AMENDMENT) BILL, 2021

The Limited Liability Partnership (Amendment) Bill, 2021 was introduced in Rajya Sabha on July 30, 2021. The Bill seeks to amend the Limited Liability Partnership Act, 2008. The Act provides for regulation of limited liability partnerships (LLP). LLP is an alternative corporate body form to traditional partnership firms. Under LLP, a partner’s liabilities are limited to their investment in the business. The Bill converts certain offences into civil defaults and changes the nature of punishment for these offences. It also defines small LLP, provides for appointment of certain adjudicating officers, and establishment of special courts.

THE BANKING LAWS (AMENDMENT) BILL, 2021

Amends the Banking Companies (Acquisition and Transfer of Undertakings) Acts of 1970 and 1980, and the Banking Regulation Act, 1949 to privatise two public sector banks.

THE INSOLVENCY AND BANKRUPTCY CODE (AMENDMENT) BILL, 2021

The Insolvency and Bankruptcy Code (Amendment) Bill, 2021 was introduced in Lok Sabha on July 26, 2021. It amends the Insolvency and Bankruptcy Code, 2016. Insolvency is a situation where individuals or companies are unable to repay their outstanding debt. The Bill replaces the Insolvency and Bankruptcy Code (Amendment) Ordinance, 2021, which was promulgated on April 4, 2021.

THE MINES AND MINERALS (DEVELOPMENT AND REGULATION) AMENDMENT BILL, 2021

The Mines and Minerals (Development and Regulation) Amendment Bill, 2021 was introduced in Lok Sabha on March 15, 2021. The Bill amends the Mines and Minerals (Development and Regulation) Act, 1957. The Act regulates the mining sector in India.

THE ARBITRATION & CONCILIATION (AMENDMENT) BILL, 2021

The Arbitration and Conciliation (Amendment) Bill, 2021 was introduced in Lok Sabha on February 4, 2021. It seeks to amend the Arbitration and Conciliation Act, 1996. The Act contains provisions to deal with domestic and international arbitration and defines the law for conducting conciliation proceedings. The Bill replaces an Ordinance with same provisions promulgated on November 4, 2020.

THE JAMMU AND KASHMIR REORGANISATION (AMENDMENT) BILL, 2021

The Jammu and Kashmir Reorganisation (Amendment) Bill, 2021 was introduced in Rajya Sabha on February 4, 2021. It amends the Jammu and Kashmir Reorganisation Act, 2019. The Act provides for the bifurcation of the state of Jammu and Kashmir (J&K) into the Union Territory of J&K and Union Territory of Ladakh. The Bill repeals the Jammu and Kashmir Reorganisation (Amendment) Ordinance, 2021.

THE ASSISTED REPRODUCTIVE TECHNOLOGY (REGULATION) BILL, 2021 AND THE SURROGACY (REGULATION) BILL, 2020

The Assisted Reproductive Technology (Regulation) Bill, 2020 was introduced in Lok Sabha on September 14, 2020. The Bill seeks to provide for the regulation of Assisted Reproductive Technology services in the country. The Surrogacy (Regulation) Bill, 2019 was introduced by the Minister of Health and Family Welfare, Dr. Harsh Vardhan in Lok Sabha on July 15, 2019. The Bill defines surrogacy as a practice where a woman gives birth to a child for an intending couple with the intention to hand over the child after the birth to the intending couple.

THE CRYPTOCURRENCY AND REGULATION OF OFFICIAL DIGITAL CURRENCY BILL, 2021

The Bill seeks to prohibit all private cryptocurrencies in India while allowing for certain exceptions that promote the technology of cryptocurrency. Also, creates a framework for digital currency that will be issued by the Reserve Bank of India.

THE MEDIATION BILL, 2021

It proposes pre-litigation mediation and also aims to safeguard the interest of the litigants to approach the competent adjudicatory forums/courts in case urgent relief is sought.

India’s Legal Turning Points in 2021: A Photo Feature on Judgments, Laws & Bills

Continue Reading

ABOUT AUTHORS

AMEET DATTA

VANEESHA JAIN