Work in Progress

India’s data protection Bill has implications for citizens, companies and the government. But many questions need answers before it can near implementation

- GOUTAM DAS

Depending on who you speak to, the Personal Data Protection Bill, 2019, draws out extreme responses. Justice B.N. Srikrishna, a former judge of the Supreme Court of India, dubbed the latest version of the Bill, cleared by the Cabinet, “dangerous” and one that could turn the country into an “Orwellian state”. In the Bill, the central government gets powers to access personal data in the interest of integrity, sovereignty, security, and public order among others.

At the other end is Omkar Rai, Director General of Software Technology Parks of India (STPI). He tweeted: “The clearance of #PDPB by the Union Cabinet is a historic step towards striking a balance between the sprinting digital revolution and exigency of personal #dataprotection while strengthening India’s position on citizens’ #datasecurity”.

There are many stakeholders in data protection – citizens, who are the data providers to private and public companies as well as the government; data processors, or organisations that use the data for business or other purposes; and the government, which is interested in law enforcement and possibly a bargaining chip in dealing with large multinationals, particularly the social media companies who are difficult to tame.

The legislation, therefore, is complicated, and evolving. The Bill has now been referred to a Joint Committee of the Houses (JPC), which could recommend tweaks, and more clarity. The Bill’s principles, however, wouldn’t change.