Data Protection Bill Passed by the Lok Sabha and Rajya Sabha; Decoding the DPDP Bill

Presentation and Passing of the Bill

The Modi-led Union Government presented the Digital Personal Data Protection Bill (DPDP, 2023) in the Lok Sabha. It was presented on August 3 by Ashwini Vaishnaw (Union Minister for Communications, Electronics and IT). The Bill has been passed by the Lok Sabha by a voice vote on August 7. The Bill has retained the contents of the original version which was proposed last year in November. As on date 9^th August, the Bill has also been passed by the Rajya Sabha. The Bill was passed after the opposition members staged a walkout over the Manipur issue.

Understanding the DPDP (Digital Personal Data Protection Bill), 2023

The Bill is said to protect the rights of all citizens. It aims to govern the digital personal data by providing a framework focussing on the rights and obligations of the “ Digital Nagarik” (citizens) on one hand, and the obligations of the fiduciary to use the data lawfully. DPDP 2023 is based on similar principles upon which personal data protection laws in other jurisdiction are based on.

Violations under the Bill

The Bill proposed violations for allowing the transfer/storage of personal data in certain countries. Furthermore, it proposed the imposition of hefty penalties upto INR 500 Cr on companies and firms that fail in preventing breach of personal data. If the data processor or the data fiduciary fails to report a personal data breach to the Data Protection Board and the individuals affected, a fine of INR 200 Cr is proposed to be levied upon such processor. Moreover, INR 250 Cr is to be levied if the Processor or Fiduciary fails in providing sufficient precautions for security.

Requirement of Consent for Data

The DPDP aims to make consent for gathering personal data a requirement. As per the bill, the processing of personal data shall only be done for a “ lawful” purpose and after the concerned individual has given his/her consent for the same. In situations where consent is not expressly required, the phrase & lsquo Deemed Consent' has been added to the Bill.

Scope and Applicability of the Bill

The DPDP Bill is valid for data processing, both in and outside of India. & lsquo Digital Personal Data' is under the ambit of the Bill. It however does not apply to non-personal data and data in non-digital formats. It excludes domestic or private processing executed by individuals, non-automated processing and private data belonging to a person that has been kept for a minimum of 100 years.