On August 7, the Digital Personal Data Protection Bill (DPB) 2023 was passed by the Lok Sabha after several rounds of consultations with all the stakeholders. The Bill introduces several key highlights, including the requirement for entities handling user data to ensure its protection even when stored with third-party processors, mandating companies to promptly report data breaches to the affected users and the Data Protection Board (to be appointed by the government and thus may not be solely independent). Additionally, special provisions are outlined for processing the data of minors and individuals under guardianship, necessitating guardian consent.
According to the new Bill, firms must appoint a Data Protection Officer and share their contact details with users. At the same time, the central government gains authority over data transfers beyond India’s borders. Additionally, penalties assessed by the DPB, up to INR 250 crore, are determined by breach nature, encompassing data breaches, lack of data protection, and failure to report breaches to the DPB and users.
However, according to experts, the Bill is a potential threat to journalists, politicians, researchers, activists, academics, and the RTI user.
One central concern pertains to the exemptions granted to government agencies, allowing them to bypass certain provisions under the pretext of national security, public order, and relations with foreign governments. Critics argue that such sweeping exemptions may lead to unchecked data collection and retention, infringing on citizens’ right to privacy.
The Bill has also raised concerns over the potential regressive amendments to the Right to Information (RTI) Act, which could weaken transparency and accountability. The National Campaign for Peoples’ Right to Information (NCPRI) has been at the forefront of these concerns. According to the NCPRI, the government has not adequately addressed critical concerns highlighted by the organization during the public consultation process. In their analysis, the NCPRI specifically pointed out regressive amendments being made to the RTI Act and issues related to the lack of independence and autonomy of the oversight body, the Data Protection Board.
Furthermore, concerns have been raised about potential implications for press freedom. The bill’s provisions could impact journalists’ ability to access and report information in the public interest, particularly concerning entities covered by the bill. The Editors Guild of India has expressed concerns regarding the bill’s impact on press freedom.
As the bill advances through legislative channels, balancing individual rights, media freedom, governmental accountability, and technological progress is imperative. Stakeholders, ranging from media organizations and legal experts to civil society and citizens, must collectively engage in a comprehensive dialogue to address these concerns and refine the bill to suit the Indian context best.
