 bill no xxiii  of  2016 the right to privacy of personal data bill, 2016 a billto provide for the right to privacy of personal data to all individuals in the country,establishing the liability of the organizations as well as the appropriate government in case of misuse of such personal data of individuals, for creation of a national do- not-disturb registry to ensure that individuals are not harassed by organisations and creating awareness among individuals for protection of their personal data and for matters connected therewith or incidental theretobe it enacted by parliament in the sixty-seventh year of the republic of india as follows:—1 (1) this act may be called the right to privacy of personal data act, 2016(2) it extends to whole of indiashort title, extent and commencement(3) it shall come into force on such date as the central government may, by notificationdefinitions2 in this act, unless the context otherwise requires,—(a) "appropriate government" means in the case of a state, the government of that state and in all other cases, the central government;5(b) "business contact information" means and includes individual's name, position name or title, business telephone number, business address, business electronic mail address or business fax number and any other similar information about the individual, not provided by individual solely for his personal purposes;(c) "data subject" means an individual whose personal data is being processed; (d) "individual" means a human being whether living or deceased;10(e) "intermediary" means an organisation which processes personal data on behalf of another organisation;(f) "national interest" includes issues of national security, defence and conduct of international affairs;15(g) "organisation" includes any individual, company, intermediaries, contractors, association or body of persons, corporate or unincorporated,whether or not—(i) formed or recognised under any law of the country; or (ii) resident, or having registered office or a place of business in indiaexplanation— organisation shall also include government ministries, departments and public funded institutions at all levels20(h) "personal data" means any data, whether true or not, about an individual who can be identified from that data and other information about an individual which any organisation has collected or is likely to have access to;(i) "prescribed' means prescribed by rules made under this act;25(j) "privacy risk" means the potential for personal data, on its own or when linked to other information about an individual, to cause emotional distress, or physical, financial, professional or any other harm to an individual;(k) "processing of personal data" means taking any action regarding data that is linked to an individual or a specific device, including but not limited to collecting, retaining, disclosing, using, merging, linking, and combining data303 (1) every individual, whether he is citizen or not, shall have the right to privacy of personal data generated by him while staying legally within the countryright to privacy of personal data(2) notwithstanding anything contained in any other law for the time being in force, no person shall process the personal data without the consent of the individual:35provided that if the individual is deceased, after the commencement of the act, this right shall pass on to his legal heir(s), as the case may be(3) before taking the consent for processing of personal data every organisation shallprovide the individual in concise and easily understandable language, accurate, clear, timely and conspicuous notice of its privacy and security practices40(4) every organisation shall provide convenient and reasonable access to such notice,in electronic, physical or any other feasible form, and any updates or modifications to such notice to the individual whose personal data is processed(5) after taking the consent, every organisation shall provide the individual with reasonable means to control the processing of personal data in proportion to the privacy risk to the individualcreation of a national do- not-disturb registry4 (1) the appropriate government shall create a registry to be named as nationaldo-not-disturb registry where individuals living in the country can register themselves to restrict any sort of communication, in any form including but not restricted to receiving phone calls, messages, or mails5(2) the appropriate government shall take necessary measures to promote the nationaldo-not-disturb registry and make the individuals aware of the same5 (1) all organisations shall create a data requirement policy, within three months ofthe commencement of the act, and shall review the actual requirement of personal data of individuals on a peridical basiscreation and review of data requirement policy10(2) the review of data requirement policy shall be updated on a yearly basis unless aneed to update the same arises earlier for an organisation6 the appropriate government shall take necessary measures for creation ofawareness of protection of personal data among the persons living in the countrycreation ofawareness of protection of personal data157 notwithstanding anything contained in this act, the right to privacy of personaldata of the individual shall be restricted,—restrictions on right to privacy of personal data(a) for matters of national security; (b) to protect the life and health of an individual who is not able to express hisconsent;20(c) for the data of the individuals, deceased before the commencement of theact;(d) when an individual is acting in the course of his employment with anorganisation; and(e) for business contact information258 (1) the appropriate government, as and when required, shall issue guidelines formaintaining privacy of personal dataguidelines for privacy of personal data(2) the guidelines shall be issued after due consultations with the concernedstakeholderscoordination within appropriate government309 the appropriate government shall take all measures to ensure effective coordinationbetween services provided by concerned ministries and departments such as those dealing with law, home affairs, human resource development, information and technology, information and broadcasting, defence, corporate affairs and external affairs to address issues of privacy of personal data10 (1) the central government may, by notification, establish for the purposes ofthis act, a national research centre for excellence in data management which shall conduct holistic research activities in the field of data management35(2) the central government may, by notification, specify the headquarters of theresearch centre established by it under sub-section (1)establishment of national research centre for excellence in data management(3) the salary and allowances payable to and other terms and conditions of the officers and members of staff of the research centre shall be such as may be prescribed4011 (1) on and from such date, as the appropriate government may, by notification in the official gazette specify, the education of privacy of personal data in educational institutions shall be imparted compulsorily from such class onwards as may be prescribed by the appropriate governmentcompulsory education of privacy of personal data in educational institutions(2) subject to such rules, as may be prescribed, the appropriate government shallensure appointment of such number of teachers with such qualifications, as may be specified, for teaching privacy of personal data in educational institutions512 no public servant shall misuse the access to personal data or track the personaldata of the individiual including the members of parliament, members of legislative assembly or council except for matters of national securitypublic servants not to misuse access to personal data of citizens 13 the central government shall, after due appropriation made by parliament by law in this behalf, provide requisite funds for carrying out the purposes of this actcentral govenment to provide funds penalty1014 (1) any organisation who directly or indirectly contravenes or attempts tocontravene the provisions of this act, shall be punished with imprisonment for a term which may extend to seven years or with fine up to fifty lakh rupees or with both(2) the penal provisions shall not apply to the individuals including the directors ofthe organisations who can prove their innocence with regard to the illegal data processing conducted in the organisation1515 in cases where it is proved that the organisation has undertaken illegal personaldata processing of individuals, the organisation shall be liable to pay ten times the revenues earned from such activities as compensation to the aggrieved individualspayment of financial compensation to aggrieved individuals(2) in case the organisation is unable to pay such financial compensation, their assetsshall be liable to be attached for this purpose20power to remove difficulties16 if any difficulty arises in giving effect to the provisions of this act, the centralgovernment may, by order published in the official gazette, make such provisions not inconsistent with the provisions of this act, as appear to it to be necessary or expedient for removing the difficulty:provided that no such order shall be made after the expiry of the period of three yearsfrom the date of commencement of this act2517 the provisions of this act shall have effect notwithstanding anything inconsistenttherewith contained in any other law the time being in forceact to have overriding effect power to make rules18 the central government may, by notification in the official gazette make rules forcarrying out the purposes of this act statement of objects and reasonspersonal data refers to data, whether true or not, about an individual who can be identified from that data and other information to which any organisation has or is likely to have access in the earlier times, personal data of citizens was confined to limited domains of government records and paper documentation managed privately by citizens however, india has witnessed a digital revolution at the cusp of the 21st century the social and economic landscape of the country underwent a metamorphosis with the advent of technology with this, the scope of personal data expounded exponentially according to data industry giant ibm website, nearly 90% of the total data in the world has been created in last two years alone a major portion of this personal data is generated through electronic medium chiefly through the means of internet with the advent of cloud compouting, millions of terabytes of data get uploaded on the web on a daily basisin the past two decades, there has been a meteoric rise in promoting digital governance in the country and the same has been undertaken in the recent months under the digital india initiative digital provisions of governmental, banking and various other necessary services have given way to generation of millions of terabytes of sensitive citizen data in the country there has been an upsurge in the use of e-locker services (digilocker) provided by the government and various cloud based storage applications for storing crucial personal data by the citizens the marquee government program for digital identification of all its citizens (aadhaar) is on its way of completing a universal coverage in the countrywith an array of governmental services being provided digitally to the citizens, there lies an imminent threat of unauthoried capturing and recording of personal data generated through the provisions of these services with the meteoric rise of the business process outsourcing (bpo) industry in the country, the demand for personal data of people is huge and in order to cater to the same, there has been a rise of a data mafia and an entire illegal industry has come up, worth thousands of crores which would provide personal details of citizens for profit-making purposes due to phenomenal penetration of smartphones in the country, there has been a rise in the application (mobile app) culture and data generated on these applications has also increased significantlyin such circumstances, it becomes extremely important to protect the personal data especially generated through electonic means belonging to the citizens in the country individual data of extremely sensitive nature such as retina scans, thumb imprints of millions of indian citizens collected under aadhaar need highest degree of safeguards especially when the same is collected by private enrolment agencies the data captured under e-locker and online storage programs need comprehensive security considering the invaluable nature of data stored in the same by the indian citizensthere is also an urgent need to create a broad, transparent and comprehensive framework to determine the liability of the organizations collecting, storing and maintaining the personal data of the user there is a need to introduce a 'review of data requirement policy' to keep a check on the greed of organizations seeking more data for nefarious purposes this policy must specifically differentiate the instances where the need is of mere identification of individuals and cases where specific personal data of the citizens is required despite having a do-not-disturb (dnd) policy in place, the organizations have found loopholes within the same and the tele-marketing harassment of common and innocent citizens in the country continues there is a need to legislate for the creation of a national do-not-disturb registry (ndndr) along with stringent penal provisions against the organizations which harass the citizens who register their numbers within this registry there is also an urgent nned to create awareness among the citizens to explain the significance of their personal data and the need to protect the same a large number of instances have come to light where the access to personal data of the politicians in the country especially the parliamentarians at both the central and state level is misused for political vendetta hence, there is a need to bring the government officials to be brought under the purview of the act in order to ensure that such illicit tracking and misuse of access to personal data can be preventedvarious countries across the globe have recognized the importance of enacted comprehensive legislations giving protection to data of its citizensvarious provisions in the current legal framework including the information technology act deal with the protection of data of the citizens however, the laws in this country have not been able to keep up with the speed of fast changes occurring in the world of technology there is a need to make the penal provisions for illegal capturing, storing and performing other such malicious activities with the personal data of the citizens even more stringent there is also a need to introduce a component of payment of financial compensation to aggrieved user whose data has been misused by the organizations in order to disincentivize perfomance of such unlawful activitieshence, in the times when the internet and data generated through the same are becoming ubiquitous, it is pertinent that the rights in relation to the same are imparted to the citizens and such a measure will surely help in proving the age old adage 'a stitch in time, saves nine' the ap shah committee submitted a report on the need to enact a law on privacy in the year 2012 despite the passage of four years, still the government has not enacted a comprehensive law on data privacy in the country it is high time that a law should be enected to protect the very foundational premise for the success of digital india which is the protection of data of its citizens without further delaythe need of the hour is to develop fool-proof data-protection laws in the countrythere is an urgency to create a comprehensive law for imparting holistic privacy to the personal data of the citizens of this countryhence, this billvivek gupta financial memorandumclause 4 provides for creations of a national do-not-distrub registry clause 6 provides for creation of awareness of protection of personal data clause 10 seeks to establish a national research center for excellence in data management clause 13 provides that the central government shall provide requisite funds for carrying out the purposes of the bill at this stage, it is not possible to estimate the amount to be incurred however, the bill, therefore, if enacted, will involve expenditure from the consolidated fund of india it is estimated that an annual recurring expenditure of about rupees one thousand crore would be involveda non-recurring expenditure of rupees one thousand and five hundred crore is also likely to be involved memorandum regarding delegated legislationclause 18 empowers the central government to make rules for carrying out the purposes of the bill as the rules will relate to matters of details only, the delegation of legislative power is of a normal character———— a billto provide for the right to privacy of personal data to all individuals in the country, establishingthe liability of the organizations as well as the appropriate government in case of misuse of such personal data of individuals, for creation of a national do-not-disturb registry to ensure that individuals are not harassed by organisations and creating awareness among individuals for protection of their personal data and for matters connected therewith or incidental thereto————(shri vivek gupta, mp)gmgipmrnd—2238(s3)—05082016