 the data (privacy and protection) bill, 2017byshri baijayant panda, mp————arrangement  of  clauses__________clauses chapter  i preliminary1short title and commencement2definitions3application chapter  ii right to privacy and data protection4right to privacy5express consent6binding determination7duly informed8access to personal data9rectification of personal data10seeking removal of personal data11restrict processing12data portability13breach of personal data14legitimate expectation of due diligence15reasonable restrictions chapter  iii methods and principles of data collection and protection16collection and processing of data with prior consent17special provisions for consent in case of minors and persons with disability18purpose of data collection and processing19collection or processing of personal data20special provisions for sensitive personal data(ii)clauses chapter  iv transfer, storage and security of personal data21prohibition on sharing of personal data22retention of personal data23prohibition on storage of personal data24transfer of personal data to third parties25cross-border transfer of personal data26pseudo-anonymisation27notification of breach28security protocol chapter  v obligations of data controller and data processors29collection etcof data in a fair, lawful and transparent30responsibly of sharing and use of personal data31fortification of data security32maintenance of accurate records33criminal liability34appointment of data protection officer35role of data protection officer chapter  vi surveillance36bar against surveillance37surveillance by private companies, partnerships or any other body corporate38surveillance by the state39duration of surveillance40security and duty of confidentiality and secrecy41admissibility in court42no targeted individual profiling43storage of surveillance chapter  vii data privacy and protection authority44constitution of data privacy and protection authority45appointment of chairperson and members to authority46constitution of benches47terms of office, conditions of service, removal of chairperson and members48procedure and powers of the authority49functions of the bench50filing of complaints51issuance of orders clauses52appeal53civil court not to have jurisdiction chapter  viii offences and penalties54punishment for offences related to personal data55punishment for offences related to sensitive personal data56breach of confidentiality and security in certain cases57compensation in case of harassment and profiling58penalty for contravention of directions59cognisance chapter  ix miscellaneous60protection of action taken in good faith61power to remove difficulties62overriding effectschedule i—exemptions schedule ii—privacy notice bill no 100 of  2017 the data (privacy and protection) bill, 2017 byshri baijayant panda, mp a billto codify and safeguard the right to privacy in the digital age and constitute a data privacy authority to protect personal data and for matters connected therewithbe it enacted by parliament in the sixty-eighth year of the republic of india as follows:— chapter  i preliminary(3) it shall come into force on such date as the central government may, by notification in the official gazette, appoint; and different dates may be appointed for different provisions of this act and any reference in any such provisions to the commencement of this act shall be construed as a reference to the commencement of that provision5definitions2 in this act, unless the context otherwise requires,—(a) "anonymised data" means data or information processed in such a manner that it no longer relates to an identified or identifiable person;10(b) "authority" means the data privacy and protection authority constituted under section 44;15(c) "armed force" means any body raised or constituted pursuant to or in connection with, or presently governed by, the army act, 1950 (46 of 1950), the indian reserve forces act, 1888 (4 of 1888), the territorial army act, 1948 (6 of 1948), the navy act, 1957 (62 of 1957), the air force act, 1950 (45 of 1950), the reserve and auxiliary air forces act, 1952 (62 of 1952), the coast guard act, 1978 (30 of 1978) or the assam rifles act, 2006 (47 of 2006);20(d) "authorised officer" means an officer, not below the rank of a gazetted officer, of an all india service or a central civil service, as the case may be, who is empowered by the central government, by notification in the official gazette, to intercept a communication of another person or carry out surveillance of another person under this act;25(e) "communication" means a word or words, spoken, written or indicated, in any form, manner or language, encrypted or unencrypted, meaningful or otherwise, and includes visual representations of words, ideas, symbols and images, whether transmitted or not transmitted and, if transmitted, irrespective of the medium of transmission;21 of 2000(f) "data" shall for the purpose of this act refer to data as defined under clause (o) of sub-section (1) of section 2 of the information technology act, 2000;30(g) "data controller" means a person who, either alone or jointly or in combination with other persons, determines the purposes for which and the manner in which any personal data are used, or are to be, processed;(h) "data processor" with respect to personal data means any person apart from an employee of a data controller, who processes data independently or on behalf of a data controller;35(i) "interception" or "intercept" means any activity intended to capture, read, listen to, record and/or copy communication of a person;58 of 1985 34 of 2008 40(j) "intelligence organisation" means institutions set-up under the intelligence organisations (restriction of rights) act, 1985, the national investigation agency act, 2008 and/or any other institution set up by the central government through an act of the parliament or the executive for the purpose of collection, monitoring, processing and/or analysis of information relevant to national security(k) "person" shall for the purpose of this act refer to an individual:45(1) "personal data" means any data or information which relates to a person if that person can, whether directly or indirectly in conjunction with any other data, be identified from it and includes sensitive personal data;(m) "prescribed" means prescribed by rules made under this act; (n) "processing" with respect to data, means obtaining or recording the information or data or carrying out any operation or set of operations on the information or data, whether or not by automatic means, including—(i) organisation, adaptation or alteration of the information, (ii) or data, (iii) retrieval, consultation or use of the information or data, (iv) disclosure of the information or data by transmission, disseminationor otherwise making available, or5(v) alignment, combination, blocking, erasure or destruction of theinformation or data10(o) "pseudo-anonymisation" means processing of personal data in such a manner that the personal data can no longer be attributed to a specific person without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable person;(p) "portability" refers to the extent to which data can be moved, copied, transferred or shared by any other means between different computers, computer networks, computer systems, and/or computer resource;15(q) "profiling" means any form of automated processing of personal data consisting of the use of personal data or information to record and classify behaviour of individuals to predict and analyse their daily activities for purposes other than promotion and marketing of goods and services;20(r) "surveillance" means any activity intended to collect, watch, monitor,intercept, or enhance the ability to do the same with a view to obtain information about a person, group of persons or class of persons through analysis of any communication, images, signals, data, movement, behaviour or actions;25(s) "sensitive personal data" means such personal information which consists of information relating to—(i) racial or ethnic origins, political or religious views; (ii) passwords; (iii) financial information such as bank account or credit card or debit cardor other payment instrument details or financial transactions records;30(iv) physical, physiological and mental health condition; (v) sexual activity; (vi) medical records and history;35(vii) biometric data relating to the physical, physiological or behaviouralcharacteristics of a natural person which allow their unique identification including, but not limited to, facial images, genetic information, fingerprints, hand prints, foot prints, iris recognition, hand writing, typing dynamics, gait analysis and speech recognition;(viii) any details relating to clauses (i) to (vii) above as provided to bodycorporates for providing service; and40(ix) any of the information received under clauses (i) to (vii) above bybody corporates for processing, stored or processed under lawful contract or otherwise:22 of 200545provided that any information that is freely and lawfully available or accessible inpublic domain or furnished under the right to information act, 2005 or any other law for the time being in force shall not be regarded as sensitive personal data for the purposes of this act; and(t) "third party" means any person public authority, agency or any other body other than the person whose data is collected or processed, the controller, the processor, and the persons who, under the authority of the controller or the processor, are authorized to process data or are recipients of the data so processedapplication53 (1) this act shall apply to—(a) collection, use, storage, disclosure and processing of personal data orinformation of all persons through wholly or partially automated or manual methods;10(b) data controllers and data processors which are state entities, includinggovernment agencies or authorised personnel on their behalf as well as private companies, partnerships or any other body corporate which conduct activities within the territory of india through a registered place of business or establishment, irrespective of whether data processing is carried out at such place or outside the territory of india; and159 of 1872(c) data controllers and data processors which are state entities, includinggovernment agencies or authorised personnel on their behalf as well as private companies, partnerships or any other body corporate which do not have a registered place of business or establishment in india and offer goods or services to persons in india, irrespective of consideration, as defined under the indian contracts act, 1872, being sought in lieu of such goods or services20(2) nothing in this act shall apply to collection or processing of data mentioned inschedule i:provided that the central government may, by notification in the official gazette,amend schedule i by way of addition and deletion of entries thereto :25provided further that every notification under sub-section (2) shall be issued afterconsultation with the authority and shall be laid before each house of parliament chapter ii right to privacy and data protectionright to privacy4 notwithstanding anything contained in any other law for the time being in force,pursuant to article 19 and 21 of the constitution and subject to the provisions of this act, all persons shall have a right to privacy30express consent5 (1) no person shall collect, store, process, disclose or otherwise handle any personaldata of another person, intercept any communication of another person or carry out surveillance of another person except in accordance with the provisions of this act35(2) for the collecting, processing, storing, disclosing and otherwise handling personaldata, express and affirmative consent has to be obtained from the requisite person after full disclosure of information as required under schedule ii of this act(3) consent under sub-section (2) shall be considered valid only if it is freely given,specific, informed and an unambiguous indication of a person's intention to allow collecting, processing, storing, disclosing and/or otherwise handling personal data40(4) notwithstanding the above, consent may be overridden in cases where there is alegal obligation or medical emergency which is fatal or may likely lead to permanent or irreversible bodily harm as well as the reasonable restrictions mentioned in section 15:provided that any consent may only be overridden to the extent necessary and theperson so affected shall be informed of the same45binding determination6 for the purposes of section 4, every person shall have the final and binding powerto determine the manner in which his personal data is to be dealt withperson to be duly informed7 every person shall be duly informed about the processing of information through issuance of a privacy notice which shall be concise, timely, updated, transparent, intelligible, written in clear and plain language (both english and vernacular language), be easily accessible and provided free of cost to persons with the information specified in schedule ii;5provided that where consent is being sought with regard to a written declaration/online form which contains other clauses and matters, the clauses or portions regarding the privacy notice should be clearly distinguishable from other clauses and mattersaccess to personal data108 every person shall have access to his personal data which is collected, processed, used or stored by data controllers and data processors, including the right to obtain a copy and obtain confirmation that his data is being processed along with any supplementary information corresponding to the information mandated under schedule ii of this actrectification of personal data9 (1) every person shall have the right to have his personal data rectified if it is inaccurate or incomplete15(2) every rectification under sub-section (1) shall be carried out by the datacontroller and/or data processor in the manner notified by the central government in consultation with the authority as it may deem appropriate:provided that every rectification shall be completed within a period of sixty days of receipt of data for rectification20(3) any person who collects, receives, stores, processes or otherwise handles anypersonal data of another person shall, to the extent possible, ensure that it is not inaccurate or misleading and, where necessary, is kept up to date25(4) no person who collects, receives, stores, processes or otherwise handles any personal data shall deny, to the person to whom any personal data so collected, received, stored, processed or otherwise handled pertains, the opportunity to review it and, where necessary, rectify anything that is inaccurate, misleading or not up to dateseeking removal of personal data10 (i) every person shall have the right to seek removal of personal data from data controller—30(a) where personal data is no longer necessary with regard to the purpose for which it was originally collected or processed; or(b) where the person withdraws consent; or (c) where personal data has been obtained unlawfully; or (d) where personal data is required to be erased in accordance with a legalobligation pursuant to a court order35(2) notwithstanding anything contained in sub-section (1), removal of personal datashall not be allowed if there are overriding legitimate interests and it is necessary—(a) in the interest of fundamental rights; (b) for compliance of a legal obligation or court order or an any actiontaken by an officer in exercise of the power vested in him;40(c) for establishing or defending a legal claim; (d) to safeguard public interest illustration45if a, a convicted sex offender, seeks removal from the online sex offender registry maintained by the government, the same shall be disallowed in light of the overriding public interest of safety of women and childrenrestrict processing11 (1) during the pendency of consideration of request for removal of specific personaldata, the data controller and data processor shall restrict processing of the specific personal data of the person5(2) it is hereby clarified that sub-clause (1) shall not restrict the collection/storage ofpersonal datadata portability12 every person shall, as and when required, receive the personal data concerninghim, which he has provided to a data controller, in a structured, commonly used and machine-readable format and have the right to data portability to another data controller without any hindrance10breach of personal data13 every person shall have the right to be duly and promptly informed, within sevendays about any unauthorized access, destruction, use, processing, storage, modification, de-anonymisation, unauthorized disclosure (either accidental or incidental) or other reasonably foreseeable risks or data security breaches of pertaining to their personal data15legitimate expectation of due diligence14 (1) every person at the stage of giving consent for collection, processing, use orstorage shall be have a legitimate expectation that data controllers and data processors shall abide by the provisions of this act(2) data controllers and/or data processors shall take all security measuresnecessary for safeguarding and securing the personal data in their custody with due diligencereasonable restrictions2015 notwithstanding anything contained in this act, the right to privacy shall berestricted by the authority in the manner specified by this act for—(a) reasonable safeguards for sovereignty or integrity of india, national securityand for the defence of country;(b) prevention of suspected acts of terrorism, corruption, money laundering,organised crime, sale or purchase of narcotic and psychotropic substances;2545 of 1860 2 of 1874(c) investigation of cognisable and non-bailable offences under the indian penalcode 1860 after a report has been duly filed under section 154 of the criminal procedure code, 1973;45 of 186030(d) investigation of any other offences under the indian penal code, 1860, orany other act for the time being in force, after an appropriate order has been obtained from the requisite judicial authority with regard to existence of probable cause andproviding a fixed time-frame for such collection or processing; and(e) maintenance of public order in situations of imminent danger of breakdown: provided that the above restrictions must be adequate, relevant, proportionate,not excessive in nature and must be imposed in the manner prescribed35 chapter  iii methods and principles of data collection and processing16 (1) no personal data shall be collected, processed, stored, accessed or monitored without prior express consent of the person directly affected by such actcollection and processing etc of personal data with prior consent40(2) consent should be express, affirmative and taken after information as mandated under schedule ii has been provided to the person in a manner which is clearly distinguishable, concise, timely, updated, transparent, intelligible, written in clear and plain language (both english and vernacular language):45provided that every person subject to data collection shall be duly informed and be provided fair opportunity or mechanism to revoke consent at any time often has consent to the collection of personal data has been obtained:provided further that where the purpose of processing of data are changed or added or varied in any manner whatsoever, such additional data collection or processing which is in variance of the initial purpose shall not be done without the prior consent of the person5(3) it shall be the duty of the data processor or controller to duly provide informationand adequate explanation to the person while taking consent about the manner and extent to which personal data shall be accessed, collected, stored or processedexplanation—for the purposes of this section "consent" shall have the same meaning and safeguards as provided under the indian contracts act, 1872| 9 of 1875                                                                               ||------------------------------------------------------------------------------------------|| 17                                                                                      || (                                                                                        || 1                                                                                        || ) notwithstanding anything contained in section 16, where the personal data              || belongs to a minor as per the indian majority act 1875, the consent of minor shall be—   || (                                                                                        || a                                                                                        || ) obtained from a legal guardian; and                                                    || special                                                                                  || provisions for                                                                           || consent in                                                                               || case of minors                                                                           || and persons                                                                              || with disability                                                                         || (                                                                                        || b                                                                                        || ) duly verified by the data controllers and processors:                                  || provided that upon attaining majority, the minor shall have the right to either continue || or terminate the consent given by the legal guardian on his behalf                      || 15                                                                                       || (                                                                                        || 2                                                                                        || ) in the case of differently abled persons, the data controllers and data processors     || shall make special provisions for providing privacy notices and obtaining consent in     || accordance with accepted standards and as per directions of the authority               || purpose of data                                                                          || collection and                                                                           || processing                                                                              || 20                                                                                       || 18                                                                                      || (                                                                                        || 1                                                                                        || ) every data controller and data processor must duly notify every person of the          || purpose for which data is collected, accessed or processed in a comprehensive format and || with the adequate information as provided under schedule ii of the act:                  |provided that in case of multiple purposes, each purpose shall be displayed separately and the ramifications thereof shall be provided to the person at the time of taking his consent25(2) no personal data shall be collected, accessed or processed unless deemed necessary for achievement of the purpose specified under sub-section (1) and connected to the stated function:provided that if any other personal data is collected it shall be marked as "optional"30(3) any additional or further processing of personal data for archiving or scientific or historical or statistical research, shall not be considered incompatible with the initial purpose if it is,—(a) bona fide; (b) in public interest; and(c) subject to adequate safeguards3519 personal data of a person with his consent may be collected or processed lawfully,if—collection or processing of personal data(a) necessary for performance of a contract or at a stage immediately prior toentering into a contract;(b) required in furtherance of a legal obligation; (c) in case of a person's medical emergency;40(d) necessary for administration of justice pursuant to a court order: (e) required for performance of any statutory, governmental or other functionsby data processor or controller as duly specified to the person subject to data collection;(f) necessary for the legitimate interests pursued by data controller or processoror the third party to whom data is disclosed after it is duly informed to the person:provided that the interests of data processors or controller or third parties shall be adequately balanced against any prejudicial effect of the same on the rights and freedoms of the person as guaranteed under this act and under the constitution of india; and5(g) required for any other purpose as may be notified by the central government in consultation with the authority, from time to time20 notwithstanding anything contained in section 16 or section 19 of this act,special provisions for sensitive personal data10(1) sensitive personal data shall not be processed unless express, affirmative and explicit written consent of the person subject to data collection has been obtained through letter or fax or email from the said person(2) no sensitive personal data under sub-section (1) shall be processed for any purpose apart from for the specific purpose for which it was collected and/or implementation of welfare schemes and social protection laws15(3) if sensitive personal data has been collected by various government agencies, institutions, authorities or private companies, partnerships or any other body corporate for a specific purpose or as a part of a statutory or legal requirement and any form of collaborating, converging or monitoring between or individually by entities shall be expressly barred if it amounts to or reasonably lead to —20(a) individual profiling except for circumstances of reasonable restriction as mentioned under section 15 of this act; or(b) mass profiling or profiling of certain group or class of persons without any lawful reason or adequate basis; or(c) unlawful access by third parties25(4) it shall be the duty of the data controller or processor, as the case may be, to ensure that the sensitive personal data is collected, stored or processed, in accordance with this act with reasonable advanced security measures and safeguards to ensure the safety of such data chapter  iv transfer, storage and security of personal data3021 no personal data shall be shared in contravention of the provisions of this actprohibition on sharing of personal data retention of personal data22 no personal data shall be retained after the achievement of purpose for which it was collected and has been duly completed up to the satisfaction of all parties:provided that nothing in this section shall apply to databases of sensitive personal data duly established by the central government or state government, as the case may be3523 (1) no person shall store any personal data of another person for a period longer than is necessary to achieve the purpose for which it was collected or received, or, if that purpose is achieved or ceases to exist for any reason, for any period following such achievement or cessationprohibition on prolonged or unnecessary storage of personal data40(2) save as provided in sub-section (3), any personal data collected or received in relation to the achievement of a purpose shall, if that purpose is achieved or ceases to exist for any reason, be destroyed forthwith(3) notwithstanding anything contained in this section, any personal data may be stored for a period longer than is necessary to achieve the purpose for which it was collected or received, or, if that purpose has been achieved or ceases to exist for any reason, for any period following such achievement or cessation, if —(a) the person to whom it pertains grants his consent to such storage prior to the purpose for which it was collected or received being achieved or ceasing to exist; or5(b) it is required to be stored for historical, statistical or research purposes underthe provisions of an act of parliament:provided that only that amount of personal data that is necessary to achieve the purpose of storage under this sub-section shall be stored and any personal data that is not required to be stored for such purpose shall be destroyed forthwith10| transfer         ||------------------|| personal data to || third parties   |24 any transfer of personal data to a third party shall be done pursuant to takingexpress, affirmative consent under section 16 of this act and after adequately informing them of the ramifications thereof in a comprehensive manner the requirements specified under section 7 of this act:15provided that any transfer of data to third parties shall be done only after ensuringthat the third parties' privacy policies and security standards are in no way less privacy preserving than that of the transferring partycross-border transfer ofpersonal data25 any cross border transfer of personal data shall be done pursuant to taking express, affirmative consent under section 16 of this act and after adequately informing them of the ramifications thereof in a comprehensive manner the requirements specified under section 7 of this act:20provided that any cross border transfer of data to any entity or person outside theterritory of india shall be done only after ensuring that the privacy policies and security standards followed by such entity are in no way less privacy preserving than those prescribed under this actpseudoanonymisation2526 for collecting, processing, storing, disclosing and/or otherwise  handling personaldata, pseudo - anonymisation shall be encouraged as far as possiblenotification of breach3027 it shall be the duty of the data controller and data processor, as the case may be,in case of any breach, unauthorized access, destruction, use, processing, storage, modification, de-anonymisation, unauthorized disclosure (either accidental or incidental), or other reasonably foreseeable risks of personal data, to notify to the person who is the subject of such personal data as well as the authority and take adequate steps to mitigate any harm or damage of the data security breach within seven dayssecurity protocol3528 it shall be the duty of the data controller and processor, as the casemay be,to maintain adequate security measures and safeguards in accordance with the nature and form of security protocol as notified by the central government in consultation with the authority, from time to time chapter v obligations of data controller and processors4029 (1) it shall be the duty of the data controller or processor, as the case may be to collect, store, access or process the personal data in a fair, lawful and transparent manner and in compliance with the provisions of this actcollection, etc of data in a fair, lawful andtransparent(2) any personal data obtained in contravention of sub-section (1) shall be deemed to be unlawfully obtained4530 it shall be the duty of the data controller or processor or third party, as the case may be, to ensure that all personal data is reasonably shared only when it is necessary, while maintaining confidentiality and in compliance with the provisions of this actresponsibility of sharing and use of personal data fortification of data security31 it shall be the duty of the data controller or processor or third party, as the case may be, to take adequate measure for fortification of data security against unauthorised or unlawful access or use, accidental loss, damage, or  any form of cyber-attacks:provided that in the case of a breach of data, it is the duty of the data controller or processor or third party to notify the affected persons within seven days of the occurrence of the breach as well as take adequate measures to mitigate any harm or damage:5provided further that the burden of proof to substantiate that adequate measures arein accordance with the provisions of this act, shall lie on the data controller or processor or third party, as the case may bemaintenance of accurate records32 it shall be the duty of the data controller or processor or third party, as the casemay be, to maintain accurate records of data collected, accessed, stored and processed along with record of consent obtained as per the provisions of this act10criminal liability33 where a data controller or data processor or third party, as the case may be, hascommitted an offence under chapter 8 which is punishable with imprisonment, every person in-charge of and responsible for the conduct of business shall, irrespective of direct commercial or financial benefit, incur criminal liability and be punished accordingly:15provided that nothing contained in this section shall render any such person incharge liable to any punishment, if he proves to the satisfaction of the authority that such offence was committed without his knowledge or that he had exercised all due diligence to prevent the commission of such offenceappointment of data protection officer2034 (1) every data controller or processor or third party, as the case may be, shallappoint a data protection officer having adequate technical expertise in the field of data collection or processing and the ability to address any requests, clarifications or complaints made with regard to the provisions of this act:25provided that the data controllers and processors employing less than live hundred people and having a per capita turnover of less than one crore rupees may jointly appoint a data protection officer, for resolving or addressing any requests, clarifications or complaints made herein in collaboration with other bodies with similar size or turnover(2) no additional fee shall be charged for resolving or addressing any requests,clarifications or complaints made herein35 (1) the data protection officer shall—role of data protection officer(a) act as an independent person;30(b) address requests, clarifications or complaints made in writing, includingthrough electronic form, by any aggrieved person or legal representative thereof;(c) take steps to initiate an inquiry and commence proceedings within sevendays of receiving the complaint;(d) resolve the matter within ninety days of receipt of complaint;35(e) recommend the data controller or processor to take action; and (f) record the proceedings, the results thereof and the reasons for arriving at thedecision in writing40(2) in cases where the data protection officer has not been appointed or is unable to or does not adequately resolve the complaints within the stipulated period of ninety days, the complainant may approach the data privacy authority for redressal of complaints chapter  vi surveillancebar against surveillance36 except for the manner provided in this act and the rules prescribed thereto, no person shall conduct or assist in conducting any surveillance of another person37 any person except a public servant or authority duly authorised by the central government to order or conduct surveillance or to assist in pending investigation by the competent authority shall be expressly barred from initiating, assisting, conducting or abetting any act of surveillance under this actsurveillance by private companies, partnerships or any other body corporate5surveillance by the state38 (1) the state has the power to collect, process, monitor and intercept personal datain accordance to the reasonable restrictions provided under section 1510(2) any officer authorised by the central government, on the basis of information received or lawfully discovered by police, armed forces, intelligence organisation or any public official, if satisfied that the information sets out a reasonable threat to sovereignty, integrity, national security or defence of public order, he may forward the same to the concerned intelligence organisations15(3) the concerned intelligence organisation shall, on receipt of information mentioned under sub-section (2), if deem necessary, seek an order from the authority who may either reject or issue an order allowing surveillance or interception of personal data for reasons recorded in writing and addressed to concerned organisation:provided that the every case referred to the authority under this section shall be processed and an appropriate order shall be passed within a period of sixty days of receipt of the case:20provided further that the order should specify the communications or class of communications to or from the persons or class of persons that shall be subject to the order(4) for the purpose of sub-section (2), a special division shall be set up by the central government for assistance of the authority for determination of the cases referred:25provided that prior to issuing the order, the authority shall satisfy itself that all other lawful means to acquire the information sought to be intercepted has been exhausted and that the proposed interception is reasonable, proportionate and not excessive30(5) the special division set up under section (4) shall have the power to conduct preliminary investigation in the manner as prescribed by the central government, from time to time, submit their findings to the authority who shall thereafter issue a detailed order to the intelligence organisation:provided that in case of military intelligence, which appears to be inaccessible or sensitive and/or confidential, the authority shall consult the cabinet secretary, government of india for the purposes of issuance of order under this section35(6) after, receipt of order from the authority the intelligence organisation shall conduct surveillance in accordance to the express conditions provided in the orderduration of surveillance39 every order issued under section 38 shall specify the time period for carryingout the surveillance by the intelligence organisation of the personal data:provided that if any extension is required for the surveillance, the intelligenceorganisation shall approach the authority along with reasons for such extension40security and duty of confidentiality and secrecy40 every state authority, intelligence organisation or private companies, partnershipsor any other body corporate shall, as the case may be, which participate, assist, co-operate, conduct or carry out activity to facilitate surveillance pursuant to provisions of this chapter, take reasonable steps to ensure security of the data so collected and maintain the confidentiality and secrecy thereof45admissibility in court41 if at any stage, information or personal data obtained through surveillance isrequired to be produced in a court of law, the onus to prove that the same has been collected in accordance with the provisions of this act while maintaining a proper chain of custodywithout any tampering or external interference shall be on the concerned state authority, intelligence organisation or private entity, as the case may beno targeted individual profiling542 any targeted profiling of individuals or of a certain section or class of personswithout any basis and harassment, whether physical or financial or other means, shall be expressly barred and be deemed as violation of privacy under this actstorage of surveillance1043 no information or personal data that is collected in the process of surveillancewhich is not relevant for the purposes of evidence or for continuing investigation by the intelligence organisations shall not be stored by or accessible to the intelligence organisations after a period of expiry of one year from the date on which the order under which the information was obtained chapter  vii data privacy authorityconstitution of data privacy authority1544 the central government shall, by notification in the official gazette, constitute anauthority to be known as the data privacy and protection authority for carrying out the purposes of this act in such manner as may be prescribed45 (1) the central government shall, in consultation with the chief justice of india,appoint a chairperson and other members to the authority in such manner as may be prescribedappointment of chairperson and other members to the authority20(2) the authority shall constitute of judicial members as well as technical members inequal proportion(3) a judicial member shall otherwise be qualified to be a high court judge or havebeen a member of the indian legal services and have held a post in grade i of that service for at least three years25(4) a technical member shall have expertise, special knowledge of and adequateprofessional experience in technology and processing/collection of data(5) the chairperson of the authority shall be the senior-most judicial memberconstitution of benches46 (i) subject to the provisions of this act, the authority may, by notification in theofficial gazette, constitute benches to exercise the jurisdiction, powers and authorityconferred to under this act30(2) each bench shall consist of at least one judicial and one technical member of theauthority to be decided by chairperson in such manner as may be prescribed(3) the benches of the authority shall sit at new delhi and at such other places as the central government may, in consultation with the chairperson of the authority, by notification in the official gazette, specify35(4) the central government shall, by notification in the official gazette, specifythe areas in relation to which each bench of the authority may exercise its territorial jurisdiction40(5) notwithstanding anything contained in sub-section (3), the chairperson of the authority may transfer a member from one bench to another bench for carrying out the purposes of this act in such manner as may be prescribed(6) if at any stage of the hearing of any case or matter it appears to the chairperson or a member of the authority that the case or matter is of such a nature that it ought to be heard by a bench consisting of more members, the case or matter may be transferred by the chairperson to such bench as the chairperson may deem fit47 (1) the chairperson and every member of the authority shall hold office for a period of five years or till the age of sixty-five years whichever is earlier:provided that no member shall be elected for more than two consecutive termsterms of office, conditions of service, removal of chairperson and members(2) the central government shall remove a person from the office of chairperson or member, as the case may be, if that person—5(i) has been adjudged as insolvent; (ii) has been convicted of an offence of moral turpitude or any other offence asmay be deemed appropriate and notified by the central government:(iii) has become physically or mentally incapable of acting as a member;10(iv) has acquired such financial or other interest as is likely to prejudicially affectcompletion of duties;(v) has abused his position in such a manner that continuance in office shall be prejudicial to public interest: provided that no person shall be removed under this sub-section unless he has been given a reasonable opportunity of being heard in the matter15 (3) the salary and allowances payable to and other terms and conditions of service of chairperson and members of the authority shall be such as may be prescribedprocedure and powers of the authority5 of 19082048 (1) the authority shall not be bound by the procedure laid down by the code of civil procedure, 1908, but shall be guided by the principles of natural justice and, subject to the other provisions of this act and of any rules(2) the authority shall have power to regulate its own procedure including the place at which it shall have its sittings5 of 190825(3) the authority shall have, for the purposes of discharging its functions under this act, the same powers as are vested in a civil court under the code of civil procedure, 1908, while trying a suit, in respect of the following matters, namely:(a) summoning and enforcing the attendance of any person and examining himon oath;(b) requiring the discovery and production of documents or other electronicrecords;30(c) receiving evidence on affidavits: (d) issuing commissions for the examination of witnesses or documents; (e) calling upon any data processor or data controller at any time to furnish inwriting such information or explanation as may be deemed necessary;(f) hearing and deciding matters where criminal liability is involved with respectto the provisions of this act;35(g) issuing an order for search and seizure pursuant to a complaint or suo-motoif there is prima facie evidence of contravention or violation of this act;(h) reviewing its decisions; (i) dismissing an application for default or deciding it ex parte; and40(j) any other matter which may be prescribed49 the authority shall,—functions of the bench(a) adjudicate all disputes and contraventions of the provisions of this actreferred to it, impose penalties and punishments thereof;5(b) study and undertake impact assessment of bills tabled before each house ofparliament, existing legislation, ordinances and rules pertaining to the subject matter of this act as it deems necessary and make recommendations to the concerned ministry;(c) consult with stakeholders on any issues pertaining to the subject matter ofthis act which are of public importance;10(d) consult with the central government according to the provisions of this act;and(e) suo-moto initiate inspection of data controllers and data processors toassess compliance with the provisions of this actfiling of complaints1550 any person aggrieved by the decision of the data protection officer or notreceived any adjudication despite lapse of ninety days may file a written complaint with regard to non-compliance, contravention or any other violation of this act before the authority:provided that where the data protection officer is not appointed, the person maydirectly approach the authority20issuance of orders51 the bench shall upon adjudicating the complaints referred to in section 50 awardfines, call for directive or injunctive measures, compensation and/or imprisonment of such term as it may deem appropriateappeal2524 of 199752 an appeal against the decision of the bench shall lie to the telecom disputessettlement appellate tribunal set up in accordance with the provisions of the telecom regulatory authority act, 199753 no civil court have jurisdiction to entertain any suit or proceedings in respect ofany matter dealt with under the provisions of this actcivil court not to have jurisdiction chapter viii offences and penalties30punishment for offences related to personal data54 whoever, except in compliance with the provisions of this act, collects, stores,receives, processes, publishes or otherwise handles personal data shall be punishable with a term of imprisonment for a term which may extend up to five years and fine which may extend up to rupees fifty thousand for each day of unlawful access to the personal data:35provided that where any offence under this act has been committed by a company andit is proved that the offence has been committed with the consent or connivance of, or is attributable to any neglect on the part of any director, manager, secretary or other officer of the company, such director, manager, secretary or other officer shall be deemed to be guilty of that offence, and shall be liable to be proceeded against and punished accordingly40punishment for offences related to sensitive personal data4555 whoever, except in compliance with the provisions of this act, collects, stores,receives, processes, publishes or otherwise handles sensitive personal data shall be punishable with a term of imprisonment which may extend up to ten years and fine which may extend up to rupees one lakh for each day of unlawful access to the personal data and shall also be required to provide adequate compensation to the person whose sensitive personal data has been breached to be determined by the authority in such manner as may be prescribed| breach                                                                                    ||-------------------------------------------------------------------------------------------|| confidentiality                                                                           || and security in                                                                           || certain cases                                                                            || 56                                                                                       || whoever breaches confidentiality or compromises security of any personal data             || being collected as a part of surveillance authorised under this act shall be liable to be || punished with a term of imprisonment which may extend up to ten years and/or fine which   || may extend up to rupees fifty thousand for each day of said breach                       || 5                                                                                         || 57                                                                                       || whoever has been victim of profiling and harassment, whether physical or financial        || under section 42 shall be entitled to adequate compensation for financial loss and mental || trauma in such manner as may be prescribed                                               || compensation                                                                              || in case of                                                                                || harassment                                                                                || and profiling                                                                            || penalty for                                                                               || contravention                                                                             || of directions                                                                            || 10                                                                                        || 58                                                                                       || any wilful non-compliance of a direction or order of the bench shall be punishable        || with imprisonment for a term which may extend upto six month and fine which may extend    || upto rupees fifty thousand for each day of said breach                                   || cognizance                                                                               || 2 of 1974                                                                                || 59                                                                                       || notwithstanding anything contained in the code of criminal procedure, 1973,               || the offences under this chapter shall be treated as cognizable                           | chapter  ix miscellaneous15protection of action taken in good faith60 no suit or other legal proceeding shall lie against the central government, stategovernment, chairperson or member of the authority, or any person acting under the direction either of the central government, state government, chairperson or member of the authority, as the case may be, in respect of anything which is in good faith done or intended to be done in pursuance of this act or of any rules or any order made thereunder20power to remove difficulties61 if any difficulty arises in giving effect to the provisions of this act, the centralgovernment may, by order, published in the official gazette, make such provisions, not inconsistent with the provisions of this act, as appears to it to be necessary or expedient for removing the difficulty:25provided that no such order shall be made under this section after the expiry of aperiod of three years from the commencement of this actoverriding effect24 of 1997 21 of 200062 the provisions of this act shall have overriding effect over the telecom regulatoryauthority act, 1997 the information technology act, 2000 or any other legislation pertaining to collection, processing, interception and monitoring of personal datapower to make rules3063 (1) the central government may, by notification in the official gazette, make rulesfor carrying out the purposes of this act35(2) every rule made under this act shall be laid, as soon as may be after it is made, before each house of parliament, while it is in session, for a total period of thirty days which may be comprised in one session or in two or more successive sessions, and if, before the expiry of the session immediately following the session or the successive sessions aforesaid, both houses agree in making any modification in the rule or both the houses agree that the rule should not be made, the rule shall thereafter have effect only in such modified form or be of no effect, as the case may be; so, however, that any such modification or annulment shall be without prejudice to the validity of anything previously done under that rule schedule i [see section 3(2)] exceptionsthis act shall not apply to collection or processing of data which falls within the following categories—1 purely for personal reasons or pertaining to household activities; 2 of a deceased person; 3 eligible to be disclosed under the right to information act, 2005; and 4 that is anonymised and cannot be used to identify the natural person schedule ii [see section 3] privacy noticeany privacy notice published under this act must contain the following ingredients—(a) what personal data or information is being collected;(b) the purposes of the processing; (c) the categories of personal data concerned;(d) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations along with the safeguards thereof;(e) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;(f) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;(g) the right to lodge a complaint with the competent authority; (h) where the personal data are not collected from person, any available information as to their source(i) the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the person statement  of  objects  and  reasonswhile right to life and personal liberty are granted under article 21 of the constitution of india, our jurisprudence, judicial pronouncements and case laws have extended it to encompass inter alia, a life of dignity however, there is no express statutory grant of right to privacythe hon'ble supreme court has recognised the right to privacy in a limited and reasonable manner with the landmark case of kharak singh v the state of up it has further expounded on the principle and safeguards thereof in various landmark cases such as pucl v union of india and selvi v union of india, delineating the extent of the right to privacy in communications and the right to withhold consent to certain privacy violations, respectivelywith the increased proliferation of technology in daily lives, it is becoming increasingly important for us to recognise and implement a meaningful right to privacy as also recognised by the special rapporteur on the right to privacy, office of the high commissioner for human rights further, india has globally, as a party to the universal declaration of human rights (udhr), and the international covenant for civil and political rights (iccpr), acknowledged the right to privacy as an universal human right under article 12 of the udhr and article 17 of the iccpron one hand, there is significant success of aadhaar, which is the largest biometric database in the world, as a means to implement social welfare schemes and serves as a tool for financial inclusion on the other hand, there is reasonable apprehension as to the security of the information contained in the database and during any information transmission as a part thereoftoday, personal data is being collected and processed at a much larger scale that is not limited to aadhaar; every application and website we use collects and processes our personal data our personal data is vulnerable to any non-state actor, private entity around the globe with the technological know-how to access and process this data unlawfully it may be utilised by non-state actors to target indian citizens through cyberattacks for financial gains as well as to profile the interests of any person ready availability and accessibility of personal data can also assist terror groups or religiously extreme groups in profiling, propagating extremist ideology and preying on young, poor and destitutethe present bill is an effort to avoid situations like a country-wide hack like in the case of estonia in 2007 and the recent global ransomware attack `wannacry' in 2017 globally, data is being considered the new oil and in the coming years, our international trade and economic relations will depend on the health and bargaining power of our data economy hence it is timely to address the issue on data protection and protect the privacy of all persons it intends to provide rights of persons vis-a-vis their own information, as well as procedures for data collection, data processing, reasonable and targeted surveillance, and means of redress in case of breaches and violationsin light of this, while the collection and processing of data is important, there is an overwhelming need to secure personal data and ensure better security by creating a statutory obligation to safeguard data and individuals to that effect, this bill seeks to establish inter alia, a balance between rights of individuals and legitimate intervention by the statethe bill seeks to codify and safeguard the right to privacy for all juristic persons in the digital age, balanced with the need for data protection in the interests of national securityhence this billnew delhi;baijayant pandaapril 7, 2017 financial memorandumclause 34 of the bill provides for appointment of data protection officer clause 44provides for establishment of the data privacy authority for carrying out the purposes of this act clause 45 provides for the appointment of a chairperson and other members to the authority clause 46 provides for constitution of benches by the authority the bill, therefore, if enacted would involve expenditure from the consolidated fund of india it is estimated that a sum of about rupees ten crores would involve as recurring expenditure per annum from the consolidated fund of indiaa non-recurring expenditure of about rupees fifty crores is also likely to be involved out of the consolidated fund of india memorandum regarding delegated legislationclause 63 of the bill empowers the central government to make rules for carrying out the purposes of the act as the rules will relate to matters of detail only, the delegation of legislative power is of a normal character———— a billto codify and safeguard the right to privacy in the digital age and constitute a data privacy authority to protect personal data and  for matters connected therewith————gmgipmrnd—889ls(s3)—10072017