 bill no 161 of  2017 the data privacy and protection bill, 2017 by dr shashi tharoor, mp a billto establish an effective regime to protect the right to privacy of data all naturalperson; to set out conditions of surveillance and interception of communicationsof natural persons; and to constitute a privacy commission and for mattersconnected therewith or incidental theretowhereas the right to privacy is an inalienable right of all persons; and whereas the need to protect privacy has increased in the digital age with the emergence of big data analytics;and whereas the delivery of goods and provision of services requires the collection, storage, processing and disclosure including international transfers of personal data;and whereas good governance requires that all interceptions of communications and surveillance must be conducted in a systematic and transparent manner subservient to the rule of law;and whereas it is necessary to harmonise any conflicting interests and competing legislations;now, therefore, it is expedient to provide for an enforceable means to protect the privacy of persons;be it enacted by parliament in the sixty-eighth year of the republic of india as follows— chapter i preliminary51 (1) this act may be called the data privacy and protection act, 2017short title, extent and commencement(2) it extends to the whole of india and, save as otherwise provided in this act, it shall also apply to any offence or contravention hereunder committed outside india by any person(3) it shall come into force on such date as the central government may, by notification in the official gazette, appoint10definitions2 (1) in this act unless the context otherwise requires, —(a) "anonymise" means, in relation to personal data, the encryption or removalof all data that may, whether directly or indirectly in conjunction with any other data, be used to identify a natural person or data subject;15(b) "appropriate government" means, in relation to the central government or aunion territory administration, the central government; in relation to a state government, that government of that state; and, in relation to a public authority which is established, constituted, owned, controlled or substantially financed by funds provided directly or indirectly:20(i) by the central government or a union territory administration, thecentral government;(ii) by a state government, the government of that state;25(c) "armed force" means any body raised or constituted pursuant to or inconnection with, or presently governed by, the army act, 1950, the indian reserve forces act, 1888, the territorial army act, 1948, the navy act, 1957, the air force act, 1950, the reserve and auxiliary air forces act, 1952, the coast guard act, 1978 or the assam rifles act, 2006;30(d) "authorised officer" means a gazetted officer of an all india service or acentral civil service, as the case may be, who is empowered by the central government, by notification in the official gazette, to intercept a communication of another person or carry out surveillance of another person under the provisions of this act;(e) "biometric data" means any data relating to the physical, physiological orbehavioural characteristics of a natural person which allow their unique identification including, but not restricted to, facial images, fingerprints, hand prints, foot prints, iris recognition, hand writing, typing dynamics, gait analysis and speech recognition;35(f) "chief privacy commissioner" and "privacy commissioner" mean the chief privacy commissioner and privacy commissioner, respectively appointed under section 33;40(g) "collect", with its grammatical variations and cognate expressions, means, in relation to personal data, any action or activity that results in a data controller, police force, armed force, intelligence organisation, public authority, company, person, state or other entity (natural or otherwise) obtaining, or coming into the knowledge or possession of, any personal data of another person;(h) "communication" means words, signs, gestures, spoken, written or indicated, in any form, manner or language, encrypted or unencrypted, meaningful or otherwise,45and includes visual representations of words, ideas, symbols and images, and the meta data in relation whether transmitted or not transmitted and, if transmitted, irrespective of the medium of transmission;(i) "competent organisation" means an organisation or public authority listedunder schedule to this act;5(j) "consent" means an unambiguous indication of a data subject's agreement tothe collection, processing, use or dissemination of personal data relating to him or her10(k) "data controller" means a person who, either solely, or jointly or in combinationwith other persons, determines the purposes for which and the manner in which any personal data is processed;(1) "data processor" means a person who processes any personal data on behalfof a data controller;(m) "data subject" means a natural person who is the subject of personal data;15(n) "deoxyribonucleic acid data" means all data, of whatever type, concerningthe characteristics of a natural person that are inherited or acquired during early prenatal development;(o) "destroy", with its grammatical variations and cognate expressions, means,in relation to personal data, to cease the existence of, by deletion, erasure or otherwise, any personal data;20(p) "disclose", with its grammatical variations and cognate expressions, means,in relation to personal data, any action or activity that results in a person coming into the knowledge or possession of any personal data of another person;25(q) "intelligence organisation" means an intelligence organisation under theintelligence organisations (restriction of rights) act, 1985 and includes the national investigation agency constituted under sub-section (1) of section 3 of the national investigation agency act, 2008 and the central bureau of investigation constituted under the delhi special police establishment act, 1946;(r) "interception" or "intercept" means any activity intended to capture, read,listen to or understand the communication of a person;30(s) "officer-in-charge of a police station" shall have the meaning ascribed to itunder clause (o) of section 2 of the code of criminal procedure, 1973(t) "person" means and includes a natural person, a company, a firm, anassociation of persons or a body of individuals, whether incorporated or not;35(u) "personal data" means any data which relates to a natural person if thatperson can, whether directly or indirectly in conjunction with any other data, be identified from it and includes sensitive personal data:provided that the term "personal data" shall not include data which is amatter of public record except details of victims in cases of sexual assault, kidnapping or abduction (v) "police force" means—40(i) anybody raised or constituted by the appropriate government for thepreservation of law and order and enforcement of laws related to customs, revenue, foreign exchange, excise, income tax and narcotics;45(ii) the bodies raised or constituted pursuant to or in connection with, orpresently governed by, the police act, 1861, the central reserve police force act, 1949, the border security force act, 1968, the indo-tibetan border police force act, 1992, the sashastra seema bal act, 2007, the central industrial securityforce act, 1968, the railway protection force act, 1957 and the national security guard act, 1986; or5(iii) the bodies raised or constituted pursuant to or in connection with, or presently governed by, the delhi special police establishment act, 1946, the income tax act, 1961, the national investigation agency act, 2008 and the central vigilance commission act, 2003; or(iv) any police forces raised or constituted by the states, armed or otherwise; (w) "prescribed" means prescribed by rules made under this act;10(x) "privacy commission" means the privacy commission constituted under sub-section (1) of section 33;(y) "privacy officer" means the privacy officer designated under sub-section(3) of section 22 and sub-sections (3) and (4) of section 3015(z) "process", with its grammatical variations and cognate expressions, means, in relation to personal data, any action or operation which is performed upon personal data of another person, whether or not by automated means including, but not restricted to, organisation, structuring, adaptation, modification, retrieval, consultation, use, alignment or destruction;(za) "public authority" shall have the meaning ascribed to it under clause (h) of section 2 of the right to information act, 2005;20(zb) "receive", with its grammatical variations and cognate expressions, means, in relation to personal data, to come into the knowledge or possession of any personal data of another person;(zc) "sensitive personal data" means personal data or metadata including—25(i) biometric data; (ii) deoxyribonucleic acid data; (iii) sexual preferences and practices; (iv) medical history and health;(v) political affiliation;30(vi) ethnicity, religion, race or caste; and (vii) financial and credit information, including financial history andtransactions35(zd) "store", with its grammatical variations and cognate expressions, means, in relation to personal data, to retain, in any form or manner and for any purpose or reason, any personal data of another person; and40(ze) "surveillance" means any activity, directly or indirectly intended to watch, monitor, record or collect, or to enhance the ability to watch, record or collect, any information, images, signals, data, movement, behaviour or actions, of a person, a group of persons, a place or an object, for the purpose of obtaining information of a person, but does not include collection of personal data under sections 7 and 8 of this act (2) all other expressions used herein shall have the meanings assigned to them under the general clauses act, 1897 or the code of criminal procedure, 1973, as the case may be3 in exercising the powers conferred by this act, regard shall be had to the following considerations, namely: —principles applicable to protecting privacy(a) that personal data with its attributes belongs solely to the person to whom it pertains;5(b) that personal data is required by governments and commercial serviceproviders and others to enable good governance and the delivery of goods and provision of services without undue delay which may be provided by a meaningful, revocable notice and consent framework;(c) that the right to privacy is recognised as a fundamental human right by various international treaties to which india is a party;10(d) that intrusions into privacy need always be measured by principles of necessity and proportionality;(e) that the right to privacy is a fundamental right essential to the maintenance of a democratic society; and15(f) that privacy must be upheld by a competent authority that is independent,impartial, well resourced and free from unwarranted influence chapter ii right to privacyright to privacy204 (1) without prejudice to the generality of the provisions contained herein, all natural persons shall have a right to privacy which shall be implemented subject to provisions of section 3(2) for the purpose of sub-section (1) no person shall collect, store, process, disclose or otherwise handle any personal data of a natural person, intercept any communication of another person, or carry out surveillance of another person except in accordance with the provisions of this act25exemptions5 nothing in this act shall apply to—(a) the collection, storage or processing by a person of their own personal data for personal or family use; or(b) surveillance by a resident of their own residential property30 chapter iii protection of personal data6 a data subject may be said to have given effective consent only when it is—(1) free, in the terms of section 14 of the indian contract act, 1872;effective consent from a data subject(2) obtained prior to all data collection, except in the cases expressly excluded by section 8;35(3) voluntarily given through an express and affirmative act and is recorded in writing:provided that effective consent shall only be said to have been obtained where:(i) a conspicuous means for its withdrawal is made available to the data subject; and40(ii) the means for its withdrawal may be employed with the same ease as the means by which it was obtained45(4) obtained after the data subject has been duly informed, in language that a reasonable person may comprehend, of the matters enumerated in sub-section (3) of section 7 or sub-section (3) of section 13 as the case may be, and:provided that, in case of any dispute, ambiguities in the terms of the notice and of any privacy policies that apply will be resolved in favour of the data subject; (5) specific and limited as to the purpose and duration5explanation 1—for the purposes of this section consent shall be deemed to be limited only if it is obtained in respect of the purposes and duration strictly necessary to provide the product or service in relation to which personal data is sought to be collected, processed or disclosed;10explanation 2—when the purposes for which personal data was collected are materially altered or expanded subsequent to its collection, consent shall be deemed to be specific only if it is obtained afresh in respect of that alteration or expansion—(i) after duly informing the data subject of the alteration or expansion in purpose, and(ii) prior to any use of that data for the expanded purposes15collection of personal data7 (1) no person, including a data controller and data processor, shall collect any personal data without obtaining the effective consent of the data subject to whom it pertains(2) subject to sub-section (1), no person shall collect any personal data that is not necessary for the achievement of a purpose that is connected to a stated function of the person seeking its collection20(3) a person seeking to collect any personal data shall, prior to its collection and as notified by the privacy commission, inform the data subject free of any charges, direct or indirect, to whom it pertains of the following details in respect of their personal data, namely—(a) when it shall be collected; (b) its content and nature;25(c) the purpose of its collection; (d) the purpose and manner in which it shall be used; (e) the persons to whom it shall be made available; (f) the duration for which it shall be stored;(g) the manner in which it may be accessed, checked and modified;30(h) the security practices and other safeguards, if any, to which it shall besubject;(i) the privacy policies and other policies, if any, that shall protect it; (j) whether, and the conditions and procedure upon which, it may be disclosedto others;35(k) the time and manner in which it shall be destroyed, or the criteria used todetermine that time period;(l) the procedure for recourse in case of any grievance in relation to it; and(m) the identity and contact details of the data collector and data processor40(4) the personal data collected in pursuance of a grant of consent by the data subject to whom it pertains shall, if that consent is subsequently withdrawn for any reason, be destroyed forthwith:provided that the person who collected the personal data in respect of which consent is subsequently withdrawn may, only if the personal data is necessary for the delivery of any good or the provision of any service, or the fulfillment of a lawful contract, not deliver that good or deny that service or fulfil that contract to the data subject who withdrew the grant of consent easily and at any point during the duration of a service8 personal data may be collected without the prior consent of the data subject if itis—5collection of personal data without prior consent(a) necessary for the provision of an emergency medical service to the data subject; (b) required for the establishment of the identity of the data subject and the collectionis authorised by a law in this regard; and(c) necessary to prevent, investigate or prosecute a cognisable offence10storage and destruction ofpersonal data9 (1) no person, including a data controller and a data processor, shall  store anypersonal data for a period longer than is necessary to achieve the purpose for which it was collected or received, or, if that purpose is achieved or ceases to exist for any reason, for any period following such achievement or cessation15(2) save as provided in sub-section (3), any personal data collected or received inrelation to the achievement of a purpose shall, if that purpose is achieved or ceases to exist for any reason, be destroyed forthwith(3) notwithstanding anything contained in this section, any personal data may be stored for a period longer than is necessary to achieve the purpose for which it was collected or received, or, if that purpose has been achieved or ceases to exist for any reason, for any period following such achievement or cessation, if —20(a) the data subject to whom it pertains grants their effective consent to suchstorage prior to the purpose for which it was collected or received being achieved or ceasing to exist; or(b) it is adduced for an evidentiary purpose in a legal proceeding; or25(c) it is required to be stored for historical, statistical or research purposes underthe provisions of an act of parliament:provided that only such amount of personal data that is necessary toachieve the purpose of storage under this sub-section shall be stored and any personal data that is not required to be stored for such purpose shall be destroyed forthwith:30provided further that any personal data stored under this sub-sectionshall, to the extent possible, be anonymisedprocessing of personal data10 (1) no person shall process any personal data that is not necessary for theachievement of the purpose for which it was collected or received35(2) save as provided in sub-section (3), no personal data shall be processed for anypurpose other than the purpose for which it was collected or received(3) notwithstanding anything contained in this section, any personal data may be processed for a purpose other than the purpose for which it was collected or received if the data subject grants their effective consent to such processing and only that amount of personal data that is necessary to achieve the other purpose is processed40(4) notwithstanding anything contained in this section, any personal data may be processed for a purpose other than the purpose for which it was collected or received if —(a) the data subject grants his/her effective consent to the processing and only that amount of personal data that is necessary to achieve the other purpose is processed;45(b) it is necessary to perform a contractual duty to the data subject;(c) it is necessary to prevent a reasonable threat to security of the state or public order; or(d) it is necessary to prevent, investigate or prosecute a cognisable offence5security of personal data and duty of confidentiality11 (1) no person shall collect, receive, store, process or otherwise handle any personaldata without implementing measures, including, but not restricted to, technological, physical and administrative measures, adequate to secure its confidentiality, secrecy, integrity and safety, including from theft, loss, damage or destruction(2) any person who collects, receives, stores, processes or otherwise handles anypersonal data shall be subject to a duty of confidentiality and secrecy in respect of it10(3) the data controllers and data processors shall be subject to a duty of confidentialityand secrecy in respect of personal data in their possession or control1520(4) without prejudice to the provisions of this section, any person who collects,receives, stores, processes or otherwise handles any personal data shall, if its confidentiality, secrecy, integrity or safety is violated by theft, loss, negligence, damage or destruction, or as a result of any collection, processing or disclosure contrary to the provisions of this act, or for any other reason whatsoever, as soon as he or she becomes aware of such violation, notify the person to whom it pertains, the privacy commission and any other agencies whom the central government notifies for this purpose, in such form and manner as may be prescribed, forthwith further, any persons, who collects, receives, stores, processes, or otherwise handles any personal data shall report all breaches of provisions of this chapter iii to the privacy commission, that are brought to its notice, or are reasonably expected to be known to such personstransfer of personal data for processing2512 (1) subject to the provisions of this section, personal data that has been collectedin conformity with this act may be transferred by a data controller for to a data processor, whether located in india or otherwise, if the transfer is pursuant to an agreement that explicitly binds the data processor to same or stronger measures in respect of the storage, processing, destruction, disclosure and other handling of the personal data as are contained in this act(2) no data processor shall process any personal data transferred under this sectionexcept to achieve the purpose for which it was collected30(3) a data controller that transfers personal data under this section shall remain liableto the data subject for the actions of the data processordisclosure of personal data13 (1) save as provided in this section, no person shall disclose, or otherwise causeany other person to receive, the content or nature of any personal data, including any other details in respect thereof, except to the person to whom it pertains35(2) no person shall disclose any personal data without obtaining the prior effective consent of the data subject and such effective consent may be obtained in any manner, and through any medium, but shall not be obtained as a result of a threat, duress, denial of service or coercion40(3) for the purpose of sub-section (2), a person seeking to disclose any personal data shall, prior to its disclosure, inform the data subject of the following details in respect of their personal data, namely: —(a) when it shall be disclosed; (b) the purpose of its disclosure;45(c) the security practices and other safeguards, if any, to which it shall be subjectto;(d) the privacy policies and other policies, if any, that shall protect it; and (e) the procedure for recourse in case of any grievance in relation to it5(4) notwithstanding anything contained in this section, any person who collects, receives, stores, processes or otherwise handles any personal data may disclose it to a person other than the data subject, whether located in india or otherwise, for the purpose only of processing it to achieve the purpose for which it was collected if such a disclosure is pursuant to an agreement that explicitly binds the person receiving it to same or stronger measures in respect of its storage, processing, destruction, disclosure or other handling as are contained in this actquality and accuracy of personal data14 (1) any person who collects, receives, stores, processes or otherwise handles any personal data shall, to the extent possible, ensure that it is accurate and, where necessary, is kept up to date10(2) no person who collects, receives, stores, processes or otherwise handles any personal data shall deny, to the data subject, the opportunity to review and obtain a copy of such data and, where necessary, rectify anything that is inaccurate or not up to date15(3) any person to whom any personal data collected, received, stored, processed or otherwise handled under this act pertains may, if it is not necessary to achieve the purpose of its collection, reception, storage, processing or other handling, demand its destruction, and the person so collecting, receiving, storing, processing or otherwise handling that personal data shall destroy it forthwith15 notwithstanding anything contained in this act and the provisions of any other law for the time being in force—20special provisions for sensitive personal data(a) no person shall collect sensitive personal data without explicit effective consent from the data subject;25(b) no person shall store sensitive personal data for a period longer than is necessary to achieve the purpose for which it was collected or received, or, if that purpose has been achieved or ceases to exist for any reason, for any period following such achievement or cessation;(c) no person shall process sensitive personal data for a purpose other than the purpose for which it was collected or received; and30(d) no person shall disclose sensitive personal data to another person, or otherwise cause any other person to come into the knowledge or possession of, the content or nature of any sensitive personal data, including any other details in respect thereof, except the data subject16 (1) notwithstanding anything contained in this act, the provisions of sections 6,7, 8, sub-section (4) of section 10 and section 11 shall not apply in respect of an intelligence organisation35special provisions for intelligence organisations(2) any intelligence organisation seeking to collect any personal data shall prefer anapplication, in such form and manner as may be prescribed, to the chief privacy commissioner or any other person authorised by him in this behalf40(3) the chief privacy commissioner, or any other person authorised by him in thisbehalf, may, if he is satisfied that the collection of the personal data is necessary to prevent a reasonable threat to security of the state or public order, or prevent, investigate or prosecute a cognisable offence, order the collection of the personal data by recording reasons in writing within a period of fourteen days from the receipt of an application under sub-section (2)45(4) notwithstanding anything contained in sub-section (2) and subsection (3), if thecentral government is satisfied that a serious threat to the security of the state or public order exists, it may, for reasons to be recorded in writing, which shall include the reason for not getting an order under sub-section (3), order the collection of any personal data(5) before the expiry of a period of seven days from the date of an order for collection of personal data made under sub-section (4), the intelligence organisation that collected the personal data shall notify the chief privacy commissioner of the fact of such collection, the name and address of the person to whom the personal data pertains and shall furnish a copy of the order of the central government authorising the collection of the personal data510(6) no intelligence organisation shall process or store any personal data without implementing measures to secure that the number of persons within that intelligence organisation to whom it is made available, and the extent to which it is copied, is limited to the minimum that is necessary to fulfill the purpose for which it is processed or stored, as the case may be(7) any intelligence organisation that processes or stores personal data shall, beforethe expiry of a period of seven days from the date of the processing or storage, as the case may be, notify the chief privacy commissioner of the fact of such processing or storage and the name and address of the person to whom the personal data pertains15(8) any intelligence organisation that processes or stores personal data shall have tocomply with the provisions of section 10 with respect to such data chapter iv interception of communications20bar against interception of communications17 (1) notwithstanding anything contained in any other law for the time being inforce, but save as provided in this chapter, no person shall intercept, or cause to be intercepted, any communication of another person save in pursuance of an order by the chief privacy commissioner or any other person authorised by him in this behalf(2) no interception of any communication shall be ordered or carried out that is notnecessary to achieve the purpose for which the interception is sought2518 (1) any authorised officer seeking to intercept any communication of anotherperson shall prefer an application, in such form and manner as may be prescribed, to the chief privacy commissioner or any other person authorised by him in this behalfprior authorisation by the chief privacy commissioner30(2) the chief privacy commissioner, or any other person authorised by him in thisbehalf, may, if he is satisfied that the interception is necessary to prevent a reasonable threat to security of the state or public order, or prevent, investigate or prosecute a cognisable offence, order the interception of communications by recording reasons in writing within aperiod of fourteen days from the receipt of an application under sub-section (1)35(3) the chief privacy commissioner, or any other person authorised by him in thisbehalf, shall prior to issuing an order for interception of any communication, satisfy himself that all other lawful means to acquire the information sought to be intercepted have been exhausted and that the proposed interception is reasonable, proportionate and not excessive(4) any interception of any communication ordered, authorised or carried out prior to the commencement of this act shall, immediately upon the constitution of the privacy commission, be reported to the chief privacy commissioner4019 (1) notwithstanding anything contained in section 17, if the home secretary of the appropriate government is satisfied that an imminent serious threat to the security of the state or public order exists, he may, for reasons to be recorded in writing, order the interception of any communicationauthorisation by home secretary in emergent circumstances(2) no order for interception of any communication made under this section shall be valid upon the expiry of a period of seven days from the date of the order45(3) before the expiry of a period of seven days from the date of an order for interception made under this section, the person who carried out the interception of communication shall notify the chief privacy commissioner of the fact of such interception, the name and address of the person whose communication is being intercepted, and the duration of the interception and, furthermore, shall furnish a copy of the order of the home secretary authorising the interceptionduration of interception20 (1) an order for interception of any communication shall specify the period of itsvalidity and, upon the expiry of the validity of the order, all interception carried out in relation to that order shall cease forthwith:5provided that no order for interception of any communication shall be validupon the expiry of a period of sixty days from the date of such order10(2) the chief privacy commissioner, or any other person authorised by him in thisbehalf, may, upon receipt of an application from an authorised officer in such form and manner as may be prescribed, renew any order for interception of any communication if he is satisfied that the conditions upon which the original order was issued continue to existduty toinform the person concerned1521 (1) subject to sub-section (2), before the expiry of a period of sixty days from theconclusion of any interception of communication ordered or  carried out under this act, the authorised officer who carried out the interception of communication shall, in writing in such form and manner as may be prescribed, notify, with reference to the relevant order of the chief privacy commissioner, each person whose communication was intercepted of the fact of such interception and duration thereof20(2) the chief privacy commissioner may, on an application made by an authorisedofficer in such form and manner as may be prescribed, if he is satisfied that the notification under sub-section (1) may reasonably present a reasonable threat to the security of the state or public order, or adversely affect the prevention, investigation or prosecution of a cognisable offence, for reasons to be recorded in writing addressed to the authorised officer, order that the person whose communication was intercepted not be notified of the fact of such interception or the duration thereof:25provided any orders passed preventing disclosure of interception under section(2) shall not operate in infinity and shall record reasons in writing with the period till when the reasonable threat is anticipated to extend, on whose cessation the duty to inform under sub-section (1) shall operate30security and duty of confidentialityand secrecy22 (1) no person shall intercept any communication of another person withoutimplementing measures, including, but not restricted to, technological, physical and administrative measures, to secure the confidentiality and secrecy of all information obtained as a result of an interception of communication, including from theft, negligence, loss orunauthorised disclosure35(2) any person who carries out any interception of any communication, or who obtainsany information, including personal data, as a result of an interception of communication, shall be subject to a duty of confidentiality and secrecy in respect of it(3) every competent organisation shall, before the expiry of a period of one hundreddays from the date of enactment of this act, designate as many officers as it deems fit as privacy officers who shall be administratively responsible for administration of all interceptions of communications carried out by that competent organisation40disclosure of intercepted communications23 (1) save as provided in this section, no person shall disclose to any other person, or otherwise cause any other person to come into the knowledge or possession of, the content or nature of any information, including personal data, obtained as a result of an interception of any communication including the fact that the interception of communication was carried out4550(2) notwithstanding anything contained in this section, if the disclosure of anyinformation, including personal data, obtained as a result of an interception of any communication is necessary to prevent a reasonable threat to the security of the state or public order, or prevent, investigate or prosecute a cognisable offence, an authorised officer may disclose the information, including personal data, obtained as a result of theinterception of any communication to any authorised officer of any other competent organization:provided that no authorised officer shall disclose any information, includingpersonal data, obtained as a result of the interception of any communication that is not necessary to achieve the purpose for which the disclosure is sought5storage of intercepted communications24 (1) subject to sub-section (2), no person shall store any information, includingpersonal data, obtained as a result of an interception of any communication for a period longer than one hundred and eighty days from the date on which the last order for interception of the communication to which the obtained information pertains expired1015(2) the chief privacy commissioner may, on an application made in such form andmanner as may be prescribed, if he is satisfied that it is necessary to prevent a reasonable threat to the security of the state or public order, or to prevent, investigate or prosecute a cognizable offence, for reasons to be recorded in writing, order that any information, including personal data, obtained as a result of an interception of any communication may be stored for a period longer than one hundred and eighty days from the date on which the last order for interception of the communication to which the obtained information pertains expired(3) any data obtained as a result of interception of any communication shall be storedin a manner that complies with the provisions of section 9 with respect to such data chapter v surveillance20bar against surveillance25 notwithstanding anything contained in any other law for the time being in force,but save as provided in this chapter, no person shall order or carry out, or cause or assist the ordering or carrying out of, any surveillance of another person:25provided that there shall be an absolute bar to the subjection of persons toindiscriminate monitoring through any methods of mass or bulk surveillance given that it is neither necessary or proportionate to any stated purpose including but not limited to the security of state, interests of public order or to prevent, investigate or prosecute a commission of a cognizable offencesurveillance by the state3026 (1) no member of a police force, armed force, intelligence organisation, publicauthority or the state shall order or carry out, or cause to be ordered or carried out, any surveillance of another person save in pursuance of an order by the chief privacycommissioner or any other person authorised by him in this behalf(2) no surveillance shall be ordered or carried out that is not necessary to achieve thepurpose for which the surveillance is sought35(3) any authorised officer seeking to carry out any surveillance of another personshall prefer an application, in such form and manner as may be prescribed, to the chief privacy commissioner or any other person authorised by him in this behalf40(4) the chief privacy commissioner, or any other person authorised by him this behalf,may, if he is satisfied that the surveillance is necessary to prevent a reasonable threat to the security of the state or public order, or to prevent, investigate or prosecute a cognizable offence, for reasons to be recorded in writing addressed to the authorised officer, order the surveillance45(5) prior to issuing an order for surveillance, the chief privacy commissioner, or anyother person authorised by him in this behalf, shall satisfy himself that all other lawful means to acquire the information sought to be obtained as a result of the proposed surveillance have been exhausted and that the proposed surveillance is reasonable, proportionate and not excessivesurveillance by private persons or entities527 (1) notwithstanding anything contained in any other law for the time being inforce, and without prejudice to the provisions of section 25, no person who is not a member of a police force, armed force, intelligence organisation, public authority or the state shall carry out, or cause to be carried out, any surveillance in any public place or in any property or premises that is not in his possession(2) without prejudice to sub-section (1), any person who carries out any surveillanceunder this section shall be subject to a duty to inform, in such manner as may be prescribed, members of the public of such surveillanceduration of surveillance1028 (1) an order for surveillance shall specify the period of its validity and,  upon theexpiry of the validity of the order, all surveillance carried out in relation to that order shall cease forthwith:provided that no order for surveillance shall be valid upon the expiry of a periodof sixty days from the date of the order15(2) the chief privacy commissioner, or any other person authorised by him in thisbehalf, may, upon receipt of an application from an authorised officer in such form and manner as may be prescribed, renew any order for surveillance if he is satisfied that the conditions upon which the original order was issued continue to exist20duty to inform the person concerned29 (1) subject to sub-section (2), before the expiry of a period of sixty days from theconclusion of any surveillance ordered or carried out under this act, the authorised officer who carried out the surveillance shall, in writing in such form and manner as may be prescribed, notify, with reference to the relevant order of the chief privacy commissioner, each person in respect of whom surveillance was carried out of the fact of such surveillance and duration thereof25(2) the chief privacy commissioner may, on an application made by an authorisedofficer in such form and manner as may be prescribed, if he is satisfied that the notification under sub-section (1) may present a reasonable threat to the security of the state or public order, or adversely affect the prevention, investigation or prosecution of a cognizable offence,for reasons to be recorded in writing addressed to the authorised officer, order that the person not be notified of the fact of such surveillance or the duration thereof:30provided that any order passed which prevent disclosure of surveillance undersub-section (2) shall not operate in infinity and the chief privacy commissioner shall record reasons in writing with the period till when the reasonable threat is anticipatedto extend, on whose cessation the duty to inform under sub-section (1) shall operate35security and duty of confidentiality and secrecy30 (1) no person shall carry out any surveillance of another person withoutimplementing measures, including, but not restricted to, technological, physical and administrative measures, to secure the confidentiality and secrecy of all information obtained as a result of surveillance, including from theft, loss or unauthorised disclosure(2) any person who carries out any surveillance, or who obtains any information, including personal data, as a result of surveillance, shall be subject to a duty of confidentiality and secrecy in respect of it40(3) every police force, armed force, intelligence organisation, public authority or state shall, before the expiry of a period of one hundred days from the enactment of this act, designate as many officers as it deems fit as privacy officers who shall be administratively responsible for all surveillance carried out:45provided that a public authority that does not order or carry out surveillanceshall not be required to designate any privacy officers under this sub-section(4) every person who is not a member of a police force, armed force, intelligence organisation, public authority or state and who seeks to carry out any surveillance shall, at least seven days before the surveillance is first carried out, designate or appoint as many persons as it deems fit as privacy officers who shall be responsible for all surveillance carried out:provided that where surveillance is carried out by a single person, that personshall be deemed to be a privacy officer5disclosure of surveillance31 (1) save as provided in this section, no person shall disclose to any other person,or otherwise cause any other person to come into the knowledge or possession of, the content or nature of any information, including personal data, obtained as a result of any surveillance including the fact that the surveillance was carried out10(2) notwithstanding anything contained in this section, if the disclosure of anyinformation, including personal data, obtained as a result of surveillance is necessary to prevent a reasonable threat to the security of the state or public order, or prevent, investigate or prosecute a cognizable offence, that information, including personal data, obtained as a result of surveillance may be disclosed to a police force, armed force, intelligence organisation, public authority or state only:15provided that no person shall disclose any information, including personal data,obtained as a result of surveillance that is not necessary to achieve the purpose for which the disclosure is soughtstorage of surveillance data2032 (1) subject to sub-section (2), no person shall store any information, includingpersonal data, obtained as a result of surveillance for a period longer than one hundred and eighty days from the date on which the surveillance to which the obtained information pertains ceased25(2) the chief privacy commissioner may, on an application made in such form andmanner as may be prescribed, if he is satisfied that it is necessary to prevent a reasonable threat to the security of the state or public order, or to prevent, investigate or prosecute a cognizable offence, for reasons to be recorded in writing, order that any information, including personal data, obtained as a result of surveillance may be stored for a period longer than one hundred and eighty days from the date on which the last order for surveillance to which the obtained information pertains expired30(3) any data obtained as a result of surveillance shall be stored in a manner thatcomplies with the provisions of section 9 with respect to such data chapter vi the privacy commissionconstitution of the privacy commission3533 (1) the central government shall, by notification, constitute, with effect fromsuch date as may be specified therein, a body to be called the privacy commission consisting of a chief privacy commissioner and not more than six other privacy commissioners, to be appointed by the president, by warrant under its hand and seal, to exercise the jurisdiction and powers and discharge the functions and duties conferred or imposed upon them by or under this act(2) the chief privacy commissioner shall be a person who has been a judge of thesupreme court of india40(3) one privacy commissioner shall be a person who is or has been a judge of a highcourt45(4) one privacy commissioner shall be a person of ability, integrity and standing whohas a special knowledge of, and professional experience of not less than ten years in privacy law and policy(5) the other privacy commissioners shall be persons with technical expertise andknowledge in the fields of data collection and storage practices, or data protection and ethics, or big data analytics and technologies or information technology while one privacycommissioner should be an ordinary citizen representing the interests of the public who are consumers of data(6) the headquarters of the privacy commission shall be at new delhi:5provided that the central government shall, in consultation with the chiefprivacy commissioners may establish its offices at such other places at it deems fit(7) the office of the privacy commission shall be a body corporate by the name of aforesaid, autonomous, independent, and free from external interference and shall be the said name, sue or be sued10(8)the office of the privacy commission shall be provided with sufficient operational resources including human, technical, and financial for the effective discharge of its duties and exercise of its powers:provided that such powers shall be subject to audit by the comptroller and auditor general of india15(9) the central government shall issue a public advertisement inviting applications to fill all vacancies in the privacy commission20(10) for the purpose of filling vacancies under sub-section (8) the privacy commissioner shall constitute a selection committee which shall consist of the chief justice of india, the law minister, the leader of the opposition from the house of the people or of the single largest opposition party being one with the greatest numerical strength in the house of the people, one eminent person representing the private sector and one eminent person representing the civil society to be nominated by the central government in such manner as may be prescribed(11) every proceeding of the selection committee shall constitute as a public record25explanation for the purpose of this section, the term "civil society" shall meanthe aggregate of non-governmental and non-profit organisations that perform activities for the general upliftment and interests of the people in the field of privacy and is independent of government funding, interference or influence3034 (1) the president shall before appointing any person as the chief privacy commissioner or privacy commissioner, as the case may be, satisfy himself that the person does not, and shall not, have any such financial or other interest as is likely to affect prejudicially their functions as such chief privacy commissioner or privacy commissioner as the case may beterm of office, conditions of service, etc of chief privacy commissioner and privacy commissioners(2) the chief privacy commissioner and every privacy commissioner shall hold office for such period, not exceeding five years, as may be specified by the president in the order of his appointment and be eligible for reappointment:35provided that no person shall hold office as the chief privacy commissioner or privacy commissioner for more than two terms;40provided further that no person shall hold office as the chief privacy commissioner or privacy commissioner after they have attained the age of seventyfive years (3) notwithstanding anything contained in sub-section (2), the chief privacy commissioner or any privacy commissioner may—(a) by writing under his hand and addressed to the president resign his office at any time; or(b) be removed from office in accordance with the provisions of section 3545(4) a vacancy caused by the resignation or removal of the chief privacy commissioner or privacy commissioner under sub-section (3) shall be filled by fresh appointment(5) in the event of the occurrence of a vacancy in the office of the chief privacy commissioner, the president may, by notification, authorise in his behalf, one of the privacy commissioners as the chief privacy commissioner till the date on which a new chief privacy commissioner, appointed in accordance with the provisions of this act, enters upon his office5(6) when the chief privacy commissioner is unable to discharge his functions owing to absence, illness or any other cause, such one of the privacy commissioners as the chief privacy commissioner may authorise in writing in this behalf shall discharge the functions of the chief privacy commissioner, till the date on which the chief privacy commissioner resumes his duties10(7) the salaries and allowances payable to and the other terms and conditions of service of the chief  privacy commissioner and privacy commissioners shall be such as may be prescribed:15provided that neither the salary and allowances nor the other terms and conditions of service of the chief privacy commissioner and any privacy commissioner shall be varied to their disadvantage after their appointment (8) the chief privacy commissioner and privacy commissioners ceasing to hold office as such shall not hold any appointment under the government of india or under the government of any state for a period of five years from the date on which they cease to hold such office2035 (1) the president may remove from office the chief privacy commissioner or any privacy commissioner, who —(a) is adjudged an insolvent; or (b) engages during his term of office in any paid employment outside the duties of his office; or removal of chief privacy commissioner and privacy commissioners from office in certain circumstances25(c) is unfit to continue in office by reason of infirmity of mind or body; or (d) is of unsound mind and stands so declared by a competent court; or (e) is convicted for an offence which in the opinion of the president involvesmoral turpitude; or30(f) has acquired such financial or other interest as is likely to affect prejudiciallyhis functions as a chief privacy commissioner or privacy commissioner, or causesome conflict of interest including benefits directly or indirectly to relatives or family members, or(g) has so abused his position as to render his continuance in offence prejudicialto the public interest3540(2) notwithstanding anything contained in sub-section (1), neither the chief privacy commissioner nor any privacy commissioner shall be removed from his office on the ground specified in clause (f) or clause (g) of that sub-section unless the supreme court on a reference being made to it in this behalf by the president, has on an inquiry held by it in accordance with such procedure as it may specify in this behalf, reported that the chief privacy commissioner or privacy commissioner ought, on such grounds, to be removedfunctions of the privacy commission4536 (1) the privacy commission may, through decisions arrived at by a simple majorityof its members present and voting as set out in section 44(1) of this act, authorise, review,investigate, make an inquiry, and/or  monitor, suo moto or on a petition presented to it by any person or by someone acting on his behalf, the implementation and application of this act and give such directions or pass such orders as are necessary for reasons to be recorded in writing(2) without prejudice to the generality of the foregoing provision, the privacy commission shall perform all or any of the following functions, namely—(a) review the safeguards provided under this act and under other laws for thetime being in force for the protection of personal data and recommend measures for their effective implementation or amendment, as may be necessary from time to time;5(b) authorise, review, investigate, make an inquiry, and/or monitor any measurestaken by any competent organisation, police force, armed force, intelligence organisation, public authority, company, person or other entity for the protection of privacy and take such further action is it deems fit;10(c) authorise, review, investigate, make an inquiry, and/or monitor any action,code, certification, policy or procedure of any competent organisation, police force, armed force, intelligence organisation, public authority, company, person or other entity to ensure compliance with this act and any rules made hereunder;15(d) investigate and direct data controllers and processors to do or cease to doany act in order to address activity which is in contravention of the provisions of this act;(e) formulate through public consultation with experts, other stakeholders, andthe general public, norms for the effective protection of privacy by competent organisations, police forces, armed forces, intelligence organisations, public authorities, companies, persons or other entities;20(f) promote awareness and knowledge of personal data protection through anymeans necessary and to all stakeholders including providing information to any data subject regarding their rights under this act as requested ;(g) undertake and promote research in the field of protection of personal dataand privacy;25(h) encourage the efforts of non-governmental organisations and institutionsworking in the field of personal data protection and privacy;30(i) publish periodic reports concerning the incidence of compliance includingviolations of this act and data breaches as reported under sub-section (4) of  section 11 of this act, collection, processing, storage, disclosure and other handling of personaldata, interception of communications and surveillance;(j) hear and decide applications for interception and surveillance under chaptersiv and v of this act;(k) exercise its powers under section 28, to ensure the speedy and efficientredressal of all complaints whose cause of action arises from this act; and35(l) such other functions as it may consider necessary for the protection ofprivacy, personal data, and enforcement of this act40(3) the periodic reports published by the privacy commission, stipulated in subsection (2) of section 36, shall be tabled by the central government before the house of thepeople during the parliamentary session that succeeds the publication of such periodic report45(4) the chief privacy commissioner and the privacy commissioners shall appearbefore an ad hoc committee, constituted by the speaker of the house of the people and comprising of members from both the governing and the opposition parties from both houses of parliament to be nominated by presiding officers of the house concerned, on an annual basis, in such manner as may be prescribed which shall,—(i) review the functioning of the privacy commission, and may ask the chiefprivacy commissioner and the privacy commissioners any questions in this regard; and(ii) present periodic reports to both houses of parliament in such manner as may be prescribed5(5) subject to the provisions of any rules prescribed in this behalf by the central government, the privacy commission shall have the power to review any decision, judgement, decree or order made by it(6) in the exercise of its functions under this act, the privacy commission shall give such directions or pass such orders as are necessary for reasons to be recorded in writing1037 (1) the central government shall appoint a secretary to the privacy commission to exercise and perform, under the control of the chief privacy commissioner such powers and duties as may be prescribedsecretary, officers and other employees of the privacycommission(2) the central government may provide the privacy commission with such other officers and employees as may be necessary for the efficient performance of the functions of the privacy commission15(3) the salaries and allowances payable to and the conditions of service of the secretary and other officers and employees of the privacy commission shall be such as may be prescribed2038 no act or proceedings of the privacy commission shall be questioned on the ground merely of the existence of any vacancy or defect in the constitution of the privacy commission or any defect in the appointment of a person acting as the chief privacy commissioner or privacy commissionervacancies, etc not to invalidate proceedings of the privacy commission39 the chief privacy commissioner and privacy commissioners and other employees of the privacy commission shall be deemed to be a public servant within the meaning of section 21 of the indian penal code, 1860chief privacy commissioner, privacy commissioners and employees of the privacy commission to be public servants2540 (1) subject to the provisions of this act, the privacy commission shall have powers to regulate —procedure to be followed by the privacy commission(a) the procedure and conduct of its business; and (b) the delegation to one or more privacy commissioners of such powers or functions as the chief privacy commissioner may specify30(2) in particular and without prejudice to the generality of the foregoing provisions, the powers of the privacy commission shall include the power to determine the extent to which persons interested or claiming to be interested in the subject-matter of any proceeding before it may be allowed to be present or to be heard, either by themselves or by their representatives or to cross-examine witnesses or otherwise take part in the proceedings:35provided that any such procedure as may be prescribed or followed shall beguided by the principles of natural justicepower relating to inquiries41 (1) the privacy commission shall, for the purposes of any inquiry or for any otherpurpose under this act, have the same powers as are vested in a civil court under the code of civil procedure, 1908, while trying suits in respect of the following matters, namely—40(a) the summoning and enforcing the attendance of any person from any part ofindia and examining him on oath;(b) the discovery and production of any document or other material objectproducible as evidence;(c) the reception of evidence on affidavit; (d) the requisitioning of any public record from any court or office; (e) the issuing of any commission for the examination of witnesses; and (f) any other matter which may be prescribed5(2) the privacy commission shall have power to require any person, subject to anyprivilege which may be claimed by that person under any law for the time being in force, to furnish information on such points or matters as, in the opinion of the privacy commission, may be useful for, or relevant to, the subject matter of an inquiry and any person so required shall be deemed to be legally bound to furnish such information within the meaning of sections 176 and 177 of the indian penal code, 186010 15(3) the privacy commission or any gazetted officer, specially authorised in this behalfby the privacy commission may enter any building or place where the privacy commission has reason to believe that any document relating to the subject matter of the inquiry may be found, and may seize any such document or take extracts or copies therefrom subject to the provisions of section 100 of the code of criminal procedure, 1973, in so far as it may be applicable20(4) the privacy commission shall be deemed to be a civil court and when any offenceas is described in section 175, section 178, section 179, section 180 or section 228 of the indian penal code, 1860 is committed in the view or presence of the privacy commission, the privacy commission may, after recording the facts constituting the offence and the statement of the accused as provided for in the code of criminal procedure, 1973, forward the case to a magistrate having jurisdiction to try the same and the magistrate to whom any such case is forwarded shall proceed to hear the complaint against the accused as if the case had been forwarded to him under section 346 of the code of criminal procedure, 197325decisions of the privacy commission42 (1) the decisions of the privacy commission shall be taken by majority of themember present and voting and be binding and enforceable as a decree of a court as per the provisions of the code of civil procedure, 1908(2) in its decisions, the privacy commission shall have the power to—30(a) require a competent organisation, police force, armed force, intelligenceorganisation, public authority, company, person or other entity to take such steps as may be necessary to secure compliance with the provisions of this act;(b) require a competent organisation, police force, armed force, intelligenceorganisation,public authority, company, person or other entity to compensate anyperson for any loss or detriment suffered; and(c) impose any of the penalties provided under this act35proceedings before the privacy commission to be judicial proceedings43 the privacy commission shall be deemed to be a civil court for the purposes of section 195 and chapter xxvi of the code of criminal procedure, 1973, and every proceeding before the privacy commission shall be deemed to be a judicial proceeding within the meaning of section 193 and section 228 and for the purposes of section 196 of the indian penal code, 186040appeal44 no order passed under this act shall be appealable except as provided therein and no civil court shall have jurisdiction in respect of any matter which the privacy commission is empowered by, or under, this act to determine and no injunction shall be granted by any court or other authority in respect of any action taken or to be taken in pursuance of any power conferred by or under this act45jurisdiction45 on and from the appointed day, no court or authority shall have, or be entitled to exercise, any jurisdiction, powers or authority, except the supreme court and a high court exercising powers under articles 32, 226 and 227 of the constitution, in relation to matters over which the privacy commission has jurisdiction chapter vii regulation by data controllers and data processors46 (1) without prejudice to the provisions of clause (d) of sub-section (2) of section36, the privacy commission may, after a public consultation, formulate codes of conduct for the collection, storage, processing, disclosure or other handling of any personal data5co-regulation by data controllers and the privacy commission(2) no code of conduct formulated under sub-section (1) shall be binding on a datacontroller unless—(a) it has received the written approval of the chief privacy commissioner and atleast two privacy commissioners; and10(b) it has received the approval, by signature of a director or  authorised signatory,of the data controllerself-regulation by data controllers47 (1) the privacy commission may encourage data controllers and data processorsto formulate professional codes of conduct to establish rules for the collection, storage, processing, disclosure or other handling of any personal data15(2) no code of conduct formulated under sub-section (1) shall be effective unless it isregistered, in such form and manner as may be prescribed, by the privacy commission(3) the privacy commission shall, for reasons to be recorded in writing, not registerany code of conduct formulated under sub-section (1) that is not adequate to protect personal data2048 any code of conduct formulated under this chapter shall be without prejudice tothe jurisdiction, powers and functions of the privacy commission chapter viiico-regulation and selfregulation without prejudice to other remedies offences and penalties2549 (1) whoever, except in conformity with the provisions of this act,  collects, receives,stores, processes, discloses or otherwise handles anypersonal data shall be liable to fine which may extend to one crore rupees:punishment for offences related to personal dataprovided that if the person commits the offence either intentionally, or withreckless disregard, he shall be liable for a term of imprisonment which may extend uptothree years, and shall also be liable to fine30(2) whoever, except in conformity with the provisions of this act, collects, receives,stores, processes, discloses or otherwise handles any sensitive personal data shall be liable to fine which may extend upto ten crore rupees:35provided that if the person committs the offence either intentionally, or withreckless disregard, he shall be liable for a term of imprisonment which may extend upto five years and shall also be liable to fine50 whoever, except in conformity with the provisions of this act, intercepts, orcauses the interception of, any communication of another person shall be liable to a fine which may extend upto one crore rupees:punishment for offences related to interception of communication40provided that if the person commits the offence either intentionally, or withreckless disregard, he shall be liable for a term of imprisonment extending upto three years, and shall also be liable to fine51 whoever, except in conformity with the provisions of this act, orders or carries out, or causes the ordering or carrying out, of any surveillance of another person shall be liable to a fine which may extend to ten crore rupees:punishment for offences related to surveillanceprovided that if the person commits the offence either intentionally, or withreckless disregard, shall be liable for a term of imprisonment extending upto five years, and shall also be liable to fine5abetment and repeat offenders52 whoever abets any offence punishable under this act shall, if the act abetted iscommitted in consequence of the abetment, be punishable with the punishment provided for that offenceoffences by companies1053 (1) where an offence under this act has been committed by a company, everyperson who, at the time of the offence was committed, was in charge of, and was responsible to, the company for the conduct of the business of the company, as well as the company shall be deemed to be guilty of the offence and shall be liable to be proceeded against and punished accordingly:provided that nothing contained in this sub-section shall render any such personliable to any punishment, if he proves that the offence was committed without his knowledge or that he had exercised all due diligence to prevent the commission of such offence15 20(2) notwithstanding anything contained in sub-section (1), where any offence underthis act has been committed by a company and it is proved that the offence has been committed with the consent or connivance of, or is attributable to any neglect on the part of any director, manager, secretary or other officer of the company, such director, manager, secretary or other officer shall be deemed to be guilty of that offence, and shall be liable to be proceeded against and punished accordinglycognizance54 notwithstanding anything contained in the code of criminal procedure, 1973, theoffences under this chapter shall be treated as cognizable and non-bailablegeneral penalty2555 whoever, in any case in which a penalty is not expressly provided by this act, failsto comply with any notice or order issued under any provisions thereof, including an order of the chief privacy commissioner or otherwise contravenes any of the provisions of this act, shall be punishable with fine which may extend to one crore rupees, and, in the case of a continuing failure or contravention, with an additional fine which may extend upto ten lakh rupees for every day after the first during which he has persisted in such failure or contravention3056 the award of punishment for an offence under this act shall be without prejudiceto any other action which has been or which may be taken under this act with respect tosuch contraventionpunishment to be without prejudice to any other action 35 chapter ix miscellaneousprotection of action taken in good faith4057 no suit or other legal proceeding shall lie against the central government, stategovernment, privacy commission, chief privacy commissioner, privacy commissioner or any person acting under the direction either of the central government, state government, privacy commission, chief privacy commissioner or privacy commissioner in respect of anything which is in good faith done or intended to be done in pursuance of this act or of any rules or any order made thereunderpower to remove difficulties4558 (1) if any difficulty arises in giving effect to the provisions of this act, thecentral government may, by order, published in the official gazette, make such provisions, not inconsistent with the provisions of this act, as appears to it to be necessary or expedient for removing the difficulty:provided that no such order shall be made under this section after the expiry ofa period of three years from the commencement of this act(2) every order made under this section shall be laid, as soon as may be after itis made, before each house of  parliamentoverriding effect59 subject to the provisions of the schedule to this act, the provisions of this actshall have effect notwithstanding anything inconsistent therewith contained in any other law for the time being in forcepower to make rules60 (1) the central government may, by notification in the official  gazette, makerules to carry out the provisions of this act5(2) in particular, and without prejudice to the generality of the foregoing power, such rules may provide for—(a) the notification of theft, loss or damage under sub-section (4) of section 11;(b) the notification of disclosure under sub-section (4) of section 13;10(c) the application by an intelligence organisation under sub-section (2) of section15;(d) the application to intercept a communication under sub-section (1) ofsection 18;15(e) the application to renew an interception of communication undersub-section (2) of section 20;(f) the notification of an interception of communication under sub-section (1) ofsection 21;(g) the application to not inform under sub-section (2) of section 21;(h) the application to store information obtained as a result of any interceptionof communication under sub-section (2) of section 24;20(i) the application to carry out surveillance under sub-section (3) of section 26; (j) notification to the general public under sub-section (2) of section 27;(k) the application to renew surveillance under sub-section (2) of section 28; (l) the notification of surveillance under sub-section (1) of section 29;25(m) the application to not inform under sub-section (2) of section 29;(n) the application to store information obtained as a result of surveillance undersub-section (2) of section 32;30(o) salaries, allowances and other terms and conditions of service of the chiefprivacy commissioner, privacy commissioners, secretaries and other members, staff and employees of the privacy commission;(p) procedure to be followed by the privacy commission; (q) powers and duties of secretaries, officers and other employees of the privacycommission;(r) the effective implementation of this act35 40(3) every rule made under this act shall be laid, as soon as may be after it is made, before each house of parliament while it is in session for a period of thirty days which may be comprised in one session or in two successive sessions and if before the expiry of the session in which it is so laid or the session immediately following, both houses agree in making any modification in the rule, or both houses agree that the rule shuold not be made, the rule shall thereafter have effect only in such mofidied form or be of no effect, as the case may be, so however, that any such modification or annulment shall be without prejudice to the validity of anything previously done under that rule the schedule1 statutes, provisions whereof, shall have to comply with the requirements of this act—(a) sections 43a, 69, 69b, 72 and 72a of the information technology act, 2000(b) sections 28, 29, 30, 31, 32 and 33 of the aadhaar (targeted delivery offinancial and other subsidies, benefits and services) act, 2016(c) section 5(2) of the indian telegraph act, 1885 (d) section 21 of the prevention of money laundering act, 2002 (e) the census act, 19482 statutes, provisions whereof shall not be required to comply with the provisions of this act—(a) the representation of the people act, 1951 (b) the right to information act, 2005 statement of objects and reasonsour country is at the threshold of a new technological revolution, marrying welfare with programmes of digitization for the quick and effective delivery of government services and benefits from various schemes for this process, ranging from electronic banking to the transfer of subsidies, vast amounts of data are collected from our citizens, the integrity of which must be protected this data can be used for seemingly innocuous purposes such as targeted advertising but also for provision of essential services such as ration, credit, insurance, and more, while unprotected and in the wrong hands, it could also cause damage to the interests of the individualbeyond its commercial exploitation there is also an inherent equation of power when a person or entity possesses data and information concerning another individual or groups of individuals today, most such interactions are unregulated and put the users of internet and technological services at risk, and this risk will only grow with more and more digitization and as technological involvement in the delivery of services to citizens developsmany concerns arise from the absence of a comprehensive data protection and privacy statute which provides rights to individuals in a data governed world this has been recognized by past efforts of the government of india notably by the report of the group of experts on privacy chaired by justice ap shah, former chief justice, delhi high court drawing on the recommendations of this expert group, global best practices and also the unique factors that exist locally, this data privacy and protection bill aims to provide a comprehensive law to protect privacy and data collected from our citizensthis bill puts a person in control of his/her own data and further permits them to make an informed choice concerning its use the bill further provides an industry friendly model of co-regulation that aims to foster a higher degree of certainty for the private sector the concerns of government are also sought to be addressed with a balanced provision for interception and access, making special provisions to safeguard the security of the state the aims and objectives of the bill are sought to be implemented by an autonomous privacy commissionthe data privacy and protection bill, 2017 aims to protect and promote our constitutional ideals in a networked, increasingly digitized societyhence this billnew delhi;shashi tharoorjuly 2, 2017 financial memorandumclause 33 of this bill provides for establishment of the privacy commission it also provides for appointment of a select committee to fill vacancies in the privacy commission clause 34 provides for salaries and allowances payable to the chief privacy commissioner and allowances or remuneration payable to the privacy commissioners clause 36 provides for constitution of an adhoc committee to serve the functions of the privacy commission clause 37 provides for the appointment of a secretary, officers and other employees of the privacy commission the bill, therefore, if enacted, would involve expenditure from the consolidated fund of india it is estimated that a recurring expenditure of about rupees six hundred crore per annum from the consolidated fund of indiaa non-recurring expenditure of about rupees one hundred and twenty five crore is also likely to be involved memorandum regarding delegated legislationclause 60 of the bill empowers the central government to make rules for carrying out the purposes of this bill as the rules will relate to matters of detail only, the delegation of legislative power is of a normal character———— a billto establish an effective regime to protect the right to privacy of data all natural person;to set out conditions of surveillance and interception of communications of naturalpersons; and to constitute a privacy commission and for matters connectedtherewith or incidental thereto————(dr shashi tharoor, mp)gmgipmrnd—1121ls(s3)—28072017