LegislationThe Personal Data Protection Bill, 2019: How it differs from the draft BillAnurag Vaishnav- December 27, 2019ThePersonal Data Protection Bill, 2019 was recently introduced in Parliament.  The Bill has been referred to a Joint Parliamentary Committee for detailed examination, and the Committee is expected to submit its report by the last week of Budget Session, 2020.  The Bill seeks to provide for the protection of personal data of individuals (known as data principals), and creates a framework for processing such personal data by other entities (known as data fiduciaries).  It provides the data principal with certain rights with respect to their data, such as seeking correction, completion or transfer of their data to other fiduciaries.   Similarly, it sets out certain obligations, and other transparency and accountability measures to be undertaken by the data fiduciary, such as instituting grievance redressal mechanisms to address complaints of individuals.  Processing of personal data is exempted from the provisions of the Bill in certain cases, such as security of state, public order, or for prevention, investigation, or prosecution of any offence.  The Bill also establishes a Data Protection Authority to ensure compliance with the provisions of the Bill and provide for further regulations.As per the Statement of Objects and Reasons of the 2019 Bill, the provisions of the Bill are based on the recommendations of thereport of the Expert Committee(Chair: Justice B. N. Srikrishna) which examined issues related to protection of personal data and proposed aDraft Personal Data Protection Bill, 2018.In a previousblog, we provided a brief background to the 2019 Bill, explained why a Bill was brought for personal data protection and what are some of the key provisions of the Bill.  In this blog, we look at how the 2019 Bill differs from the 2018 Draft Bill.Table 1:Comparison of the provisions of the 2018 Draft Bill with the 2019 BillProvisionDraft Personal Data Protection Bill, 2018Personal Data Protection Bill, 2019Definition of personal dataPersonal data pertains to characteristics, traits or attributes of identity, which can be used to identify an individual.The Bill retains the definition and adds that such characteristics or traits will also include any inference drawn from such data for the purpose of profiling.Sensitive personal dataSensitive personal data includes personal data related to health, sex life, sexual orientation, financial data, passwords, among others.The Data Protection Authority can categorise any other personal data as sensitive personal data.The Bill removes passwords from the category of sensitive personal data.The power to further categorise personal data as sensitive personal data will lie with the central government (in consultation with Data Protection Authority and the sector regulator concerned).Rights of individual (data principal)The data principal has certain rights with respect to their data such as obtaining confirmation on whether their data has been processed, seeking correction, transfer, or restriction on continuing disclosure of their data.The Bill provides the right to erasure of personal data which is no longer necessary for the purpose for which it was processed, as an additional right for the data principal.Non-consensual processing of personal dataPersonal data may be processed without obtaining the consent of the individual on certain grounds.  These include: (i) any function of Parliament or state legislature, (ii) if required by the State for providing benefits to the individual, and (iii) for reasonable purposes specified by the Authority, such as fraud detection, debt recovery, and whistle blowing.The Bill removes the provision on any function of Parliament or state legislature as a ground for non-consensual processing of personal data.The Bill adds ‘operation of search engines’ as a reasonable purpose for which non-consensual processing of personal data may be allowed by the Authority.Social media intermediariesThe draft Bill did not contain this term.The Bill defines a social media intermediary as an intermediary which enables online interaction between users and allows for sharing of information.All social media intermediaries which are classified as significant data fiduciaries (fiduciaries with users above a notified threshold whose actions can impact electoral democracy or public order) must provide a voluntary user verification mechanism for all users in India.Exemptions for the government for processing of personal dataThe State is exempted from the provisions of the Bill while processing personal data in the interest of national security.     However, such processing must be permitted by a law and must be proportionate to the interests being achieved.  Further, such processing must be done in a fair and reasonable manner.The government can exempt any of its agencies from any or all provisions of the Act, for processing of personal data in certain cases.     These include: (i) in interest of security of state, public order, sovereignty and integrity of India and friendly relations with foreign states, and (ii) for preventing incitement to commission of any cognisable offence relating to the above matters.Exemptions for manual processing by small entitiesTransparency and accountability measures and certain other obligations will not apply to small entities.  These are fiduciaries which: (i) have annual turnover below Rs 20 lakh (or such lower amount as prescribed), and (ii) did not process data of more than 100 individuals in any one day in the last year.The Bill retains the exemption for small entities.     However, it does away with the prescribed limits and allows the Authority to classify fiduciaries as small entities based on the annual turnover of fiduciary and the volume of data processed by such fiduciary.Transfer of personal data outside countryOne serving copy of all personal data should be stored in India.The Bill removes the provision for mandatory storage of all personal data in the country.  It provides that sensitive personal data must continue to be stored in India.  Such data can be transferred outside India if explicitly consented by the individual, and subject to certain additional conditions.Composition of Data Protection Authority of IndiaThe chairperson and members of the Authority will be appointed by the central government on the recommendations of a selection committee.  The selection committee will be comprised of: (i) Chief Justice of India or a Judge of Supreme Court as the chairperson, (ii) Cabinet Secretary, and (iii) an expert in field of data protection, information technology and related subjects.The Bill provides that the selection committee will be comprised of: (i) Cabinet Secretary as the chairperson, (ii) Secretary, Department of Legal Affairs, and (iii) Secretary, Ministry of Electronics and Information Technology.Offences and penaltiesUnder the Bill, offences such as: (i) obtaining, disclosing, transferring, or selling personal data in contravention of the Act, and (ii) re-identification and processing of de-identified personal data (data from which identifiers have been removed) without consent, are punishable with imprisonment.Under the Bill, re-identification and processing of de-identified personal without consent is the only offence punishable with imprisonment.Non-personal and anonymised personal dataNo provision of the Bill would apply to non-personal data used by government for formulation of policies for digital economy, growth or security.The Bill retains the provision and further provides that the government can direct data fiduciaries to provide it any: (i) non-personal data and (ii) anonymised personal data (where it is not possible to identify data principal) for better targeting of services and formulation of evidence-based policy.Sources: The Draft Personal Data Protection Bill, 2018; The Personal Data Protection Bill, 2019; PRS.Read MoreParliamentFirst no-confidence motion of the 17th Lok Sabha discussed todayNiranjana Menon- August 8, 2023Discussion on the first no-confidence motion of the 17thLok Sabha began today.  No-confidence motions and confidence motions are trust votes, used to test or demonstrate the support of Lok Sabha for the government in power.  Article 75(3) of the Constitution states that the government is collectively responsible to Lok Sabha.  This means that the government must always enjoy the support of a majority of the members of Lok Sabha.  Trust votes are used to examine this support.  The government resigns if a majority of members support a no-confidence motion, or reject a confidence motion.So far, 28 no-confidence motions (including the one being discussed today) and 11 confidence motions have beendiscussed.  Over the years, the number of such motions has reduced.  The mid-1960s and mid-1970s saw more no-confidence motions, whereas the 1990s saw more confidence motions.Figure1: Trust votes in ParliamentNote: *Term shorter than 5 years; **6-year term.Source: Statistical Handbook 2021, Ministry of Parliamentary Affairs; PRS.The no-confidence motion being discussed today wasmovedon July 26, 2023.  A motion of no-confidence is moved with the support of at least 50 members.   The Speaker has the discretion to allot time for discussion of the motion.  TheRules of Procedurestate that the motion must be discussed within 10 days of being introduced.  This year, the no-confidence motion wasdiscussed13 calendar days after introduction.  Since the introduction of the no-confidence motion on July 26, 12 Bills have been introduced and 18 Bills have been passed by Lok Sabha.  In the past, on four occasions, the discussion on no-confidence motions began seven days after their introduction.  On these occasions, Bills and other important issues were debated before the discussion on the no-confidence motion began.Figure2: Members rise in support of the motion of no-confidence in Lok SabhaSource: Sansad TV, Lok Sabha, July 26, 2023; PRS.Figure3: Number of days from introduction to discussion on no-confidence motionsNote: Number of days implies calendar days.Source: Statistical Handbook 2021, Ministry of Parliamentary Affairs; PRS.On average, no-confidence motions (excluding the one being discussed today) have been discussed for 13 hours over three days.  Discussions have lasted longer than 20 hours on four instances, most recently in 2003.  Today’s no-confidence motion was allotted 12 hours discussion time by theBusiness Advisory Committee.Following the discussion, the motion is put to vote.  26 out of 27 no-confidence motions (excluding the one being discussed today) have been voted upon and rejected.  This means that no government has ever had to resign following a vote of no-confidence.   On one occasion, in 1979, the discussion on a no-confidence motion against the Morarji Desai government remained inconclusive.  He resigned before the motion was put to vote.  50% of all no-confidence motions (14 out of 28) were discussed between 1965 and 1975.  Of these, 12 were against governments headed by Indira Gandhi.Figure4: Duration of discussion on no-confidence motionsNote: This graph excludes the no confidence motion moved on July 26, 2023.Source: Statistical Handbook 2021, Ministry of Parliamentary Affairs; PRS.In comparison, confidence motions have a more varied history.  The first motion, brought in 1979 to demonstrate confidence in Charan Singh’s government, was not discussed at all.  The Prime Minister resigned before the discussion could take place.  Since then, 11 confidence motions have been discussed in Lok Sabha, with nine occurring in the 1990s.  During this period, several coalition governments were formed, and Prime Ministers sought to prove their majority throughconfidence motions.   These motions have been discussed, on average, for 12 hours over two days.Figure5: Duration of discussion of confidence motionsSource: Statistical Handbook 2021, Ministry of Parliamentary Affairs; PRS.Of the 11 confidence motions discussed in Lok Sabha, seven were accepted.  On three instances, governments had to resign as they could not prove that they had the support of the majority.  On one instance in 1996, the motion was not put to vote.  Following an eleven-hour discussion on this confidence motion, Prime Minister Atal Bihari Vajpayee announced his intention to resign on the floor of the House.  He resigned 16 days into his term.Vajpayee became Prime Minister again in 1999, and faced another confidence motion.   This time, it was put to vote.   The motion was defeated by a margin of one vote.  This has been the closest result on a trust vote in the history of Lok Sabha.  The next closest result was when a motion of no-confidence against P V Narasimha Rao’s government was defeated by 14 votes in 1993.  In most cases, results have been in favour of the government by a large margin.«12345678910»