LegislationThe Personal Data Protection Bill, 2019: All you need to knowAnurag Vaishnav- December 23, 2019Recently, thePersonal Data Protection Bill, 2019was introduced in Parliament.  The Bill has been referred to a Joint Parliamentary Committee for detailed examination, and the report is expected bythe Budget Session, 2020.The Bill seeks to provide for protection of personal data of individuals, create a framework for processing such personal data, and establishes a Data Protection Authority for the purpose.  In this blog, we provide a background to the 2019 Bill, and explain some of its key provisions.What is personal data and data protection?Data can be broadly classified into two types: personal and non-personal data.  Personal data pertains to characteristics, traits or attributes of identity, which can be used to identify an individual.   Non-personal data includes aggregated data through which individuals cannot be identified.  For example, while an individual’s own location would constitute personal data; information derived from multiple drivers’ location, which is often used to analyse traffic flow, is non-personal data.  Data protection refers to policies and procedures seeking to minimise intrusion into the privacy of an individual caused by collection and usage of their personal data.Why was a Bill brought for personal data protection?In August 2017, the Supreme Courtheldthat privacy is a fundamental right, flowing from the right to life and personal liberty under Article 21 of the Constitution.  The Court also observed that privacy of personal data and facts is an essential aspect of the right to privacy.  In July 2017, a Committee of Experts, chaired by Justice B. N. Srikrishna, was set up to examine various issues related to data protection in India.  The Committee submitted itsreport, along with a Draft Personal Data Protection Bill, 2018 to the Ministry of Electronics and Information Technology in July 2018.  The Statement of Objects and Reasons of the Personal Data Protection Bill, 2019 states that the Bill is based on the recommendations of the report of the Expert Committee and the suggestions received from various stakeholders.How is personal data regulated currently?Currently, the usage and transfer of personal data of citizens is regulated by theInformation Technology (IT) Rules, 2011, under the IT Act, 2000.  The rules hold the companies using the data liable for compensating the individual, in case of any negligence in maintaining security standards while dealing with the data.  The Expert Committee in its report, held that while the IT rules were a novel attempt at data protection at the time they were introduced, the pace of development of digital economy has shown its shortcomings.3For instance, (i) the definition of sensitive personal data under the rules is narrow, and (ii) some of the provisions can be overridden by a contract.  Further, the IT Act applies only to companies, not to the government.What does the Personal Data Protection Bill provide?The Bill regulates personal data related to individuals, and the processing, collection and storage of such data.  Under the Bill, a data principal is an individual whose personal data is being processed.  The entity or individual who decides the means and purposes of data processing is known as data fiduciary.  The Bill governs the processing of personal data by both government and companies incorporated in India.  It also governs foreign companies, if they deal with personal data of individuals in India.Will individuals have rights over their data?The Bill provides the data principal with certain rights with respect to their personal data.   These include seeking confirmation on whether their personal data has been processed, seeking correction, completion or erasure of their data, seeking transfer of data to other fiduciaries, and restricting continuing disclosure of their personal data, if it is no longer necessary or if consent is withdrawn.  Any processing of personal data can be done only on the basis of consent given by data principal.Are there any restrictions on processing of an individual’s data?The Bill also provides for certain obligations of data fiduciaries with respect to processing of personal data.  Such processing should be subject to certain purpose, collection and storage limitations.   For instance, personal data can be processed only for specific, clear and lawful purpose.  Additionally, all data fiduciaries must undertake certain transparency and accountability measures such as implementing security safeguards and instituting grievance redressal mechanisms to address complaints of individuals.  Certain fiduciaries would be notified as significant data fiduciaries (based on certain criteria such as volume of data processed and turnover of fiduciary).  These fiduciaries must undertake additional accountability measures such as conducting a data protection impact assessment before conducting any processing of large scale sensitive personal data (includes financial data, biometric data, caste, religious or political beliefs).What is the grievance redressal mechanism if the above restrictions are not followed?To ensure compliance with the provisions of the Bill, and provide for further regulations with respect to processing of personal data of individuals, the Bill sets up a Data Protection Authority.  The Authority will be comprised of members with expertise in fields such as data protection and information technology.  Any individual, who is not satisfied with the grievance redressal by the data fiduciary can file a complaint to the Authority.  Orders of the Authority can be appealed to an Appellate Tribunal. Appeals from the Tribunal will go to the Supreme Court.Are there any exemptions to these safeguards for processing of personal data?Processing of personal data is exempt from the provisions of the Bill in some cases.  For example, the central government can exempt any of its agencies in the interest of security of state, public order, sovereignty and integrity of India, and friendly relations with foreign states.  Processing of personal data is also exempted from provisions of the Bill for certain other purposes such as prevention, investigation, or prosecution of any offence, or research and journalistic purposes.  Further, personal data of individuals can be processed without their consent in certain circumstances such as: (i) if required by the State for providing benefits to the individual, (ii) legal proceedings, (iii) to respond to a medical emergency.Is the Bill different from the draft Bill suggested by the Expert Committee?The Bill has made several changes from the draft Bill.  For instance, the Bill has added a new class of significant data fiduciaries, as social media intermediaries.  These will include intermediaries (with users above a notified threshold) which enable online interaction between users.  Further, the Bill has expanded the scope of exemptions for the government, and additionally provided that the government may direct data fiduciaries to provide it with any non-personal or anonymised data for better targeting of services.In a follow-up blog, we will provide a detailed comparison of the key provisions of this Bill with the Draft Personal Data Protection Bill 2018, released by the Justice B. N. Srikrishna Committee.Read MoreParliamentFirst no-confidence motion of the 17th Lok Sabha discussed todayNiranjana Menon- August 8, 2023Discussion on the first no-confidence motion of the 17thLok Sabha began today.  No-confidence motions and confidence motions are trust votes, used to test or demonstrate the support of Lok Sabha for the government in power.  Article 75(3) of the Constitution states that the government is collectively responsible to Lok Sabha.  This means that the government must always enjoy the support of a majority of the members of Lok Sabha.  Trust votes are used to examine this support.  The government resigns if a majority of members support a no-confidence motion, or reject a confidence motion.So far, 28 no-confidence motions (including the one being discussed today) and 11 confidence motions have beendiscussed.  Over the years, the number of such motions has reduced.  The mid-1960s and mid-1970s saw more no-confidence motions, whereas the 1990s saw more confidence motions.Figure1: Trust votes in ParliamentNote: *Term shorter than 5 years; **6-year term.Source: Statistical Handbook 2021, Ministry of Parliamentary Affairs; PRS.The no-confidence motion being discussed today wasmovedon July 26, 2023.  A motion of no-confidence is moved with the support of at least 50 members.   The Speaker has the discretion to allot time for discussion of the motion.  TheRules of Procedurestate that the motion must be discussed within 10 days of being introduced.  This year, the no-confidence motion wasdiscussed13 calendar days after introduction.  Since the introduction of the no-confidence motion on July 26, 12 Bills have been introduced and 18 Bills have been passed by Lok Sabha.  In the past, on four occasions, the discussion on no-confidence motions began seven days after their introduction.  On these occasions, Bills and other important issues were debated before the discussion on the no-confidence motion began.Figure2: Members rise in support of the motion of no-confidence in Lok SabhaSource: Sansad TV, Lok Sabha, July 26, 2023; PRS.Figure3: Number of days from introduction to discussion on no-confidence motionsNote: Number of days implies calendar days.Source: Statistical Handbook 2021, Ministry of Parliamentary Affairs; PRS.On average, no-confidence motions (excluding the one being discussed today) have been discussed for 13 hours over three days.  Discussions have lasted longer than 20 hours on four instances, most recently in 2003.  Today’s no-confidence motion was allotted 12 hours discussion time by theBusiness Advisory Committee.Following the discussion, the motion is put to vote.  26 out of 27 no-confidence motions (excluding the one being discussed today) have been voted upon and rejected.  This means that no government has ever had to resign following a vote of no-confidence.   On one occasion, in 1979, the discussion on a no-confidence motion against the Morarji Desai government remained inconclusive.  He resigned before the motion was put to vote.  50% of all no-confidence motions (14 out of 28) were discussed between 1965 and 1975.  Of these, 12 were against governments headed by Indira Gandhi.Figure4: Duration of discussion on no-confidence motionsNote: This graph excludes the no confidence motion moved on July 26, 2023.Source: Statistical Handbook 2021, Ministry of Parliamentary Affairs; PRS.In comparison, confidence motions have a more varied history.  The first motion, brought in 1979 to demonstrate confidence in Charan Singh’s government, was not discussed at all.  The Prime Minister resigned before the discussion could take place.  Since then, 11 confidence motions have been discussed in Lok Sabha, with nine occurring in the 1990s.  During this period, several coalition governments were formed, and Prime Ministers sought to prove their majority throughconfidence motions.   These motions have been discussed, on average, for 12 hours over two days.Figure5: Duration of discussion of confidence motionsSource: Statistical Handbook 2021, Ministry of Parliamentary Affairs; PRS.Of the 11 confidence motions discussed in Lok Sabha, seven were accepted.  On three instances, governments had to resign as they could not prove that they had the support of the majority.  On one instance in 1996, the motion was not put to vote.  Following an eleven-hour discussion on this confidence motion, Prime Minister Atal Bihari Vajpayee announced his intention to resign on the floor of the House.  He resigned 16 days into his term.Vajpayee became Prime Minister again in 1999, and faced another confidence motion.   This time, it was put to vote.   The motion was defeated by a margin of one vote.  This has been the closest result on a trust vote in the history of Lok Sabha.  The next closest result was when a motion of no-confidence against P V Narasimha Rao’s government was defeated by 14 votes in 1993.  In most cases, results have been in favour of the government by a large margin.«12345678910»
LegislationThe Personal Data Protection Bill, 2019: All you need to knowAnurag Vaishnav- December 23, 2019