India’s Digital Personal Data Protection Bill passed: “it’s a bad law”

Personal Data Protection Bill: this is not the privacy law India needs

Access Now is calling for immediate, concrete moves to protect people’s privacy after the Joint Parliamentary Committee (JPC) on the Personal Data Protection Bill failed to safeguard rights in its report tabled in the Indian Parliament today. 

“The current legislative vacuum puts the fundamental right to privacy of millions of people in India at risk,” said Namrata Maheshwari, Asia Pacific Policy Counsel at Access Now. “However, authorities have failed to seize this opportunity for positive change, and the JPC’s report does not adequately address the shortcomings in the current draft. As it stands, this is not the legislation India needs.” 

The ill-directed recommendations come after two years of deliberations, in which multiple members of the JPC have filed dissent notes highlighting, among other things, the wide exemptions granted to government agencies. The most troublesome areas of the report include:

  • Granting exceptions without safeguards for the Central Government, that can, in effect, exempt nearly any government agency or department from the requirements of the data protection law without independent oversight or approval if they assert that they follow “just, fair, reasonable, and proportionate” procedures;
  • Unduly expanding the scope of the Bill and reaching beyond the JPC’s mandate by recommending the establishment of an alternative statutory body to fill the role of the Press Council of India, as it is “not appropriately equipped to regulate the journalism sector;” pushing for the bill to also regulate non-personal data, diluting its focus and prescribing similar treatment for different types of data, muddling the duties of the proposed Data Protection Authority (DPA); and pressing for social media networks to be treated as publishers of content, potentially losing their safe-harbour protection; and
  • Leaving the independence of the DPA in peril by failing to ensure its complete independence, and granting the executive significant influence on its composition and policies, hampering effective implementation and meaningful protection of people’s privacy. 

“Access Now has consistently advocated for the urgent need for strong data protection legislation in India, and after today’s disappointing tabling, we assure the people of India that the fight isn’t over,” said Raman Jit Singh Chima, Asia Pacific Policy Director at Access Now. “The people of India deserve a strong privacy law, one that demonstrates a commitment to prioritising fundamental rights. Their voices must be heard by Parliament.”

Access Now is calling for lawmakers to immediately commit to only passing an amended, stronger data protection law, and to include public interest groups, civil society, and subject matter experts in discussions. The Government of India must not push the current flawed text through the parliamentary process. People in India are entitled to a data protection legislation which upholds international standards, human rights principles, and safeguards in line with the Supreme Court of India’s rulings on the right to privacy