laws for privacy in India
Since the EU tightened the protection of personal data with the General Data Protection Regulation (GDPR), calls for implementing measures reducing data vulnerability and preventing erosion of user privacy have been resounding worldwide.
A series of allegations against tech giants for misuse and mishandling of personal data was a major turning point in how people look at the issue of data privacy breaches. Many jurisdictions subsequently overhauled existing laws to pave the way for stricter regulatory regimes.
India is no exception – and is also making efforts on this front.
Currently, this space is regulated by the Information Technology Act and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. Section 43A of the IT act entitles a data principal to seek compensation for unauthorised disclosure of sensitive personal information. Section 72A is the penal provision under which a person, including an intermediary who discloses sensitive personal information without consent, can be punished with imprisonment or a fine.
However, these laws are considered inadequate as their scope is quite limited. Therefore, a comprehensive draft law, the Personal Data Protection Bill, was introduced in 2018 to reshape the regulatory regime. It is aimed at providing the right governing mechanism and deploying the right data infrastructure so that the power of data could be unlocked for India.

Partner
LexOrbis in New Delhi
Email: manisha@lexorbis.com
But the bill has been hit by a series of controversies – and has already been amended thrice.
On referral to a Joint Parliamentary Committee (JPC) comprising members of both Houses of the Indian Parliament, the JPC report was published along with the revised Data Protection Bill on 16 December 2021. The new bill seeks to regulate both personal and non-personal data, which means that the scope of the proposed law has been widened.
As regards the foundation of the proposed legislation, it is based on the principle laid down by the Supreme Court of India in KS Puttaswamy v Union of India, according to which anything that restricts the right to privacy of a person should be sanctioned by law and must have procedural safeguards against abuse.
The most controversial element of the bill is virtually carte blanche exemptions for the government. Clause 35 exempts the government from compliance with all provisions when necessary for protecting the sovereignty and integrity of India, national security, friendly relations with foreign states, and public order. Despite sharp criticism, the JPC has retained this provision.
To limit the surveillance powers of the government, it has added an explanation saying the procedure to be followed by the government must be “fair, just, reasonable and proportionate”. Although adding this qualifier to exemption is a welcome move, it may not be sufficient.
Comments
Post a Comment