Latest News
EDITORIALS & ARTICLES
The issues, debate around Data Protection Bill
The pandemic has increased people’s participation in the digital economy. Unfortunately, the number of personal data breaches from major digital service providers has increased worryingly in the same period.
The recent alleged data breach at MobiKwik could stand to be India’s biggest breach with the data of 9.9 crore users at risk. Given the significance of data in this age, robust data protection regimes are necessary to prevent such events and protect users’ interests.
Presently, how different entities collect and process users’ personal data in India is mainly governed by the Information Technology Act, 2000, but this data protection regime falls short of providing effective protection to users and their personal data.
However, the Personal Data Protection Bill, 2019 (which is now under scrutiny by a Joint Parliamentary Committee) could play a big role in providing robust protections to users and their personal data.
Associated Issues With IT Act
- Issue of Consent: Data aggregator entities could override the protections in the regime by taking users’ consent to process personal data under broad terms and conditions.
- This is problematic given that users might not understand the terms and conditions or the implications of giving consent.
- Neglecting Data Privacy: The frameworks under IT Act emphasize data security but do not place enough emphasis on data privacy.
- In essence, while entities must employ technical measures to protect personal data, they have weaker obligations to respect users’ preferences in how personal data can be processed.
- Large Vacuum for Data Protection: The data protection provisions under the IT Act also do not apply to government agencies. This creates a large vacuum for data protection when governments are collecting and processing large amounts of personal data.
- Becoming Obsolete: IT Act was enacted in 2000 and further amended in 2008. However, technology and cross-platform integration have increased exponentially.
- Therefore, the current data protection regime seems to have become inadequate in addressing risks emerging from new developments in data processing technology.
- Defining the Roles: The Bill envisages codifying the relationship between individuals and firms/state institutions as one between “data principals” (whose information is collected) and “data fiduciaries” (those processing the data) so that privacy is safeguarded by design.
- Also, the Bill seeks to apply the data protection regime to both government and private entities across all sectors.
- Ensuring Data Privacy: The Bill seeks to emphasize that data principals will have to maintain security safeguards to protect personal data and also have to fulfill a set of data protection obligations and transparency and accountability measures.
- In nutshell, the provides scrutiny on these entities govern and process personal data to uphold users’ privacy and interests.
- Rights of the Citizens: The Bill seeks to give users a set of rights over their personal data and means to exercise those rights.
- For instance, a user will be able to obtain information about the different kinds of personal data that an entity has about them and how the entity is processing that data.
- Establishing a Regulator: The Bill seeks to create an independent and powerful regulator known as the Data Protection Authority (DPA).
- The DPA will monitor and regulate data processing activities to ensure their compliance with the regime.
- More importantly, the DPA will give users a channel to seek redress when entities do not comply with their obligations under the regime.
- Scope for Loopholes: For instance, under clause 35, the Central government can exempt any government agency from complying with the Bill.
- Government agencies will then be able to process personal data without following any safeguard under the Bill.
- This could create severe privacy risks for users.
- Compromised Concept of Consent: Similarly, users could find it difficult to enforce various user protection safeguards (such as rights and remedies) in the Bill.
- For instance, the Bill threatens legal consequences for users who withdraw their consent for a data processing activity.
- In practice, this could discourage users from withdrawing consent for processing activities they want to opt-out of.
- Sweeping Mandate of DPA: DPA will be tasked with regulating the provisions of the bill to frame regulations on issues such as mechanisms for taking consent, limitations on the use of data, and cross-border transfer of data.
- The supervisory mandate of the DPA is sweeping, given the fact that it has to regulate a wide array of preventive obligations, such as security safeguards and transparency requirements.
|
POSTED ON 17-04-2021 BY ADMIN
Next previous 
General Studies
Political Science and International Relations
Some Reference Essays
List of previous year essay topics (1997-2019)
IAS GOOGLE is googled by the team of Raja Sir’s Cracking IAS Academy. Sources include The Hindu, Indian Express, pib.nic.in, Down To Earth, Economic Times, Vigyan Prasar, AIR and the like. IAS GOOGLE has been prepared in pace with emerging UPSC Trends.