The Personal Data Protection Bill, 2019 was introduced by the Ministry of Electronics and Information Technology on 11th of December 2019. The bill was very much similar to the GDPR (General Data Protection Regulation) in the European Union.

The act mainly aimed at protecting the interests of individuals with regards to data protection, specifically, Personal data. It does so by limiting the system of processing of data by company, mandating the consent of the individual for processing the data, establishing a dedicated Public Data Authority that shall adjudicate upon related issues. The bill however, as on today, stands withdrawn after deliberations for almost three years. The reason for the same is said to reframe the bill to include a comprehensive view of various facets of data privacy and data protection in this growing and expanding age of Information Technology. 

Join Now! India's Largest directory of lawyers and legal professionals

Personal data with reference to the proposed bill refers to “data about or relating to a natural person who is directly or indirectly identifiable, having regard to any characteristic, trait, attribute or any other feature of the identity of such natural person, whether online or offline, or any combination of such features with any other information, and shall include any inference drawn from such data for the purpose of profiling.”

The applicability of the provisions extends to government, Companies incorporated in India, Foreign Companies (data fiduciaries or processors) processing of data in connections with any business carried out in India or involving profiling of data principals within the territory of India. 

The Bill provides that a fiduciary can process a data of an individual only if consent for the same is provided by such person and then too in a fair and reasonable manner ensuring privacy of the individual. However, there are exceptions here as well. For example, the data can be processed without consent in case of medical emergency, order of court of tribunal or under any law for the time being in force. 

In 2021, a Joint Committee of the Indian Parliament which is the committee set up to frame and propose the said legislation suggested 81 amendments to the draft Bill. The JPC also recommended that the Bill be amended to include 'non-personal data' within the provisions which widens the scope the bill to a large extent. 

In this view, the challenges the legislation bring about is predominantly to IT companies and businesses collecting data of the customers/ clients as a strong privacy system has to be ensured if this bill is enacted. Similarly, this bill may act as hindrance to industries venturing to bring about AI (Artificial Intelligence) related products. AI based projects rely, to large extent, on the data collected by it. The Organizations have been so focused on collecting data which enhance the AI practice. Now, this bill if enacted, will form a question mark over the impending AI development in the country.

Criticisms to the bill- 

• It is criticized to be biased towards the data collecting entity. The bill while granting rights and protection to the individuals and mandating requirement of consent to process the data of individuals, it also makes the process of withdrawal of consent tedious as the consent cannot be withdrawn without any ‘valid reason’, while giving no clear definition or guideline as to what a valid reason can be. The requirement of having a valid consent will make the process so much cumbersome and will in turn negate the purpose of the act. 
• The law also creates certain circumstances wherein the data can be processed without the consent of the individual. 
• The Bill grants the government a provision to use and process the data in interest of sovereignty, Public Order, Security, Foreign relations or preventing any cognizable offence. This gives the state and the government the right to access any and every data. 
• The Bill permits an employer to use the data of employees without their consent for recruitment, termination and other relating activities in relation to employees.