Recently, the Personal Data Protection Bill, 2019 was introduced in Parliament. The Bill has been referred to a Joint Parliamentary Committee for detailed examination, and the report is expected by the Budget Session, 2020. The Bill seeks to provide for protection of personal data of individuals, create a framework for processing such personal data, and establishes a Data Protection Authority for the purpose. In this blog, we provide a background to the 2019 Bill, and explain some of its key provisions.
What is personal data and data protection?
Data can be broadly classified into two types: personal and non-personal data. Personal data pertains to characteristics, traits or attributes of identity, which can be used to identify an individual. Non-personal data includes aggregated data through which individuals cannot be identified. For example, while an individual’s own location would constitute personal data; information derived from multiple drivers’ location, which is often used to analyse traffic flow, is non-personal data. Data protection refers to policies and procedures seeking to minimise intrusion into the privacy of an individual caused by collection and usage of their personal data.
Why was a Bill brought for personal data protection?
In August 2017, the Supreme Court held that privacy is a fundamental right, flowing from the right to life and personal liberty under Article 21 of the Constitution. The Court also observed that privacy of personal data and facts is an essential aspect of the right to privacy. In July 2017, a Committee of Experts, chaired by Justice B. N. Srikrishna, was set up to examine various issues related to data protection in India. The Committee submitted its report, along with a Draft Personal Data Protection Bill, 2018 to the Ministry of Electronics and Information Technology in July 2018. The Statement of Objects and Reasons of the Personal Data Protection Bill, 2019 states that the Bill is based on the recommendations of the report of the Expert Committee and the suggestions received from various stakeholders.
How is personal data regulated currently?
Currently, the usage and transfer of personal data of citizens is regulated by the Information Technology (IT) Rules, 2011, under the IT Act, 2000. The rules hold the companies using the data liable for compensating the individual, in case of any negligence in maintaining security standards while dealing with the data. The Expert Committee in its report, held that while the IT rules were a novel attempt at data protection at the time they were introduced, the pace of development of digital economy has shown its shortcomings.3 For instance, (i) the definition of sensitive personal data under the rules is narrow, and (ii) some of the provisions can be overridden by a contract. Further, the IT Act applies only to companies, not to the government.
What does the Personal Data Protection Bill provide?
The Bill regulates personal data related to individuals, and the processing, collection and storage of such data. Under the Bill, a data principal is an individual whose personal data is being processed. The entity or individual who decides the means and purposes of data processing is known as data fiduciary. The Bill governs the processing of personal data by both government and companies incorporated in India. It also governs foreign companies, if they deal with personal data of individuals in India.
Will individuals have rights over their data?
The Bill provides the data principal with certain rights with respect to their personal data. These include seeking confirmation on whether their personal data has been processed, seeking correction, completion or erasure of their data, seeking transfer of data to other fiduciaries, and restricting continuing disclosure of their personal data, if it is no longer necessary or if consent is withdrawn. Any processing of personal data can be done only on the basis of consent given by data principal.
Are there any restrictions on processing of an individual’s data?
The Bill also provides for certain obligations of data fiduciaries with respect to processing of personal data. Such processing should be subject to certain purpose, collection and storage limitations. For instance, personal data can be processed only for specific, clear and lawful purpose. Additionally, all data fiduciaries must undertake certain transparency and accountability measures such as implementing security safeguards and instituting grievance redressal mechanisms to address complaints of individuals. Certain fiduciaries would be notified as significant data fiduciaries (based on certain criteria such as volume of data processed and turnover of fiduciary). These fiduciaries must undertake additional accountability measures such as conducting a data protection impact assessment before conducting any processing of large scale sensitive personal data (includes financial data, biometric data, caste, religious or political beliefs).
What is the grievance redressal mechanism if the above restrictions are not followed?
To ensure compliance with the provisions of the Bill, and provide for further regulations with respect to processing of personal data of individuals, the Bill sets up a Data Protection Authority. The Authority will be comprised of members with expertise in fields such as data protection and information technology. Any individual, who is not satisfied with the grievance redressal by the data fiduciary can file a complaint to the Authority. Orders of the Authority can be appealed to an Appellate Tribunal. Appeals from the Tribunal will go to the Supreme Court.
Are there any exemptions to these safeguards for processing of personal data?
Processing of personal data is exempt from the provisions of the Bill in some cases. For example, the central government can exempt any of its agencies in the interest of security of state, public order, sovereignty and integrity of India, and friendly relations with foreign states. Processing of personal data is also exempted from provisions of the Bill for certain other purposes such as prevention, investigation, or prosecution of any offence, or research and journalistic purposes. Further, personal data of individuals can be processed without their consent in certain circumstances such as: (i) if required by the State for providing benefits to the individual, (ii) legal proceedings, (iii) to respond to a medical emergency.
Is the Bill different from the draft Bill suggested by the Expert Committee?
The Bill has made several changes from the draft Bill. For instance, the Bill has added a new class of significant data fiduciaries, as social media intermediaries. These will include intermediaries (with users above a notified threshold) which enable online interaction between users. Further, the Bill has expanded the scope of exemptions for the government, and additionally provided that the government may direct data fiduciaries to provide it with any non-personal or anonymised data for better targeting of services.
In a follow-up blog, we will provide a detailed comparison of the key provisions of this Bill with the Draft Personal Data Protection Bill 2018, released by the Justice B. N. Srikrishna Committee.
The Monetary Policy Committee (MPC) has decided to conduct an off-cycle meeting today to discuss the failure to meet the inflation target under Section 45ZN of the Reserve Bank of India Act, 1934. As per the Reserve Bank of India Act (RBI), 1934, MPC is required to meet at least four times each year, to discuss the macroeconomic issues in the country, and take policy decisions to address those. This is the second time MPC has conducted an off-cycle meeting in 2022-23. The meeting is scheduled in light of inflation being consistently high for nine consecutive months.
In this blog, we discuss what the inflation targeting framework is, examine retail and wholesale prices, and the divergence between them.
What is the inflation targeting framework, and what happens if inflation is persistently high?
In 2016, Parliament amended the RBI Act, 1934 to change the monetary policy, and introduce an inflation targeting framework. This framework prioritises price stability to achieve sustainable GDP growth. Price stability allows investors to confidently invest their money for productive activities, without worrying about it losing value. Price stability also maintains the purchasing power of consumers, i.e., the ability to purchase a good (or service) with a given amount of money.
As per the new framework, the central government, in consultation with RBI sets: (i) an inflation target, and (ii) an upper and lower tolerance level for retail inflation. The target has been set at 4%, with an upper tolerance limit of 6% and a lower tolerance limit of 2%. The upper and lower limits indicate that although it is desirable for inflation to be close to 4%, deviation between these limits is acceptable. The target and bands are revised every five years. In March 2021, the existing targets were carried forward.
Retail inflation has been above 6% for the past nine months, and it has been above 4% from October 2019 onwards (See Figure 1).
Figure 1: Consumer price index (year-on-year; in percentage)
Sources: Database on Indian Economy, Reserve Bank of India; PRS.
If inflation is above or below the prescribed limits for three quarters, RBI must submit a report to the central government explaining why prices have been rising (or falling) persistently, what will be done to correct that, and an estimate as to when the target will be achieved.
The MPC uses tools such as interest rates to control the level of inflation in the economy. One such rate is the policy repo rate, which is the rate at which RBI lends money to banks. An increase in the policy repo rate makes borrowing money more costly, and hence is expected to control inflation by reducing the money supply. MPC increased this rate from 4% in April 2022 to 4.4% in May 2022, to 4.9% in June 2022, to 5.4% in August 2022, and to 5.9% in September 2022.
Breaking down the Consumer Price Index and the Wholesale Price Index
Consumer Price Index (CPI) measures the general prices of goods and services such as food, clothing, and fuel over time. Retail inflation is calculated as the change in the CPI over a period of time. Goods and services such as petrol, food products, health, and education are considered for its calculation, which are assigned different weights (See Table 1). Between February 2022 and August 2022, the average annual inflation was 6.9%. The rise in prices of subcomponents of the CPI during this period is indicated in Table 2.
Table 1: Assigned weights for the calculation of CPI
Sources: MOSPI; PRS.
Table 2: Average inflation of some CPI components
Sources: Database on Indian Economy, RBI; PRS.
CPI is not the only index that measures inflation in an economy. The Wholesale Price Index (WPI) measures the wholesale prices of goods. A change in wholesale prices reflects wholesale inflation. Table 3 indicates the weights assigned to goods for calculating the WPI. Manufactured goods include metals, chemicals, food products, and textiles.
Primary articles (23%) include food articles, and crude petroleum and natural gas. Fuel and power (12%) include mineral oils, electricity, and coal. WPI has remained above 10% from April 2021 onwards. It reached an all-time high of 17% in May 2022. This was driven by the inflation in metals, kerosene and petroleum coke, fruits and vegetables, and palm oil.
Table 3:Assigned weights for the
Sources: Ministry of Commerce and Industry; PRS.
Why has WPI inflation been consistently above CPI inflation?
Movements in the WPI have an impact on the CPI. For almost a year and half, CPI inflation has remained below WPI inflation. However, as per the design of the indices, it is expected that CPI would remain above WPI, and that any increase in WPI would reflect in the CPI after a time lag. This is because retail prices include taxes (as a percentage of price), while wholesale prices do not. Additionally, some of the goods in WPI act as inputs in the goods considered in CPI. An increase in input prices would lead to higher retail prices after a time lag.
We discuss possible reasons for why CPI has remained below WPI for a year and a half.
Figure 2: Consumer Price Index and Wholesale Price Index
Sources: Database on Indian Economy, Reserve Bank of India; PRS.
Composition of indices
As indicated in Table 2 and 3, the composition of the two indices varies. For instance, prices of manufacture of basic metals, chemicals, and machinery grew at an average rate of 13% between February 2021 and September 2022. They contribute 7% to the WPI. These are input goods for producing final goods and services such as automobiles, which are included in the CPI. The rise in prices of transport vehicles, communication devices, fuel for transport, and housing (CPI components) rose by 6% during this period.
The Ministry of Finance has observed that wholesale prices did not feed into retail prices (from March 2021 onwards) as wholesalers absorbed the rising input costs and did not pass them on to retailers. In August 2022, it noted that as retail prices are rising now, the pass-through may occur.