Provision

Draft Personal Data Protection Bill, 2018

Personal Data Protection Bill, 2019

Definition of personal data 

• Personal data pertains to characteristics, traits or attributes of identity, which can be used to identify an individual.

• The Bill retains the definition and adds that such characteristics or traits will also include any inference drawn from such data for the purpose of profiling.

Sensitive personal data

• Sensitive personal data includes personal data related to health, sex life, sexual orientation, financial data, passwords, among others.  
• The Data Protection Authority can categorise any other personal data as sensitive personal data. 

• The Bill removes passwords from the category of sensitive personal data.  
• The power to further categorise personal data as sensitive personal data will lie with the central government (in consultation with Data Protection Authority and the sector regulator concerned).

Rights of individual (data principal)

• The data principal has certain rights with respect to their data such as obtaining confirmation on whether their data has been processed, seeking correction, transfer, or restriction on continuing disclosure of their data.

• The Bill provides the right to erasure of personal data which is no longer necessary for the purpose for which it was processed, as an additional right for the data principal.

Non-consensual processing of personal data

• Personal data may be processed without obtaining the consent of the individual on certain grounds.  These include: (i) any function of Parliament or state legislature, (ii) if required by the State for providing benefits to the individual, and (iii) for reasonable purposes specified by the Authority, such as fraud detection, debt recovery, and whistle blowing.   

• The Bill removes the provision on any function of Parliament or state legislature as a ground for non-consensual processing of personal data. 
• The Bill adds ‘operation of search engines’ as a reasonable purpose for which non-consensual processing of personal data may be allowed by the Authority.

Social media intermediaries

• The draft Bill did not contain this term.

• The Bill defines a social media intermediary as an intermediary which enables online interaction between users and allows for sharing of information.  
• All social media intermediaries which are classified as significant data fiduciaries (fiduciaries with users above a notified threshold whose actions can impact electoral democracy or public order) must provide a voluntary user verification mechanism for all users in India. 

Exemptions for the government for processing of personal data 

• The State is exempted from the provisions of the Bill while processing personal data in the interest of national security.     However, such processing must be permitted by a law and must be proportionate to the interests being achieved.  Further, such processing must be done in a fair and reasonable manner. 

• The government can exempt any of its agencies from any or all provisions of the Act, for processing of personal data in certain cases.     These include: (i) in interest of security of state, public order, sovereignty and integrity of India and friendly relations with foreign states, and (ii) for preventing incitement to commission of any cognisable offence relating to the above matters.

Exemptions for manual processing by small entities

• Transparency and accountability measures and certain other obligations will not apply to small entities.  These are fiduciaries which: (i) have annual turnover below Rs 20 lakh (or such lower amount as prescribed), and (ii) did not process data of more than 100 individuals in any one day in the last year.

• The Bill retains the exemption for small entities.     However, it does away with the prescribed limits and allows the Authority to classify fiduciaries as small entities based on the annual turnover of fiduciary and the volume of data processed by such fiduciary. 

Transfer of personal data outside country

 

• One serving copy of all personal data should be stored in India. 

• The Bill removes the provision for mandatory storage of all personal data in the country.  It provides that sensitive personal data must continue to be stored in India.  Such data can be transferred outside India if explicitly consented by the individual, and subject to certain additional conditions.

Composition of Data Protection Authority of India

• The chairperson and members of the Authority will be appointed by the central government on the recommendations of a selection committee.  The selection committee will be comprised of: (i) Chief Justice of India or a Judge of Supreme Court as the chairperson, (ii) Cabinet Secretary, and (iii) an expert in field of data protection, information technology and related subjects.

• The Bill provides that the selection committee will be comprised of: (i) Cabinet Secretary as the chairperson, (ii) Secretary, Department of Legal Affairs, and (iii) Secretary, Ministry of Electronics and Information Technology. 

Offences and penalties 

• Under the Bill, offences such as: (i) obtaining, disclosing, transferring, or selling personal data in contravention of the Act, and (ii) re-identification and processing of de-identified personal data (data from which identifiers have been removed) without consent, are punishable with imprisonment. 

• Under the Bill, re-identification and processing of de-identified personal without consent is the only offence punishable with imprisonment.  

Non-personal and anonymised personal data

• No provision of the Bill would apply to non-personal data used by government for formulation of policies for digital economy, growth or security. 

• The Bill retains the provision and further provides that the government can direct data fiduciaries to provide it any: (i) non-personal data and (ii) anonymised personal data (where it is not possible to identify data principal) for better targeting of services and formulation of evidence-based policy.