The Personal Data Protection Bill, 2019: How it differs from the draft Bill

Anurag Vaishnav - December 27, 2019

The Personal Data Protection Bill, 2019 was recently introduced in Parliament. The Bill has been referred to a Joint Parliamentary Committee for detailed examination, and the Committee is expected to submit its report by the last week of Budget Session, 2020. The Bill seeks to provide for the protection of personal data of individuals (known as data principals), and creates a framework for processing such personal data by other entities (known as data fiduciaries). It provides the data principal with certain rights with respect to their data, such as seeking correction, completion or transfer of their data to other fiduciaries. Similarly, it sets out certain obligations, and other transparency and accountability measures to be undertaken by the data fiduciary, such as instituting grievance redressal mechanisms to address complaints of individuals. Processing of personal data is exempted from the provisions of the Bill in certain cases, such as security of state, public order, or for prevention, investigation, or prosecution of any offence. The Bill also establishes a Data Protection Authority to ensure compliance with the provisions of the Bill and provide for further regulations.

As per the Statement of Objects and Reasons of the 2019 Bill, the provisions of the Bill are based on the recommendations of the report of the Expert Committee (Chair: Justice B. N. Srikrishna) which examined issues related to protection of personal data and proposed a Draft Personal Data Protection Bill, 2018.

In a previous blog, we provided a brief background to the 2019 Bill, explained why a Bill was brought for personal data protection and what are some of the key provisions of the Bill. In this blog, we look at how the 2019 Bill differs from the 2018 Draft Bill.

Table 1: Comparison of the provisions of the 2018 Draft Bill with the 2019 Bill

Provision	Draft Personal Data Protection Bill, 2018	Personal Data Protection Bill, 2019
Definition of personal data	Personal data pertains to characteristics, traits or attributes of identity, which can be used to identify an individual.	The Bill retains the definition and adds that such characteristics or traits will also include any inference drawn from such data for the purpose of profiling.
Sensitive personal data	Sensitive personal data includes personal data related to health, sex life, sexual orientation, financial data, passwords, among others. The Data Protection Authority can categorise any other personal data as sensitive personal data.	The Bill removes passwords from the category of sensitive personal data. The power to further categorise personal data as sensitive personal data will lie with the central government (in consultation with Data Protection Authority and the sector regulator concerned).
Rights of individual (data principal)	The data principal has certain rights with respect to their data such as obtaining confirmation on whether their data has been processed, seeking correction, transfer, or restriction on continuing disclosure of their data.	The Bill provides the right to erasure of personal data which is no longer necessary for the purpose for which it was processed, as an additional right for the data principal.
Non-consensual processing of personal data	Personal data may be processed without obtaining the consent of the individual on certain grounds. These include: (i) any function of Parliament or state legislature, (ii) if required by the State for providing benefits to the individual, and (iii) for reasonable purposes specified by the Authority, such as fraud detection, debt recovery, and whistle blowing.	The Bill removes the provision on any function of Parliament or state legislature as a ground for non-consensual processing of personal data. The Bill adds ‘operation of search engines’ as a reasonable purpose for which non-consensual processing of personal data may be allowed by the Authority.
Social media intermediaries	The draft Bill did not contain this term.	The Bill defines a social media intermediary as an intermediary which enables online interaction between users and allows for sharing of information. All social media intermediaries which are classified as significant data fiduciaries (fiduciaries with users above a notified threshold whose actions can impact electoral democracy or public order) must provide a voluntary user verification mechanism for all users in India.
Exemptions for the government for processing of personal data	The State is exempted from the provisions of the Bill while processing personal data in the interest of national security. However, such processing must be permitted by a law and must be proportionate to the interests being achieved. Further, such processing must be done in a fair and reasonable manner.	The government can exempt any of its agencies from any or all provisions of the Act, for processing of personal data in certain cases. These include: (i) in interest of security of state, public order, sovereignty and integrity of India and friendly relations with foreign states, and (ii) for preventing incitement to commission of any cognisable offence relating to the above matters.
Exemptions for manual processing by small entities	Transparency and accountability measures and certain other obligations will not apply to small entities. These are fiduciaries which: (i) have annual turnover below Rs 20 lakh (or such lower amount as prescribed), and (ii) did not process data of more than 100 individuals in any one day in the last year.	The Bill retains the exemption for small entities. However, it does away with the prescribed limits and allows the Authority to classify fiduciaries as small entities based on the annual turnover of fiduciary and the volume of data processed by such fiduciary.
Transfer of personal data outside country	One serving copy of all personal data should be stored in India.	The Bill removes the provision for mandatory storage of all personal data in the country. It provides that sensitive personal data must continue to be stored in India. Such data can be transferred outside India if explicitly consented by the individual, and subject to certain additional conditions.
Composition of Data Protection Authority of India	The chairperson and members of the Authority will be appointed by the central government on the recommendations of a selection committee. The selection committee will be comprised of: (i) Chief Justice of India or a Judge of Supreme Court as the chairperson, (ii) Cabinet Secretary, and (iii) an expert in field of data protection, information technology and related subjects.	The Bill provides that the selection committee will be comprised of: (i) Cabinet Secretary as the chairperson, (ii) Secretary, Department of Legal Affairs, and (iii) Secretary, Ministry of Electronics and Information Technology.
Offences and penalties	Under the Bill, offences such as: (i) obtaining, disclosing, transferring, or selling personal data in contravention of the Act, and (ii) re-identification and processing of de-identified personal data (data from which identifiers have been removed) without consent, are punishable with imprisonment.	Under the Bill, re-identification and processing of de-identified personal without consent is the only offence punishable with imprisonment.
Non-personal and anonymised personal data	No provision of the Bill would apply to non-personal data used by government for formulation of policies for digital economy, growth or security.	The Bill retains the provision and further provides that the government can direct data fiduciaries to provide it any: (i) non-personal data and (ii) anonymised personal data (where it is not possible to identify data principal) for better targeting of services and formulation of evidence-based policy.

Sources: The Draft Personal Data Protection Bill, 2018; The Personal Data Protection Bill, 2019; PRS.

Policy

Examining pendency of cases in the Judiciary

Roshni Sinha - August 8, 2019

Yesterday, Parliament passed a Bill to increase the number of judges in the Supreme Court from 30 to 33 (excluding the Chief Justice of India). The Bill was introduced in view of increasing pendency of cases in the Supreme Court. In 2012, the Supreme Court approved the Scheme of National Court Management System to provide a framework for case management. The scheme estimated that with an increase in literacy, per capita income, and population, the number of new cases filed each year may go up to 15 crore over the next three decades, which will require at least 75,000 judges. In this blog, we analyse the pendency of cases at all three levels of courts, i.e. the Supreme Court, the Highs Courts, and the subordinate courts, and discuss the capacity of these courts to dispose of cases.

Pendency in courts has increased over the years; 87% of all pending cases are in subordinate courts

Sources: Court News, 2006, Supreme Court of India; National Data Judicial Grid accessed on August 7, 2019; PRS.

Overall, the pendency of cases has increased significantly at every level of the judicial hierarchy in the last decade. Between 2006 and now, there has been an overall increase of 22% (64 lakh cases) in the pendency of cases across all courts. As of August 2019, there are over 3.5 crore cases pending across the Supreme Court, the High Courts, and the subordinate courts. Of these, subordinate courts account for over 87.3% pendency of cases, followed by 12.5% pendency before the 24 High Courts. The remaining 0.2% of cases are pending with the Supreme Court. The primary reason for growing pendency of cases is that the number of new cases filed every year has outpaced the number of disposed of cases. This has resulted in a growing backlog of cases.

In High Courts and subordinate courts, over 32 lakh cases pending for over 10 years

Sources: National Data Judicial Grid accessed on August 7, 2019; Court News, 2006-17, Supreme Court of India; PRS.

In the High Courts, over 8.3 lakh cases have been pending for over 10 years. This constitutes 19% of all pending High Court cases. Similarly, in the subordinate courts, over 24 lakh cases (8%) have been pending for over 10 years. Overall, Allahabad High Court had the highest pendency, with over seven lakh cases pending as of 2017.

Despite high pendency, some High Courts have managed to reduce their backlog. Between 2006 and 2017, pendency of cases reduced the most in Madras High Court at a rate of 26%, followed by Bombay High Court at 24%. Conversely, during the same period, the pendency of cases doubled in the Andhra Pradesh High Court, and increased by 2.5 times in Karnataka High Court.

As a result of pendency, number of under-trials in prison is more than double that of convicts

Sources: Prison Statistics in India, 2015, National Crime Record Bureau; PRS.

Over the years, as a result of growing pendency of cases for long periods, the number of undertrials (accused awaiting trial) in prisons has increased. Prisons are running at an over-capacity of 114%. As of 2015, there were over four lakh prisoners in jails. Of these, two-thirds were undertrials (2.8 lakh) and the remaining one-third were convicts.

The highest proportion of undertrials (where the number of inmates was at least over 1,000) were in J&K (85%), followed by Bihar (82%). A total of 3,599 undertrials were detained in jails for more than five years. Uttar Pradesh had the highest number of such undertrials (1,364) followed by West Bengal (294).

One interesting factor to note is that more criminal cases are filed in subordinate courts than in High Courts and Supreme Court. Of the cases pending in the subordinate courts (which constitute 87% of all pending cases), 70% of cases were related to criminal matters. This increase in the pendency of cases for long periods over the years may have directly resulted in an increase in the number of undertrials in prisons. In a statement last year, the Chief Justice of India commented that the accused in criminal cases are getting heard after serving out their sentence.

Vacancies in High Courts and Subordinate Courts affect the disposal of cases

Sources: Court News, 2006-17, Supreme Court of India; PRS.

Vacancy of judges across courts in India has affected the functioning of the judiciary, particularly in relation to the disposal of cases. Between 2006 and 2017, the number of vacancies in the High Courts has increased from 16% to 37%, and in the subordinate courts from 19% to 25%. As of 2017, High Courts have 403 vacancies against a sanctioned strength of 1,079 judges, and subordinate courts have 5,676 vacancies against a sanctioned strength of 22,704 judges. As of 2017, among the major High Courts (with sanctioned strength over 10 judges), the highest proportion of vacancies was in Karnataka High Court at 60% (37 vacancies), followed by Calcutta High Court at 54% (39 vacancies). Similarly, in major subordinate courts (with sanctioned strength over 100 judges), the highest proportion of vacancies was in Bihar High Court at 46% (835 vacancies), followed by Uttar Pradesh High Court at 42% (1,348 vacancies).

Home

MPs & MLAs

Legislatures

Parliament

State

Bills & Acts

Budgets

Policy

LAMP

Careers

The Personal Data Protection Bill, 2019: How it differs from the draft Bill

Examining pendency of cases in the Judiciary

Recent Posts