ANIRUDH BURMAN
The recently released draft of the Digital Personal Data Protection Bill, 2022 is a pragmatic, evolved, and contextual approach to protecting Indian personal data. Significantly, it marks a clear rupture in the direction in which the debate on privacy has been evolving, where data privacy necessarily has to be protected by a powerful, cross-sectoral, and intrusive regulatory agency.
The 2019 version of the law, the Personal Data Protection Bill, 2019, was an expansive, cross-sectoral law that proposed many consumer rights and significant privacy-related compliance obligations on Indian businesses. Elevated protections were accorded to sensitive and critical personal data. Data fiduciaries had additional requirements to be designated as “significant.” Cross-border transfers of data were restricted based on whether the data was sensitive or critical. While some of these rights and requirements are necessary, the 2019 bill would have required a significant increase in compliance costs across the economy, especially for small businesses. The bill also proposed an independent regulatory agency, the Data Protection Authority, to implement the law, specify the details of many of its parts through regulations, and supervise compliance with the law and its own regulations. One major flaw in the 2019 bill—that is sadly present in the new version as well—was the exemptions given to government agencies from many data protection requirements. The bill’s biggest issue was the challenge of implementing all its provisions effectively, from ensuring a wide degree of compliance requirements to setting up a new regulatory agency with an expansive mandate. In contrast, when the EU adopted the General Data Protection Regulations (GDPR), it was preceded by almost three decades’ worth of privacy regulation and court jurisprudence. The GDPR harmonized this developed field of regulation across the EU. This was an incremental step in privacy regulation. Importantly, after the GDPR was enacted, many countries in the EU transitioned from pre-existing agencies or departments to creating independent Data Protection Authorities (DPAs).