Industry bodies concerned over data protection Bill, says it "compromises" on privacy
The Personal Data Protection Bill, 2019, was introduced in the Lok Sabha on Wednesday, and the government proposed sending the Bill to a joint select committee of both Houses of Parliament amid protests by the opposition.
The Internet and Mobile Association of India (IAMAI) said the Bill in its current form "compromises" on privacy of Indian citizens as "it has built in far too many exceptions for government agencies to access personal information of the citizens".
The Bill proposes that personal data will not be processed without consent of the owner of the information, and that no personal data will be processed except for clear and lawful purpose.
However, one of the provisions of the Bill will "empower the central government to exempt any agency of the government from application of the proposed legislation" - which experts say will give sweeping powers to government agencies to collect data of citizens.
The Bill also states that the Centre can direct any data processor to "provide any personal data anonymised or other non-personal data to enable better targeting of delivery of services or formulation of evidence-based policies by the central government".
The US-India Business Council (USIBC) said the Bill contains several new provisions outside the core issue of data privacy that raises serious concerns for the private sector, particularly the inclusion of requirements around non-personal data and social media intermediary liabilities.
"These two issues are distinct from personal data issues and are complex in their own right. Given the need for additional discussion, we urge the government to remain focused on essential data privacy issues and to take up these matters as part of existing policy efforts taking place in parallel to the Bill," it added.
IAMAI pointed out that the provision for the Centre to seek anonymised and non-personal data from any data fiduciary via the Data Protection Authority (DPA) - along with the fact that insights derived from personal data are also considered as personal data - raises issues of undermining Intellectual Property Rights of businesses engaged in data services.
The association also raised concerns over the fact that the government itself today offers many services in competition to private service providers. The right of the government over data assets of private businesses risks creating unlevel playing field for private businesses, it said.
The USIBC recommended that the Bill be revised to provide ample time for establishing a new DPA and strengthening the DPA's independence and effectiveness.
"We remain committed to working closely with the government as the Bill moves through the parliamentary process... we will continue to seek opportunities for industry and India's leading trading partners to share their views as new policy takes shape," it added.
IAMAI highlighted that the requirement to get a certification from the DPA in order to do business in India, would create a "restrictive Certification and Licensing regime" for organisations to operate in India.
"IAMAI highlighted that the world wide web (WWW) is borderless with many services originating in other countries and still being accessible to a global audience including India. Such a provision risks isolating India as service providers who do not get certification from the DPA cannot offer their services in India," it said. SR ANU