5 major changes expected in revised DPDP Bill that will be tabled in Parliament

The revised Digital Personal Data Protection Bill, 2022 will be tabled in the Parliament on August 3

Minister for Electronics and Information Technology (MeitY) Ashwini Vaishnaw is set to table the Digital Personal Data Protection (DPDP) Bill on August 3 in the Lok Sabha, bringing India closer to having its first bill that lays down how a citizen's data can be processed while also providing safeguards against misuse of data and so on.

The development comes exactly a year after the government withdrew the DPDP Bill's predecessor, the Personal Data Protection Bill, on August 3, 2022, citing compliance-related concerns.

Following the withdrawal, the DPDP Bill 2022 was released for consultation. The government has made several changes in the 2023 version of the DPDP Bill based on responses received from the consultation. The new version was also approved by the Union Cabinet.

Here are a few major changes that are expected in the new version of the DPDP Bill, which Vaishnaw is set to table in the Parliament on August 3.

No more "deemed consent":  Consent given by the data principal was one of the contentious issues that are likely to be changed in the 2023 version of the bill that will be tabled on August 3. While the 2022 version of the bill includes a subsection on deemed consent, the current version seemingly does away with it.

In the 2022 version, consent was deemed to have been given in a situation where someone voluntarily provides their personal data and it is reasonably expected that they would do so (like at a restaurant); for the performance of any function under any law; for compliance with a judgment or order and so on.

However, the revised draft outlines certain legitimate uses, such as the processing of personal data, when it has been voluntarily shared and it is not indicated that the person has not consented etc.

Blocking powers: In a curious development, the new version of the DPDP Bill may give blocking powers to the Data Protection Board, the proposed data protection regulator under the bill. A copy of the new version of the bill, making the rounds of social media says that the DPB can block access to any content hosted on a "computer resource", "in the interests of the general public, for reasons to be recorded in writing".

This may make it more difficult for platforms to navigate the Indian techno-legal ecosystem, where concerns have already been raised regarding the existing blocking powers under IT (Blocking) Rules 2008, IT Act 2000 and so on.

Black list, not white list?: Another major change in the new version of the bill is regarding the countries where data will be allowed to be transferred from India. In the earlier version, the bill had said that it will "notfiy countries or territories outside India to which a data fiduciary may transfer personal data", or in other words a "white list" approach.

In contrast, in the new bill, it is expected that the Union government may, by notification, restrict the transfer of personal data by platforms to a particular country, or in other words, a "black list approach".

Appellate tribunal: As Moneycontrol had earlier reported that the Telecom Dispute Settlement and Appellate Tribunal (TDSAT) may be established as an appellate body over the Data Protection Board. An order passed by the appellate tribunal under the DPDP Bill will have the same powers as if it is a decree of a civil court. The TDSAT will deal with user appeals coming from the Data Protection Board.

Call for information: Unlike the previous draft, under the 2023 version, the Union government may be empowered to call for information from the Data Protection Board or any data fiduciary for the "purposes of the Act". The previous draft did not have any such provisions.