Data protection bill: Users may be able to appeal decisions of board with another body

In 2022, the Indian government released the DPDB bill for consultation last week, months after withdrawing the Personal Data Protection Bill 2019, which had been under consideration for years

In the revised Digital Personal Data Protection (DPDP) Bill that is set to be tabled soon in the Parliament, the government may introduce an appellate body for customers to appeal decisions of the Data Protection Board, sources close to the developments told Moneycontrol.

This will be a significant change from the draft of the bill that was released in 2022, where only the Data Protection Board (DPB) could conduct proceedings or inquiries and give their decisions while dealing with user complaints related to data breaches and so on.

Moneycontrol has learned that the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) may be roped into adjudicating such disputes and disposing of appeals coming in from the Data Protection Board.

"There was a thinking that by just having the DPB, it may have led to a lot of court cases," said a source.

This proposed two-tiered grievance redressal mechanism is also similar to the government's method of dealing with user complaints pertaining to the social media sector. This year, in March, the government notified Grievance Appellate Committees (GAC) for dealing with appeals of decisions of grievance officers in social media companies.

What DPB will do

The board is set to be established by the Central government and will have an organisation structure headed by a chairperson, members, officers and other employees.

Essentially, the board will determine non-compliance to the provisions of the data protection bill and will have the power to impose penalties in this regard.

Going by the draft released last year, the government has said that the board will function as an independent body and will also have a digital presence for taking in user complaints.

DPB independence questioned

Justice BN Srikrishna, who led the committee that drafted the Personal Data Protection Bill in July 2018, had earlier pointed out that it will be difficult for the DPB to be independent of the government.

"Who should be a member of the Board? What will be its qualification? There is nothing on that front in the bill. The government can very well back up the board with its own officers, and the board will not be independent," he had said.

"The Board should have independent members, experts in the field such as academicians, maybe practitioners, even people from abroad. It can be headed by an independent person like a retired judge," he opined.