The Parliamentary Standing Committee on Communications and Information Technology criticised the government for the delay in the introduction of the rules of the Digital Personal Data Protection (DPDP) Act, stating that the delay has prevented the notification of the Data Protection Board and other essential components of the law.
The Parliamentary panel pointed out that the DPDP Act had laid down that the rules would be in place within six months from the enactment of the law. The DPDP Act was notified on August 11, 2023, which brings the six-month timeline to an end in February 2024.
The committee urged the government to prioritise its formulation and asked the government "to avoid asking for an extension". The DPDP rules are necessary because certain clauses of the DPDP Act require additional provisions and directions.
Explained: What the Digital Personal Data Protection Bill means for you
The report "Citizens' Data Security and Privacy", published by the committee on February 8 said, "The Committee expected that since the data protection law was notified on August 11, 2023, the Rules in this regard should now be nearing completion."
"However, the Committee observe that the lack of properly framed rules has prevented the notification of essential components of the data privacy law, including the Data Privacy Board, which is mandated to investigate privacy breaches and impose penalties as outlined in the Act," the report added.
The report was considered and adopted by the committee at their sitting held on February 6.
"Recognizing the pivotal role of Rules in the implementation of the Act practical and feasible, the committee urge the ministry to prioritise this matter, so as to ensure that drawing up of Rules is completed within the prescribed period of six months and avoid seeking an extension," it added.
The committee has asked the government to inform of the steps taken to bring in the DPDP Rules at the earliest.
Digital India Bill: When?
The committee also enquired of the government regarding the Digital Indian Bill. The bill is aimed at superseding the existing over-two decade-old Information Technology Act.
"The Committee, therefore, urged the Ministry to promptly conclude the framework for the Digital India Bill and expedite its enactment without unnecessary delays. Upon reviewing the action taken notes of the
Ministry the Committee observes the lack of a specified timeline for rolling out the Digital India Bill," the report said.
Digital India Bill may bring in guardrails against AI algorithms, offer opt-out rights
"There is no indication of the government introducing the Act in the upcoming session of Parliament. Consequently, the ministry has ample time to release the draft bill for public consultation before its presentation in Parliament," it read.
"The committee, reiterating their earlier recommendation strongly urge the ministry to promptly finalise the draft of the Digital India (DIA) Bill without any further delay. The earliest action in this regard would be appreciated," it added.
Misuse of 'legitimate uses'
Additionally, the panel also highlighted potential misuse of the "legitimate uses" clause of the DPDP Act, where public or private entities are empowered to process a person’s data without their consent in specific cases.
"Notwithstanding that, the committee had expressed concern regarding the potential misuse of these exceptions. Therefore, the Ministry was urged to establish a mechanism that prevents these exceptions from becoming the norm and ensure that they are employed only in exceptional situations," the report said.
The report said that the committee has noted that the Ministry of Electronics and Information Technology is aware of the potential misuse. "However, the committee finds that ministry has not outlined any specific in this regard," the report added.
Discover the latest Business News, Sensex, and Nifty updates. Obtain Personal Finance insights, tax queries, and expert opinions on Moneycontrol or download the Moneycontrol App to stay updated!
