Provisions of data protection bill will enable state surveillance, impact businesses: Experts

The Digital Personal Data Protection Bill was introduced in the Parliament by Minister for Electronics and Information Technology Ashwini Vaishnaw on August 3.

Certain provisions of the Digital Personal Data Protection (DPDP) Bill that was tabled in the Parliament on August 3 may lead to the potential facilitation of state surveillance and impact businesses, civil society organisations and legal experts said.

The bill was introduced by Minister for Electronics and Information Technology Ashwini Vaishnaw amid protests by members of the Opposition, who alleged that the bill is in violation of the Right to Privacy and that it should be sent to the Parliamentary Committee for IT and Communications for further deliberations.

Also read: DPDP bill: Govt proposes Rs 25 crore one-time expense to set up Data Protection Board, annual expenditure of Rs 10 crore

Now it looks like the reservations regarding the bill are not just restricted to Opposition MPs but also to civil society organisations and so others.

Impact on business: Supratim Chakraborty, partner at Khaitan and Co pointed out that the Bill provides that even where consent is obtained for a specified purpose, the consent will only be valid where the processing of personal data is necessary for such specified purpose.

"This provision has significant implications for businesses as they will now be required to obtain consent for purposes which are necessary for which it is being collected," Chakraborty said.

Also read: DPDP Bill 2023: Data protection board may block content, govt gives itself wide exemptions from provisions and more

State surveillance: "The Internet Freedom Foundation is extremely disappointed by the version of the Digital Personal Data Protection Bill, 2023 (DPDPB. 2023) that has been introduced in the Lok Sabha today," digital rights body Internet Freedom Foundation said.

The IFF's main concern regarding the bill is regarding the "widening exemptions granted to government instrumentalities", which it said may increase State surveillance.

Increased blocking:  The DPDP Bill has introduced provisions of the Data Protection Authority to block any content hosted on any "computer resource".

"This move leads to overlaps and inconsistencies at various levels. Firstly, the DPB is only concerned with data protection issues, and content blocking cannot be read as an action directly flowing from data-related concerns," said Shruti Shreya, programme manager at The Dialogue.

"Sectoral regulators can always coordinate with the Government and give advice on matters that they may deem crucial. However, creating a substitute provision on content blocking, through another Act whose purpose is not to regulate online content is not an advisable approach," Shreya said.

Also read: Trade body representing Big Tech questions removal of ‘deemed consent’ from data protection bill

"A problematic provision is a clause added in the bill for blocking a computer resource which could be used for blocking websites and applications," a statement by Software Freedom Law Centre said.

Independence of Data Protection Board questioned: "Unfortunately the provisions on the Data Protection Board fall short of taking care of the concerns raised by industry and civil society all these year and during the consultation process, specially relating to independence of the Data Protection Board due to direct executive control," Salman Waris, partner at TechLegis.

"... Unfortunately the need for a strong and independent regulatory authority to enforce data protection measures is still not met and the mere are real concerns on the independence of the Data Protection Board under the Bill," Waris added.