Union Cabinet clears personal data protection bill: Sources

This draft bill has undergone extensive consultation and the government is aiming to introduce in Parliament by the Monsoon Session

The Union cabinet has today cleared the personal data protection bill which clears its way to be tabled in the Parliament during the upcoming Monsoon session, CNBC Awaaz reported quoting sources.

This is the version of the bill that was published by the government in November last year for public consultation. Sources say that some minor changes have been incorporated on the advice of stakeholders, but more details are awaited.

This bill was necessitated due to the withdrawal of another data protection bill formulated by the Justice BN Srikrishna Committee in 2018 as it had garnered a lot of criticism on grounds of being too complicated and placing onerous responsibilities related to data localisation on industry, among other things.

By just focusing personal data, the new bill has done away with regulating the use of non-personal data. It has also removed the need to locally store all user data by businesses, and instead allowed the leeway of storing such data in 'trusted geographies'.

The draft bill requires a data fiduciary -- i.e. an entity which processes user data -- to give an itemised notice to user on data sought to be collected, in clear and plain language. It also mandates that the user should be allowed the right to give, manage, withdraw consent from sharing his/her information.

For example, when a person closes their savings bank account, the bank has to delete his/her data pertaining to the account. Similarly, if a user deletes their social media account on a particular platform, their data has to be deleted as the bill mandates that a data fiduciary must retain personal data only so long as it is required for the purpose for which it was collected.

The bill states that a data fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children. Before processing any personal data of a child, the fiduciary has to obtain verifiable parental consent. Moreover, non-fulfilment of these obligations relating to children can lead to penalties of up to Rs 200 crore.

A few months back, Minister for Electronics and Information Technology Ashwini Vaishnaw courted controversy after, in an event, he claimed that the Parliamentary Standing Committee on IT had "approved" the bill. Soon after, members of the committee such as Karti Chidambaram, John Brittas and others refuted these claims.

It is important to remember that the previous version of this bill, Personal Data Protection Bill, 2019, was referred to a Joint Parliamentary Committee only after it was tabled in the Parliament. It was under consideration of the JPC for more than two years. In 2021, December the committee submitted its report, following which in August 2022, the government withdrew the bill citing compliance-related concerns.