Opposition questions behind-closed-doors rulemaking of Data Protection Bill; government issues response

The Digital Personal Data Protection Bill was passed in the Lok Sabha on August 7

Bahujan Samaj Party (BSP) MP Ritesh Pandey on August 7 accused the government of leaving the majority of the rules in the data protection bill to be formulated after the bill is passed into law, and alleged that it "will be formulated behind closed doors"

Pandey, including other MPs, both from the Opposition and Treasury benches in Lok Sabha, took part in the discussion over the Digital Personal Data Protection (DPDP) Bill before it was passed in the house.

Also read: Data protection bill passed by Lok Sabha, next stop Rajya Sabha

"In the bill, the government has mentioned "as may be prescribed" 26 times in its 26 pages. This means that the majority of the rules of DPDP will be made after it is formulated into law, and the government will formulate this behind closed doors," Pandey said.

If the DPDP Bill in its current form provides a framework for the legislation, the rule-making process will shape its contours. For instance, the current bill says that the government will list a number of countries where data cannot be transferred. The rule-making processes will define on what basis a country can be "blacklisted" in the bill.

In response, Minister for Electronics and Information Technology Ashwini Vaishnaw said that the government's rulemaking power was not "absolute".  "If the Parliament has created a law, then the rules will be formulated under the law. It will also be tabled in the Parliament," Vaishnaw said.

Moneycontrol had earlier reported how the industry has started lobbying the government for initiating an open, rule-making process after the bill is enacted into law.

How will parents give consent?

Yuvajana Sramika Rythu Congress Party (YSRCP) MP Srikrishna Devarayalu spoke on the provision that mandates that parental consent is necessary for a child to access a platform.

"Everyone in this House knows that 40 per cent of the population cannot copy a file from one folder to another. How do you expect this to happen?" Devarayalu asked.

Vaishnaw responded, "In the bill clear provisions have been made, based on age of a child, that mandate which apps a child can use and not use. When it comes to acquiring parental consent, one can obtain parental consent through Digilocker."

'DPB is overtly tilted towards Centre'

Telugu Desam Party MP Jayadev Galla, while supporting the bill "with caveats" questioned the structure of the Data Protection Board, which when enacted under the bill, will become the country's data protection regulator.

"The DPB is overly tilted towards central government. The government will establish the board, decide its chairperson, where its office should be-- It gives elbow room to the government to appoint members at its own wisdom," Galla said.

On the term of a DPB member being limited to two years, Galla said that the Supreme Court had earlier observed that short-term appointments in a body directly correlate to the concentration of power with the executive.

Vaishnaw in response said that Section 8 of the DPDP Bill mandates that the board will be an independent body.

"Need State data protection boards"

Claiming that a single DPB may go against the spirit of federalism, Biju Janata Dal's Sarmistha Sethi urged the government to establish data protection boards in States, along the lines of the Right to Information Act.

"The operation of the data protection board has been expanded in this bill. It disempowers the State government in controlling its own data. Will a single DPB have the jurisdiction over State government's data? On the lines of RTI, I urge the government that may there be State Data Private Boards too," Sethi said.