Cabinet Secretary likely to head Data Protection Board chairperson selection committee

The rules of the Digital Personal Data Protection (DPDP) Act is expected to be released soon

The Cabinet Secretary is likely to head a search-cum-selection committee tasked with appointing the chairperson for the Data Protection Board (DPB), which is being formed under the Digital Personal Data Protection (DPDP) Act, according to an unreleased version of the draft rules of the law.

The Cabinet Secretary is the senior-most civil servant and the administrative head of the government, and serves as the principal advisor to the Prime Minister. The Data Protection Board when established, will be the nodal body tasked with ensuring compliance of the data protection law.

The search-cum-selection committee for appointing the DPB chairperson, in addition to the Cabinet Secretary, may also include the Secretary of the Ministry of Electronics and Information Technology (MeitY), the Secretary of the Department of Legal Affairs, and two experts, as per the draft rules. Moneycontrol has seen a copy of this draft.

Even though the DPDP Act was passed in August 2023, certain clauses of the legislation require additional provisions to define the framework's details. The government is likely to release these rules for consultation soon, with plans to officially notify them in January 2024.

Another search-cum-selection committee will be formed to appoint the remaining members of the Data Protection Board. This committee may be headed by the secretaries of MeitY and the Department of Legal Affairs, along with two experts and the potential inclusion of the Data Protection Board chairperson (if appointed by then).

However, in the version of the draft rules that Moneycontrol has seen, there were no details provided on the required qualification and eligibility criteria for the members of DPB and its chairperson.

Also read: What the Digital Personal Data Protection Act means for you

Moneycontrol has reached out to the secretaries in MeitY, Department of Legal Affairs and Cabinet Secretary with queries in this regard and the article will be updated when a response is received.

These provisions are likely to heighten concerns that experts had previously expressed regarding the independence of the DPB. While the legislation states that the board will operate as an independent body, analysts had earlier pointed out that the government controls the appointees, their functions, and more.

For instance, retired Justice BN Srikrishna, who led the committee that drafted the Personal Data Protection Bill in July 2018, had earlier flagged such concerns.

"Who should be a member of the Board? What will be its qualification? There is nothing on that front in the bill. The government can very well back up the board with its own officers, and the board will not be independent," he had earlier said in 2022.

Apart from this, the upcoming rules of the DPDP Act may also mandate social media companies, e-commerce platforms, and online gaming services to delete the personal data of users who have been inactive on these platforms for three years.

Separately, the new rules may also require platforms to immediately inform the data protection board when it comes to know of a data breach.