Yesterday the Indian Government officially withdrew the draft Personal Data Protection Bill, 2019 (“Bill”) from Parliament. Sometimes called ‘India’s GDPR’, this Bill sought to regulate data processing activities of entities collecting data of individuals in India. You can read the withdrawal announcement here.
Here is a brief primer on what this Bill meant for businesses operating in India, and what to expect next.
The Bill was developed following the Indian Supreme Court’s 2017 ruling in K. S. Puttaswamy holding that informational privacy is protected as a fundamental right under the Indian Constitution. In this decision the court also emphasized the need for a data protection law. Following this decision, a committee was set up in 2017 to review Indian privacy law, and following its report the Indian Government released an initial version of the Bill in 2018.
The Bill led a chequered life, and went through numerous rounds of public debate and consultation. The text of the Bill was criticised by technology companies for certain business-unfriendly measures, such as data localisation and heavy levels of monetary fines for non-compliance. On the other hand, civil society groups criticised it for enabling government surveillance, and exempting the Indian Government from most of its rules and limitations.
In 2021, a Joint Committee of the Indian Parliament (“JPC”) suggested 81 amendments to the draft Bill. The JPC also recommended that the Bill be amended to include ‘non-personal data’ within its scope; something that has never been a part of the Bill. You can read the JPC full report here. It now seems that a combination of public criticism, and extensive JPC comments, has led to the Indian Government withdrawing the Bill and seeking a ‘clean slate’.
The Indian Government is now working on preparing a new comprehensive bill. We understand that it is also looking at making corresponding enabling changes to the Indian Information Technology Act, 2000. A new bill may be introduced in the Indian Parliament as soon as its 2022 Winter Session, beginning in December. It remains to be seen if a new draft bill will be released before December 2022 for public consultations, like last time.
We will continue to track the matter and keep you updated on how the new regulation on data privacy develops in the future.
Comments