To
The Lok Sabha
That the Personal Data Protection Bill, 2019 (hereinafter referred to as ‘the Bill’) has been introduced in the Lok Sabha. This bill will be India's first comprehensive data protection law, which is desperately needed given the current vacuum of legal protections around personal data. It will shape the relationship between individuals and the companies and government entities they entrust with their data. To ensure this is a strong law which can stand the test of time, serious concerns in the bill will need to be addressed:
- The Bill establishes an authority to enforce the provisions of the Bill, however, the Adjudicating Officer responsible for deciding penalties has not been made sufficiently independent. Conditions relating to the qualification, manner, and terms of appointment of Adjudicating Officers should be included to ensure the independence of such officers.
- The Bill acknowledges a bundle of rights for data principals but a critical right to object to processing of data is missing, which can be especially detrimental in cases where the Bill itself permits collection of data without consent.
- The Bill requires that intelligence agencies conduct data processing in accordance with law, however, till date no framework to govern surveillance by these agencies exist. Therefore, a legal framework to regulate intelligence gathering must also be passed in order to be harmonious with this provision.
- The Bill provides for data localization of all personal data, which would have negative repercussions on users, security, and businesses of all sizes. In the absence of strong legal protections, this could also enable unchecked surveillance.
and accordingly your petitioner(s) pray that
The Personal Data Protection Bill, 2019 be referred to the relevant department-related standing committee without delay to permit a thorough legislative scrutiny and widespread consultation with experts and members of the general public.