Personal Data Protection Bill: More drama ahead

There is more drama left when it comes to The Personal Data Protection Bill, 2019. The current bill may be further modified after the Joint Parliamentary Committee (JPC) holds consultations with different stakeholders, including citizens, small and large companies, and law enforcement agencies, among others.

The Bill, that was approved by the Cabinet, has now been referred to a Joint Committee of the Houses (JPC) with some clear mandates, two BJP parliamentarians who are part of the JPC told Business Today. The JPC, they indicated, would be open to discussions to make the legislation work for everybody.

The JPC consists of 20 members from the Lok Sabha and 10 members from the Rajya Sabha.

"It is an important legislation - almost the defining legislation for the future of Digital India. That is one point of view," member of Parliament Rajeev Chandrasekhar said. "Two, the Bill has to be seen in the context that privacy is a fundamental right subject to reasonable restrictions.  These are the two guiding beacons that will drive the conversations in the committee (JPC)," he added. 

Also Read: Personal Data Protection Bill, 2019: From right to erase data to special powers for govt; 10 major points

While Chandrasekhar did not indicate any timeline for stakeholder consultations, he said that a horizon of three-four months would be reasonable for substantive discussions.  "The Digital economy by 2024 is going to be more than $1 trillion in size; it is going to be a big part of the $5 trillion roadmap. Therefore, anything that we do must only enable, expand and enhance investments as well as innovation," he said.

BJP Parliamentarian from Karnataka Tejasvi Surya, also part of the JPC, said that the Bill is trying to balance different interests. "The interests of the state - national security, the enforcement of laws - have to be protected on one hand and on the other, the privacy of individuals and the integrity of data. Interest of companies in a sector that is so critical for India's economy is the third thing. All of these interests would be balanced and the JPC will make valuable recommendations," he said.

Also Read: Personal Data Protection Bill to burden firms with long-drawn, expensive compliance process

The current draft of the Bill is a significant improvement from the 2018 draft, Surya held. "The post-JPC version will be even better because there would be much wider consultation. The purpose of the JPC is to make it better - else the government wouldn't have referred it to the JPC," he added.

The JPC is expected to look at finer details including the definitions, what constitutes personal, sensitive, and critical data, what data should be stored in India and what can be mirrored etc. The Bill does not provide any guidance around timelines - for setting up of the Data Protection Authority or for companies to start complying. Surya indicated that the post-JPC version of the Bill would provide reasonable time for companies to prepare. "The bill will provide for enough time for companies to comply with the regulations made. It will not come into effect from tomorrow midnight. This is going to be a reasonable exercise balancing all interests," he stressed.