Government releases draft of new data protection bill, proposes penalty of up to ₹500 crore

The new measure, now up for public consultation, is expected to be presented in the next session of parliament.

Expected to be presented in the next session of parliament, the measure, aimed at protecting digital personal data, seeks to allow transfer of data outside India, and provides for penalties regarding data breaches.

The government has raised the penalty amount to up to ₹500 crore for violating the provisions proposed under the draft Digital Personal Data Protection Bill 2022 issued on Friday.

The draft personal data protection bill in 2019 proposed a penalty of ₹15 crore or 4 per cent of the global turnover of an entity.

The draft proposes to set up a Data Protection Board of India, which will carry on functions as per the provisions of the bill.

The draft has proposed a graded penalty system for data fiduciary that will process the personal data of data owners only in accordance with the provisions of the Act.

The same set of penalties will be applicable to the Data processor which will be an entity that will process data on behalf of the Data Fiduciary.

The draft is open for public comment till December 17.

Union telecom and IT minister Ashwini Vaishnaw had said that the joint parliamentary committee which went through the original draft suggested 88 amendments to a bill of 91 sections, which led the government to decide that there was "no option" but to withdraw the original bill completely.

He added that a lot of changes had taken place during the Covid pandemic, leading to newer learnings, which had to be incorporated in the laws.

Non-profit Internet Freedom Foundation (IFF) had said that the Data Protection Bill 2021 gave large exemptions to government departments, prioritises the interests of big corporations, and did not adequately respect people's fundamental right to privacy.

US-based ITI, whose members include all tech firms like Google, Meta, and Amazon, appreciated the government's move to withdraw the parliamentary panel version of the bill.

ITI was among the global industry bodies that had opposed the joint committee version of the bill.

These global industry bodies included JEITA, TechUK, US India Business Council, and Business Europe which represent thousands of companies and technology majors like Google, Amazon, Cisco, Dell, SoftBank and Microsoft.

Around a dozen of industry bodies had written to Vaishnaw that implementation of the proposed Data Protection Bill, as recommended by a parliamentary panel, will significantly degrade India's business environment and reduce foreign investment inflows.