Personal Data Protection (PDP) Law

In News

• The Unique Identification Authority of India (UIDAI) has asked for exemption from the Personal Data Protection (PDP) Law.

Why demand for exemption?

• The UIDAI demanded that it should get a blanket exemption from the Personal Data Protection (PDP) Law. 
• It further argued that it already is being governed by the Aadhaar Act and the PDP bill could be counter-productive.

Personal Data Protection (PDP) Bill 2019

• The genesis of this Bill lies in the report prepared by a Committee of Experts headed by Justice B.N. Srikrishna. 
• Key Features:
  • Categorisation of Data: Constitute 3 types of user data: Sensitive, Critical and General.
  • Concept of Data Principle: Gives data principle right over his/her personal data & how it can be utilised.
  • Right to Forgotten: This allows an individual to remove consent for data collection and disclosure.
  • Exemptions: Government is qualified to obtain the data for research or on national security concerns.
  • The setting of Independent Regulator: Data protection Authority (DPA) to safeguard the interest and check misuse of data.
  • Data Protection Officer (DPO): Each company will have DPO in which work in liaison with Data Protection Authority (DPA).
  • User Verification Mechanism: Social media companies need to develop UVM based on the severity of data.
  • Data Localisation Norms: Non-personal data can be stored and processed outside but personal data within the Indian territory.

Shortcomings/ Challenges

• The independence of data protection authority is questionable.
• Government can have access to a wide range of data.
  • It has a contentious section 35, which invokes “sovereignty and integrity of India,” “public order”, “friendly relations with foreign states” and “security of the state” to give powers to the Central government to suspend all or any of the provisions of this Act for government agencies.
• Prevailing digital illiteracy is also the main concern.
• The complicated language used by the internet agencies in terms and conditions.
• Lack of proper digital infrastructure.

Way Forward

• Provision of Data Localisation should be enforced.
• Focus on enhancing digital awareness and literacy, not only the digital economy.
• Independence of the data protection authority.
• DPB should be passed and enforced soon to have a robust data protection regime.

Source: TH