What was your vision when you set out to finalise this revised Bill?
PM Modiji (PM Narendra Modi) wants to create a globally benchmarked and comprehensive digital legal framework. In line with this vision, we drafted this Bill keeping all established principles of privacy and the global experience. We have attempted to keep it technology agnostic, simple to read and the implementation is completely digital by design. Most importantly, Indian languages have been given their due. Notices, consents, etc., will have to be in any one of the Indian languages specified in the Eighth Schedule (of the Constitution). In line with Modiji’s focus on women empowerment, we have used the female pronoun in the Bill.
The Bill has provided for data transfer to trusted geographies. How will it be implemented?
Today, the global principle of adequacy of data protection is being followed. So, if data has to go to any country and if the data protection is not adequate, then it won’t be on the list. Our IT industry and startup ecosystem is based on receiving data from hundreds of other countries.
Why is the proposed penalty an absolute figure and not a percentage of revenue?
We have seen the impact of adjusted gross revenue definition in telecom where the calculation was in terms of percentages. Why shouldn’t we learn from this example in the digital economy? That’s why we came up with a graded penalty system. The criteria for implementing a penalty have been very clearly laid out.
‘Data Protection Board to be Totally Independent’
The (Data Protection) Board will have to consider aspects like the nature, gravity and duration of noncompliance. We have kept similar provisions in the telecom Bill too. The thought process in both the Bills was that we have to create a digital implementation and graded penalty framework. We have kept a voluntary undertaking construct and an alternative dispute mechanism to reduce unnecessary litigation.
Will the Rs 200-crore penalty be multiplied by the number of users?
The penalty has been prescribed for every instance of breach, and Rs 200 crore is the upper limit for each instance.
How different is the Data Protection Board from the previous Data Protection Authority? How independent will it be?
It is totally independent and fully digital by design. We would like to have equal access to justice for all citizens. That is possible only through a digital implementation framework.
What is the government’s intent behind the revised Bill?
PM Modiji wanted the Bill to be tech agnostic, sector agnostic, and be able to give justice to all citizens. Access to justice is very important. All the principles of privacy should be incorporated. Indian languages should be given their due importance. It is a foundational bill on which sector-specific, modular regulations can be built.
This Bill relates to data stored in a digital format. What happens to the privacy of data stored in the physical format?
Today, practically 99% of data is already digitised, or maybe even 100%. There’s hardly anything which is on paper now.
You have introduced the concept of a significant data fiduciary. Are any parameters applicable here? What is the idea behind bringing in a graded system?
There is a significantly better structure here. If you look at Section 11.1, we are saying that based on an assessment of relevant factors – volume, sensitivity, risk of harm, impact on sovereignty, integrity, threat to electoral democracy, security of the state, public order and such factors. So, it’s not just the number of subscribers, it is a very comprehensive framework. Most of the world will adopt the way we have structured it. People were always struggling to define significant data fiduciary.
So, you are saying that this will be a global trendsetter…
Yes
How will you protect the startup industry?
We are exempting them from many of the compliances. In Section 18, there is a clause which says they will notify a data fiduciary or a class of data fiduciaries… many of the provisions will not apply…this is with regard to the volume and nature of personal data. Startups should get the freedom to grow.
When do you intend to table the Bill in Parliament?
By the budget session.
Does the Board have quasi-judicial powers?
Every independent regulator will always have this power. So, in effect, the Board is an independent body. It derives those powers from an independent structure.
What happens in case someone tries to challenge it?
People can challenge (it) and any challenge to the Board’s direction can go to the High Court.
Provisions on non-personal and social media were part of the earlier Bill, but not now. What is your view on that?
In the comprehensive framework that we are building, the entry to the digital world is telecom. For that we have brought in the telecom Bill. For data protection, we have brought the data protection Bill. These are horizontal structures over which other modular regulations can be built. For example, the financial services sector can use these building blocks and come up with smaller focused modular regulations.
