A new draft of the Personal Data Protection Bill, 2019 #PDPBill was released this week, and introduced in the Lok Sabha yesterday. It builds on the earlier draft prepared by the #SrikrishnaCommittee, but with a few significant changes ⬇️
The most concerning provision in the new #PDPBill is Section 35 on exceptions for the state for national security, law enforcement, sovereignty etc. It drops the legal test of ‘necessity and proportionality’ and legality, taking a huge step back on #SurveillanceReform.
#PDPBill asks some #SocialMedia platforms to give users option to voluntarily verify their identities, posing questions about #FreeSpeech and if there will be greater #Surveillance of accounts who don’t identify themselves. This provision is out of scope for a #DataProtectionLaw.
The #PDPBill provides for mandatory sharing of #NonPersonalData with the government for planning. While the Bill provides for trade secret exception for #DataPortability, it is not applicable to mandatory sharing of non-personal data with the state.
The independence of the #DataProtectionAuthority has been significantly reduced in this version of the #PDPBill. The last draft envisaged members appointed by a committee from diverse backgrounds, but the new bill says it will be composed of members from the Executive.
According to the new #PDPBill, the #DataProtectionAuthority can create a sandbox to encourage innovation for public interest for #AI #MachineLearning etc. The criteria to select sandbox participants, and to certify #PrivacyByDesign policy of organizations need to be clarified.
In the new #PDPBill, provisions on #DataLocalisation have been relaxed on lines of suggestions made by @BasuArindrajit @Elonnai @AdityaSChawla in “The Localisation Gambit” cis-india.org/internet-gover… Mirroring provision only for #SensitivePersonalData or #CriticalPersonalData.
A new right been added to the #PDPBill — #RightToErasure, which would require deletion of data no longer necessary for the purpose for which it was originally collected.
