Today, India's Ministry of Electronics and IT issued a new draft "digital data protection bill".
TL;DR: its quite disappointing. This is a #DataProtectionBill one would expect from a country in the mid 2000s, before the GDPR, before the Indian Supreme Court's Puttaswamy ruling.
TL;DR: its quite disappointing. This is a #DataProtectionBill one would expect from a country in the mid 2000s, before the GDPR, before the Indian Supreme Court's Puttaswamy ruling.
While claiming to be shorter and using simpler language than the previous draft bill, its actually deletes entire data protection rights that the earlier draft proposed. It uses weaker, pro-corporate language around consent. And even wider carve-outs for govt agencies, LEAs.
Despite repeated, loud concerns around the issues with the independence of the data protection authority proposed in the previous draft, the new draft bill created an even weaker Data Protection Board that would not be independent of the Union Govt- the main party often before it
Imagine an "independent regulator" whose governing body's composition is completely decided by the Govt. Appointments of the chair & members solely by the Govt. The Govt can even directly appoint the DPB's chief exec, managing day-to-day affairs. + change service rules anytime
The draft bill proposes "voluntary agreements" where a party being investigated for breaking the law can essentially plea bargain. Except if they break the agreement, the only thing the DPB can do is fine them. Such agreements are a complete shield, defanging the DPB.
[For context, the US's Federal Trade Commission regularly uses consent decrees to push oversight & long term accountability on firms, incl tech cos. But the FTC can go ahead and seek wide remedies and enforcement actions if such consent decrees are breached. Not just fines.]
As my colleague @NamrataM_ pointed out : the new draft bill actually does away with the provision on compensation to affected individuals entirely! It also creates a narrower definition of "harm" - psychological impacts of unlawful behaviour and other factors no longer included.
And while trying to potentially be seen as pro-corporate - or at least responding to some of the corporate lobbying done on this - the bill actually sets up a huge crisis for India's tech and outsourcing industry. It categorically says non-residents get no data protection rights.
... which, anyone who follows data protection developments globally, knows is a red flag for India in the eyes of the EU Court of Justice, EU and DPAs. The Schrems judgments tore up data transfers between the EU & the US due to inadequate data protection remedies for EU citizens.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
