Putting the brakes on personal data misuse: Digital Personal Data Protection Bill, 2022

(The writer is Union Minister of State for Electronics & IT)

A recent statement by the UAE Digital Minister saying, "The future will have Indian fingerprints on it for everyone and everywhere," sums up India's expanding presence and stature in the fast-digitizing world and changing technology value chains. From three decades of being a consumer of all Technologies to our transformation into an architect, designer and producer of Tech platforms, solutions, devices and products – India's technological capabilities have come a long way. From being the outsourcing hub of the world, today the scorching pace of our innovation ecosystem is the envy of the world with Young Indians confidently innovating in domains ranging from Space to Deep Tech, from AI to web3, from the Internet to Electronics/Semiconductors.

India with over 820 million internet users, and soon to touch 1.2 billion, has become the world's largest connected democracy with the largest presence on the global Internet. Unlike China's walled-off and heavily censored Internet (or Intranet), the Internet in India is open, accessible and interconnected to the global digital network like other western democracies. With India assuming the presidency of the G20 and also the Council chairmanship of the Global Partnership of Artificial Intelligence (GPAI) it would seem natural that India can play a leadership role in shaping the future of Technology and in particular this New Era of Technology Policy and Governance.

PM Narendra Modi's goals and ambitions for India are clear – A decade of Technology opportunities – "IndiaTechade" and the immediate target of a USD 1 Trillion digital economy. To meet these goals, the Ministry of Electronics and IT (MeitY) is piecing together a policy framework to accelerate and strengthen India's position in the global digital economy – around principles of Openness, Safety &Trust and Accountability.

'Technology' as a subject of policy-making, however, presents a challenge, unlike other areas. Agile and dynamic technological developments require agile and responsive governance. This has become even more important because much of the trend in the rise of Consumer data misuse, User Harm and criminality online is because Governments around the world have lagged in framing laws and regulations to swiftly respond to the rapidly shifting and growing challenges of Safety, Crime, Harassment and Political Interference on the Internet and Tech space.

To tackle these challenges, legislations have to not only cater to present-day needs but also be Future-Ready to change gears as and when required. Hence, MeiTY's new forward-looking approach to Internet-related matters includes having an unwavering focus on enhancing accountability, safety & trust without increasing the regulatory burden. It also emphasizes laws that are not disproportionately hard-wired and can quickly adapt to changing technological needs with rules and regulations. This approach safeguards the interests of citizens/consumers, and ensures there is no data misuse, yet provides flexibility to ensure that innovation is not stifled and new emerging challenges can be addressed without delay.

DPDP - an opportunity, not a burden

Since the 2017 Right to Privacy Judgement, the endeavour remains to view the digital economy through the prisms of Trust, Growth and Governance. There is no standard playbook out there, notwithstanding the recent proliferation of "Experts".

Our Government has been on a journey to design legislation that safeguards the interests of Data principals (consumers/citizens) without stifling innovation. Stakeholders ranging from consumers to start-ups to investors have been involved at every step. The Narendra Modi Government has welcomed consumer and industry feedback, examined it in detail and taken cognizance of concerns that were justified. That our PM agreed to our request for withdrawal of the last version of the Data Bill in August 2022 because of how cumbersome and complex it had become and despite the time spent on it, is a testament to the openness of the process.

Between then and now, we went back to the drawing board – established a comprehensive global standard and future-ready framework for our Digital Economy and Ecosystem consisting of the IT Act & IT rules, Cybersecurity Directions, National Data Governance Framework Policy, the Digital Data Protection bill and soon to be unveiled Digital India Act (as a successor to the 22-year-old IT Act). The DPDP Bill, 2022 is part of this modern global standard Future-Ready cyber law framework.

The DPDP Bill is a holistic, forward-looking and modern legislation that achieves the objectives of protecting citizen's right to data protection, Ease of doing business and the Government's national security and emergency requirements – and establishes a design that manages to achieve the three seemingly contradictory goals of data protection, facilitating innovation and governance. DPDP will usher in deep permanent behavioural changes in our data economy and put legal brakes on the rampant misuse of personal data and toxic practices of doing, gaslighting, and cyber trolling as well.

Apart from its simple language and design, the salient features of the DPDP Bill, 2022 are

n Citizen /Consumer (Digital Nagrik) rights to data protection are well protected.

n Data fiduciaries' obligations are clear, precise and unambiguous. Data minimization, Consent, Purpose and storage limitation, and Swift and transparent adjudications of Data breaches by the Data Protection Board are principles that have been coded into the bill.

n The compliance burden is proportional and minimal.

n Independent adjudicating authority, Data Protection Board is independent and has a specific role of adjudicating disputes and determining financial penalties in event of breaches. Its independence and performance are assured by the oversight of the High court where appeals of its orders lie. All standards for the larger data ecosystem will be by MeiTY through its India Data Management Office (IDMO).

n Cross-border data flow to be conditional – only to trusted jurisdictions which will ensure data protection rights of Indian consumers will be protected. This will balance the interests of start-ups/software firms, for whom data flows across geographical boundaries is a mainstay.

n No compromise on the Government's need to access data for Emergency purposes like law enforcement, pandemic and Natural disaster

n Further, the bill is aligned to the tests of Legality, Necessity and Proportionality as laid out by the Supreme Court and India will be well positioned as a safe destination for data processing and the growth of the Indian Cloud and Data centre Industry.

Paradigm shift: Policymakers and stakeholders as partners in policymaking

Predictably many views are being expressed on the DPDP Bill, 2022. This includes criticisms as well. I have carefully studied and analysed the commentary so far on the bill and we will continue to engage with all those interested in the development of this bill into modern world-class legislation.

Open and exhaustive consultations are a hallmark of policymaking in the Digital domain under PM Narendra Modi and reaffirm his view that this new framework that we are developing for the India Techade must be authored as much by Young Indians as by Government and/or Parliament, and so open and transparent consultations have become the cornerstone of ALL technology policy-making being undertaken by MeitY. Exhaustive consultations that lasted several weeks with my involvement led to current Amended IT rules, National Data Governance Framework Policy and Cybersecurity directions.

For the DPD Bill, we are on the final leg of our journey. It is open for public consultation. Constructive feedback and comments are welcome. To make the consultative process even more comprehensive, we are engaging with all stakeholders–with sectoral groups, academicians, industry bodies and lawyers.

We believe that the consultative process of governance will incubate policies that act as catalysts for the digital economy. The Government is investing in this consultative approach. Its success would mean that in the coming decade of policy governance - policymakers and stakeholders will work alongside one another as partners.

With this global standard Future-Ready Framework of laws and rules taking shape – with Cybersecurity directions, Amended IT Rules, National Data Governance Framework policy for Non-personal Data - the current Digital Personal Data Protection Bill and soon-to-be-proposed Digital India Act, the Safe & Trusted, Consumer rights protected enabling environment for India Techade is steadily and surely falling into place. As the largest connected democracy in the world and as a pre-eminent nation using Technology to improve the lives of our citizens and create more opportunities for our youth, India under PM Narendra Modi ji is charting its new course for India's and the world's future Digital Economy.