Digital Data Protection Act 2023: Five Must Reads

On August 11, 2023, the President of India granted assent to the highly anticipated Digital Personal Data Protection Act, 2023. The legislation has been in the making since 2018 and finally became an act after multiple deliberations and rewrites. However, much of the rewriting and discussion happened outside the public eye. The reasons for withdrawing a previous iteration of the bill were not made public. Even the public comments on the 2022 version of the Bill—which eventually became the Act—were not released by the government. 

The Union has maintained that the Act recognises the rights of individuals and protects their personal data, with a focus on promoting the digital economy, ease of living and doing business. In Parliament, the government argued that the legislation was principle-based and not prescriptive, so as to allow for its flexible application.

While corporate India, who would be considered as Data Fiduciaries under the legislation, has more or less welcomed the Act, technology and constitutional law experts have raised an eyebrow at the wide discretion it grants to the government. Here, we curate a list of five articles that have raised critical questions around the  Act, both from technical and philosophical standpoints. 

1) What is the Data Protection Bill of 2023? (The Hindu, August 6, 2023) 

Radhika Roy and Tejasi Panjiar from the Internet Freedom Foundation (IFF) highlight areas of concern, including the wide scope of the “certain legitimate uses” provision and the extension of the “personal information” defence to deny providing information which may be of public interest.

2) The dangers in the Digital Personal Data Protection Bill (The Hindu, August 2, 2023)

Anjali Bharadwaj and Amrita Johri of the National Campaign for Peoples’ Right to Information (NCPRI) bring up the threat of the Act legitimising executive overreach. “Given that the government is the biggest data repository,” they write, “an effective data protection law must not give wide discretionary powers to the government.” The Act allows the government to exempt a private entity—the law even namechecks “startups”—by simply issuing a notification. The authors’ affiliation with the NCPRI also offers a perspective on the intricate relationship between the right to information and the Data Protection Act. You can access more of their work here and here. 

3) Ten instances show how the digital data protection bill will undermine the RTI Act (Scroll.in, February 5, 2023) 

Shailesh Gandhi, a former Central Information Commissioner, paints a picture of the threat that the law poses to the RTI regime. He does this by listing ten examples that could potentially allow public information to be shielded using the “personal information” defence endorsed by the data protection law. 

4) The long saga of the data bill holds crucial lessons (Hindustan Times, August 4, 2023)

Apar Gupta, founding director of the Internet Freedom Foundation (IFF) traces the turbulent journey of the bill in India since 2012. He demonstrates the “aggravated and intentional form of policy paralysis over the past nine years” while highlighting the key pitstops: the Attorney General disputing the constitutional basis of the right to privacy in 2015, the promise of the Puttuswamy judgment in 2017, the abrupt scrapping of the 2019 draft bill in August 2022. His prediction for the future of this vaguely worded law? “Litigation, ordinances, amendments” and the extension of “a cycle of uncertainty.”

5) DPDPB, 2023 in the Parliament: Dialogue, Drama, and Discord  (Internet Freedom Foundation, August 10, 2023) 

Tejasi Panjiar, Prateek Waghre and Saharsh Panjwani, of the IFF provide an alarming account of the passage of the data protection bill in Parliament. The piece also refers to the opaque consultation process and contends that the inputs submitted by civil society stakeholders were rendered to be of “no value.” One of the more striking data points is that the bill was debated for a mere 52 and 67 minutes in the Lok Sabha and Rajya Sabha respectively. 

Resources 

• The Digital Personal Data Protection Act, 2023
• A Public Brief on the Draft Digital Personal Data Protection Bill, 2022 by the Internet Freedom Foundation (IFF)
• Living document containing key changes in the DPDPB, 2023 when compared to the DPDPB, 2022 by the Internet Freedom Foundation (IFF)
• The 2022 Draft Digital Personal Data Protection Bill, 2022 by the Ministry of Electronics and Information Technology
• Explanatory Note To Digital Personal Data Protection Bill, 2022 by the Ministry of Electronics and Information Technology