Context: The Joint Parliamentary Committee (JPP) on the Personal Data Protection Bill of 2019 is said to have adopted the final draft .

• Since the final draft has been adopted by all members of the JCP, it is likely to be tabled during the Winter Session. 
• However, some of the JCP members have dissented to certain aspects, so some changes are possible before the Bill is tabled in Parliament.

How long has it taken to complete the draft?

• First proposed by the government in 2018, the Bill has been pending for close to three years now. It has seen several changes to the original draft drawn by retired Supreme Court Justice B N Srikrishna, who has said that the revised Bill was “a blank cheque to the state”.
• Officials from the Ministries of IT, Law and Home Affairs, the Unique Identification Authority of India, National Investigation Agency, Narcotics Control Bureau and the Reserve Bank of India, among others, have deposed before the panel.
• From the private sector, executives from Visa, MasterCard India, Google India, PayTM, Facebook India, Twitter India, Amazon Web Services as well as Amazon India, among others, have made submissions to the panel.

Why does India need a data protection law?
Rise of e-Commerce

• Amid the proliferation of computers and the Internet, consumers have been generating a lot of data, which has allowed companies to show them personalised advertisements based on their browsing patterns and other online behaviour. 
• Companies began to store a lot of these datasets without taking the consent of the users, and did not take responsibility when the data leaked. 
• To hold such companies accountable, the government in 2019 tabled the Personal Data Protection Bill for the first time.

What is said to be in the final draft?
Inclusion of non-personal data

• One of the major changes that the final draft of the PDP Bill is believed to have pushed for is to include non-personal data within its ambit, which changes the nature of the Bill from personal data protection to just data protection.

Segregation of Age specific data

• The final draft is also said to have sought additional compliance for companies that deal exclusively with children’s data, by asking them to register with the Data Protection Authority — a regulatory body that will have powers to decide on implementing the law’s various provisions.

Making social media companies accountable

• A third key aspect that the committee is said to have pushed for is to consider all social media companies as publishers, and to hold them accountable for the content on their platform if they are not acting as intermediaries. 
• It is said to have recommended that no social media company be allowed to operate in India unless the parent company handling the technology sets up an office in India.
• Other aspects such as setting up of an indigenous architecture, which can be an alternative to the internationally accepted SWIFT payment system, are also said to have been suggested.

A key suggestion said to be made by the JCP, which also received the most dissent from members, is wide-ranging powers for the government such as exempting any agency from application of the law.
Other recommendations

• It recommends the setting up of a dedicated lab for certification of all digital devices in the country.
• The committee suggests that in case of cross border transfer of data, a mirror copy of sensitive and critical personal data needs to be mandatorily maintained in India.
• The committee recommends the development of an alternative indigenous financial system for cross-border payments on the lines of Ripple (U.S.) and INSTEX (European Union).

Concerns

• Some members of the committee have expressed concerns over clause 35 of the bill. This they argue could be ultra vires of the Fundamental Right to privacy as laid down in the Puttaswamy (2017) judgment as the bill did not provide adequate safeguards to protect the right to privacy and gave unqualified powers to the Government which could be misused.
• The PDP bill also considerably diverges from the Justice Srikrishna Committee’s draft Bill.
• The selection of the chairperson and members of the Data Protection Authority (DPA) will be made by members of the executive.
• Suggestions by some members of the committee to remove “public order” as a ground for exemption, suggestions for “judicial or parliamentary oversight” for granting of exemptions and the mandatory written orders for granting exemptions have been overlooked.

Road Ahead

• The recommendations made during the Global Privacy Assembly could be an ideal way forward on this issue.
• There should be clearly laid principles based on a legal basis for government access to personal data.
• There should also be clear and precise rules, proportionality and transparency, data subject rights, independent oversight, and effective remedies and redress to the individuals affected.