Context: In an interaction with the Joint Parliamentary Committee on Data Protection Bill 2019, the Karnataka government, the Income Tax (I-T) department and Unique Identification Authority of India (UIDAI) officials have flagged concerns regarding the current form of the Personal Data Protection (PDP) Bill, 2019.

Background

• The genesis of this Bill lies in the report prepared by a Committee of Experts headed by Justice B.N. Srikrishna. 
• The committee was constituted by the government in the course of hearings before the Supreme Court in the right to privacy case (Justice K.S. Puttaswamy v. Union of India).

Key Concerns

• Making Aadhaar compulsory for many key services including the banks that first triggered the data privacy debate.

It may create two distinct ecosystems:-

• One with the government agencies who will be completely out of the ambit of the law, giving them complete freedom to deal with the personal data.
• The second will be private data fiduciaries who will have to deal with every letter in the law.

Duplicity: Section 12 of the Act gives UIDAI some leeway from the rigours of the Bill as it enables for processing data for provision of a service or benefit to the data principal. However, even then prior notice has to be given.

• Section 35: Personal Data Protection (PDP) Bill 2019 has a contentious section 35, which invokes “sovereignty and integrity of India,” “public order”, “friendly relations with foreign states” and “security of the state” to give powers to the Central government to suspend all or any of the provisions of this Act for government agencies.

Note: Privacy Law: It is commonly referred to as the “Privacy Bill” and intends to protect individual rights by regulating the collection, movement, and processing of data that is personal, or which can identify the individual.
Key Provisions

• The Bill gives the government powers to authorise the transfer of certain types of personal data overseas and has given exceptions allowing government agencies to collect personal data of citizens.

The Bill divides the data into three categories and mandates their storage depending upon the type.

• Personal Data: Data from which an individual can be identified like name, address, etc.
• Sensitive Personal Data: Some types of personal data like financial, health-related, sexual orientation, biometric, genetic, transgender status, caste, religious belief, and more.
• Critical Personal Data: Anything that the government at any time can deem critical, such as military or national security data.

It mandates data fiduciaries to provide the government with any non-personal data when demanded.

• Data Fiduciary may be a service provider who collects, stores and uses data in the course of providing such goods and services.
• Non-Personal Data refers to anonymised data, such as traffic patterns or demographic data.
• A Data Protection Authority has been envisaged for ensuring the compliance of the law.
• It also mentions ‘Right to be Forgotten.’ It states that the “data principal (the person to whom the data is related) shall have the right to restrict or prevent the continuing disclosure of his personal data by a data fiduciary”.