The normative foundation of the proposed Personal Data Protection Bill, 2018 (hereinafter known as “Data Protection framework”) is the final result of the judgment passed by using the Hon’ble Supreme Court of India in Justice K.S. Puttaswamy (Retd.) v. Union of India1. The stated judgment proper to privateness has been identified as a fundamental proper rising in most cases from Article 21 of the Constitution. The Supreme Court vide the aforesaid judgment clarified that the right to privacy isn’t an absolute proper. A person’s privacy interests may be overridden via competing State and personal interests.
In 2011, i.E. Before Justice Puttaswamy’s judgment (supra) judgment, the Government propounded the Information Technology (Reasonable Security Practices And Procedures And Sensitive Personal Data Or Information) Rules, 2011 (hereinafter called the SPD Rules), were issued underneath Section 43A of the IT Act. The stated Rules examine with Section 43A of the Act, holds handiest a frame company chargeable for reimbursement for any negligence in imposing and maintaining reasonable security practices and methods at the same time as handling touchy personal statistics or information. However, the tempo of development of the virtual financial system and with the arrival of the right to privateness being recognized as a fundamental right after the law laid down by the Hon’ble Supreme Court in Justice Puttaswamy judgment (supra), has ended up inevitable to have extra complex legal guidelines for protecting the information of people.
The latest disclosure of data sharing practices with the aid of Facebook2 has located the hobbies of the man or woman (in whose call the facts flows) as secondary to the pursuits of the corporates which cope with the data, which has, in addition, made the requirement of getting stringent norms for the protection of information of the people. After the choice of the Supreme Court in Justice Puttaswamy judgment (supra), a Committee under the aegis of Justice B.N. Srikrishna changed into constituted.
(popularly referred to as the Justice Srikrishna Committee). The Committee in its Report offers the need for propounding a Personal Data Protection Bill, as the statistics amassing exercise in India, presently is opaque and mired in complex privateness paperwork which might be unintelligible. The Committee opined that protective the autonomy of a man or woman is vital no longer best for the sake of the character, but because such autonomy is constitutive of the commonplace appropriate of an unfastened and fair virtual economy. Some of the highlights of the Data Protection framework are elaborated hereinbelow:
Jurisdiction
With many corporations not being primarily based in India but wearing on business or offering goods and/or services in India, the State has a valid interest in regulating the activity of amassing and processing private records through such entities. The Committee, consequently, proposes to increase the regulation to all such entities processing the personal records of Indian citizens or citizens.
Applicability
The information processed, the reasons for such processing and security requirements maintained are the critical elements determining the law’s applicability. The Report presents that the proposed regulation shall not be retrospective in its application. However, if there may be any ongoing processing activity at the time, the law comes into impact. The records fiduciary (i.E. The entity amassing the records) must make certain that it is in compliance with this law regarding that interest. This way, merely because some private information has been gathered before the graduation of this regulation, such personal statistics aren’t always excluded from the software of the law.
As special earlier, SPD Rules restricted its applicability to body corporates. However, the existing Data Protection framework has considered the difficulty that Governments, as facts fiduciaries, procedures large quantities of private information, be it related to taxation, Aadhaar, social protection schemes, using lets in, and so forth. Unlawful processing of such facts can motive giant harm to individuals. As such, Governments, as facts fiduciaries, need to be in the remit of the regulation, ensuring that the State respects the proper privateness of the citizen.
Processing
The Bill will cowl the processing of personal statistics utilizing each public and private entity. Consent will be a lawful foundation for the processing of private statistics. Furthermore, processing private statistics of children3 ought to be with the utmost care and ought to be accomplished with more protection than everyday processing of facts.
The obligation of information fiduciaries
All processing of statistics must be fair and affordable. Furthermore, the Bill imposes a quandary that handiest such information needs to be amassed that is essential for attaining the purposes special for such processing. Thus, the minimal information necessary for reaching a reason could be accumulated, and such information will be used best for the desired cause and different well-suited functions and no different. Furthermore, information ought to be stored through the fiduciary best for a time period. This is vital to fulfilling the reason for which it becomes gathered. Once the reason has been executed, the statistics should be deleted or anonymized.
Data Breach With large quantities of facts being held through fiduciaries, a breach of private data will become an actual opportunity. Currently, in India, the SPD Rules cope with records safety. Thus, the Bill presents for notification to the Data Protection Authority upon the incidence of such breach, earlier than a notification to the person is made. As propounded by the framework, the Data Protection Authority will be an excessive-powered, impartial countrywide body. Such Authority shall have the power of issuing directions, strength to name for data, a book of suggestions, issuing Public Statement, Conducting inquiries, granting injunctive alleviation, and so forth.
