Government releases draft of new data protection bill, proposes penalty of up to ₹500 crore

India released the draft of a new comprehensive data protection bill on Friday, three months after withdrawing a previous bill that had alarmed big technology companies.

The new measure, now up for public consultation, is expected to be presented in the next session of parliament. Expected to be presented in the next session of parliament, the measure, aimed at protecting digital personal data, seeks to allow transfer of data outside India, and provides for penalties regarding data breaches.

The government has raised the penalty amount to up to ₹500 crore for violating the provisions proposed under the draft Digital Personal Data Protection Bill 2022 issued on Friday.

The draft personal data protection bill in 2019 proposed a penalty of ₹15 crore or 4 per cent of the global turnover of an entity.

The draft proposes to set up a Data Protection Board of India, which will carry on functions as per the provisions of the bill.

"If the Board determines at the conclusion of an inquiry that noncompliance by a person is significant, it may, after giving the person a reasonable opportunity of being heard, impose such a financial penalty as specified in Schedule 1, not exceeding rupees five hundred crore in each instance," the draft said.

The draft has proposed a graded penalty system for data fiduciary that will process the personal data of data owners only in accordance with the provisions of the Act.

The same set of penalties will be applicable to the Data processor -- which will be an entity that will process data on behalf of the Data Fiduciary.

The draft proposes a penalty of up to ₹250 crore in case the Data Fiduciary or Data Processor fails to protect against personal data breaches in its possession or under its control.

The draft is open for public comment till December 17.

Union telecom and IT minister Ashwini Vaishnaw had said that the joint parliamentary committee which went through the original draft suggested 88 amendments to a bill of 91 sections, which led the government to decide that there was "no option" but to withdraw the original bill completely.

He added that a lot of changes had taken place during the Covid pandemic, leading to newer learnings, which had to be incorporated in the laws.

Non-profit Internet Freedom Foundation (IFF) had said that the Data Protection Bill 2021 gave large exemptions to government departments, prioritises the interests of big corporations, and did not adequately respect people's fundamental right to privacy.

"This move, when taken with the lack of literacy around data protection in India, may be dangerous on an individual level -- where your everyday privacy is threatened -- and on a collective level, given how it makes allowances for mass surveillance," IFF had alleged.

US-based ITI, whose members include all tech firms like Google, Meta, and Amazon, appreciated the government's move to withdraw the parliamentary panel version of the bill.

ITI was among the global industry bodies that had opposed the joint committee version of the bill. These global industry bodies included JEITA, TechUK, US India Business Council, and Business Europe which represent thousands of companies and technology majors like Google, Amazon, Cisco, Dell, SoftBank and Microsoft.

Around a dozen of industry bodies had written to Vaishnaw that implementation of the proposed Data Protection Bill, as recommended by a parliamentary panel, will significantly degrade India's business environment and reduce foreign investment inflows.

*With inputs from agencies