Creating an Effective Enforcement Authority for Data Protection Legislation

Multiple reports have confirmed that today, the Union Cabinet has granted approval to the Digital Personal Data Protection (DPDP) Bill. The primary objective of this bill is to safeguard the personal data of citizens and ensure that business entities responsible for handling such data are held responsible.

In particular, the protection of personal data has been neglected in India for too long. My personal data was leaked in the Domino’s Pizza breach and the Big Basket Breach already in 2020, but in the absence of a personal data protection bill, these organizations could not be held responsible for their inability to protect customer data.

While the European Union has adopted the GDPR and has been very diligent in enforcing it, India has been lagging far behind. Different versions of data protection laws have been in circulation for the past 5 years, and finally one version seems to be on its way to the parliament.

After reading this bill, I’m a little disappointed that it’s pretty watered down. It is somewhat simplified from earlier versions, but seems to have given too many exceptions to the state.

The actual details are also left out, leaving many provisions up to the interpretation of the government in power.

The bill also provides for a penalty for negligence, which will be determined by the data protection board, which will be formed after the notification of the bill. Unless such a board is duly empowered, none of the penal provisions can actually be imposed.

In summary, it can be stated that a bill approved by the government is not a guarantee of personal data protection, unless the enforcement authority is formulated correctly and the authorization of the authority is done properly and the authority is led by the right people.

The views expressed by the author are his own and not necessarily those of ReturnByte.