On August 3, the Ministry of Electronics and IT (MEITY) withdrew the Personal Data Protection Bill, 2019. Soon after, a note was circulated for the MPs wherein the reasons for such withdrawal were stated as, “Considering the report of the JPC (Joint Parliamentary Committee), a comprehensive legal framework is being worked upon. Hence, it is proposed to withdraw The Personal Data Protection Bill, 2019, and present a new Bill that fits the comprehensive legal framework”.
As the Bill stands aborted, it has at least for some time now brought the momentum for data protection framework to a halt, which was first proposedand considered in 2011 when a draft for this purpose was coordinated through the Ministry of Personnel, Public Grievances and Pensions. This proposal was followed by the recommendation of an expert committee in October 2012 headed by Justice AP Shah that “a detailed framework that serves as the conceptual foundation for the Privacy Act”.
The Union Government constituted an expert group headed by Justice (retd) BN Srikrishna in July 2017 during the same time when petitions on the constitutionality of Aadhaar and the right to privacy were pending before the Supreme Court. During the constitution of the expert group, the then Union Minister for MEITY Ravi Shankar Prasad had notably remarked, “Data protection law… will set a global benchmark.”
Interestingly, during August in the same year, a nine-judge Supreme Court Bench unanimously pronounced a judgment in the Puttaswamy case upholding the fundamental right to privacy being important for the autonomy, dignity and liberty for every Indian. The formation of the Srikrishna Committee was noted as a positive obligation on the Government to enact a law for informational privacy by Justice DY Chandrachud, who had authored the majority of the opinion in the Puttaswamy judgment. Further in July 2018, this ignited the hopes of the nation when the Srikrishna Committee submitted its report. The report was appreciated Minister Ravi Shankar Prasad, who said, “It is a monumental law; and we would like to have the widest parliamentary consultation.”
Subsequently in December 2019, the Personal Data Protection Bill, 2019 was introduced in Parliament which was then referred to a JPC of 30 MPs that submitted a report after two years and 78 sittings on December 16, 2021, which contains 97 amendments, 93 recommendations and seven dissent notes. Post those recommendations, Justice Srikrishna remarked, “I said earlier when I saw the 2019 draft that it is sliding into the Orwellian state, and this proves my point.”
It is obvious that the Union Government in the best of its prudence has decided to withdraw the Bill as it is always better to give a fresh thought to the proposed legislation rather than struggling to amend the previous one. There is definitely a lot of criticism on the withdrawal of the Bill mainly because all three branches of Government worked on the Bill for years. But attributing any ill intention on the Government over withdrawal of the Bill is not justified as Union Minister for MEITY had stated, “Our target (to pass the Bill) was actually this Budget session itself, but definitely, by the Monsoon Session.” Which implies the Government was keen on passing the Bill after duly considering the suggestions of the JPC but was constrained to withdraw it on August 3 for embarking upon “a comprehensive legal framework”. With the pace in which the technology sector is advancing, it is obvious for the Government to change its mind in order to bring a better personal data protection regime.
The withdrawal of the Bill, especially in view of an array of JPC recommendations, is wise as it will give scope for incorporating changes on the foundation of those recommendations and even an attempt can be made to improve in light of those recommendations in a better way. The final recommendation by the JPC is for “the Bill as amended after inclusion of suggestions/recommendation made by the committee be passed”. And the proper course correction can be made by considering the JPC’s recommendations including the expert analysis and dissenting notes and then re-draft and re-introduce a new Bill, for which it was essential to withdraw the old one. And as it concerns the common man, now public consultations can be organised; and this can go a long way in building stakeholders’ confidence and clear doubts on provisions.
The Government has already set a goal of a one-trillion dollar digital economy, and re-introducing a new data protection legislation after careful consideration of various stakeholder interests will be important in balancing genuine regulation and data protection compliance as opposed to an overburdening compliance regime which would impede innovation and growth. This could be well-reasoned with the Srikrishna Committee report as well as a growing international consensus about the necessity for data protection in next-generation innovation in technology.
Most importantly, with the withdrawal of the Personal Data Protection Bill, the imperfections inherent in the Bill and even in the JPC report, the chances of institutionalisation of bad privacy practices are now warded off. But in the face of fast digitisation that heavily depends on gathering of personal data in all sectors -- education, agriculture, finance, health, labour benefits, welfare orthe linking of Aadhaar with voter records under the Election Laws (Amendment) Act, 2021 or for the collection of biometric samples for storage in electronic databases under the Criminal Procedure Identification Act, 2022, it is important to carefully but soon re-introduce the Personal Data Protection Bill that is based on a “comprehensive legal framework”; otherwise, such a crucial aspect of our lives will be exposed to data theft and misuse in the absence of proper regulation and rogue elements will exploit the legal vacuum.
(The writer is an Additional Central Government Standing Counsel, Central Administrative Tribunal, Cuttack and a Distinguished Adjunct Professor of Law and Media Studies, School of Mass Communication, KIIT University. Views are personal)
