NASSCOM-DSCI Joint Submission on the Personal Data Protection Bill, 2019
Blog: NASSCOM Official Blog
Yesterday, NASSCOM and DSCI submitted their joint representation on the Personal Data Protection Bill, 2019 (PDP Bill 2019) before the Joint Parliamentary Committee (JPC) chaired by Smt. Meenakshi Lekhi, MP.
The inputs received from members, both during the Consultation Sessions held across Delhi, Mumbai and Bangalore, as well as written submissions provided by members, were extremely helpful in shaping these submissions, and have been incorporated in our submission to the extent possible.
Broadly, the submission is divided into four broad sections:
- Recommended Principles for an effective Personal Data Protection Framework – In this section, the submission adopts a ‘first-principles’ approach towards building a Personal Data Protection Framework, in order to provide context for the remainder of the submissions. In particular, the section emphasises that three foundational principles must form the basis of the data protection and privacy legislation, i.e.
- Operationalising privacy as a fundamental right;
- Increasing trust in the ecosystem governed by the legislation and providing a framework that is suitable for Data Driven Innovation (DDI);
- Including transparency and accountability requirements for all players in the ecosystem, including the State and regulators.
- Key Concerns in the PDP Bill 2019 and Suggestions to address them – In this section, the submission highlights certain resolvable issues that subsist within the framework of the PDB Bill 2019, particularly regarding:
- Categorisation of Sensitive Personal Data and its consequential impact
- Restrictive grounds for Processing Personal Data and Sensitive Personal Data
- Restrictions and conditions for Cross-Border Transfer of Sensitive Personal Data and Critical Personal Data
- Lack of appropriate framework to build trust for processing of global data in India: Power to Exempt certain Data Processors from data processing obligations
- Provisions Dealing with Non-Personal Data
- Strengthening of framework for an effective and accountable Data Protection Authority (DPA)
- Lack of appropriate grading of Criminal Offences
- Key areas where the provisions of the PDP Bill 2019 need clarification in order to minimise uncertainty – In this section, the submission focuses on provisions where interpretative ambiguities exist – either on account of the framing of the provisions, or on account of the lack of sufficient detailing in the PDP Bill 2019. In particular, the section highlights interpretative issues with regard to:
- Provisions relating to the designation of Significant Data Fiduciaries (Exercise of the DPA’s discretion in designating a significant data fiduciary; Appointment of Data Protection Officer; Requirement for Data Audits)
- Change in the definition of “Personal Data” under the PDP Bill 2019 (Inclusion of inferences derived within the scope of the definition)
- Preliminary Clauses (Removal of transition provisions; Lack of clarity on geographical scope)
- Other Compliance Issues (Certification and publication of Privacy by Design policy; Technical requirements for the exercise of a data principal’s right to correction)
- Other Issues requiring clarifications (Prohibition on the processing of certain categories of biometric data; Definition of ‘harm’ under the PDP Bill 2019; Lack of a definition for “financial institutions”)
- Clause-by-Clause Remarks on the PDP Bill 2019 – In this section, the submission provides NASSCOM and DSCI’s remarks on the provisions of the PDP Bill 2019. Wherever relevant, appropriate recommendations have been included.
We have provided rationale for each of our suggestions and wherever possible we have provided examples and use cases to illustrate our point.
We hope that our submission will be well received by the JPC, and can help operationalise an effective framework for individual privacy in India, while projecting India as a trusted, efficient and competitive player in global digital value chains.
The full submission is attached.
The post NASSCOM-DSCI Joint Submission on the Personal Data Protection Bill, 2019 appeared first on NASSCOM Community |The Official Community of Indian IT Industry.
Leave a Comment
You must be logged in to post a comment.
