New Delhi, Dec 11 :
The much-talked about legislation to protect personal data will allow processing of private data without explicit consent of the owner of the information for credit scores, debt recovery, security, operation of search engines and whistle blowing.
The draft Personal Data Protection Bill, 2019, which is likely to be introduced in the Lok Sabha in the next couple of days, bars storing and processing of personal data by entities without the explicit consent of an individual.
It, however, provides for exemptions for “reasonable purposes” such as “prevention and detection of any unlawful activity including fraud, whistle blowing, merger and acquisitions, network and information security, credit scoring, recovery of debt, processing of publicly available personal data, and the operation of search engines.”
The legislation provides for stringent ground rules for processing of personal and sensitive information of children, while mandating the processing of ‘critical’ personal data only in India.
But data concerning health services and for complying with any law or court orders can be processed without the consent of the owner, the draft bill said.
It also gives power to the government to decide from time to time on the exemption list.
The draft bill, cleared by the Cabinet last week, aims to create a “strong and robust data protection framework for India” as it fixes obligation of data fiduciary (that is entity collecting and processing data) and places restriction on transfer of personal data outside India.
Interestingly, the draft bill empowers the Centre to exempt any government agency from application of the proposed legislation.
The draft bill also states that the central government can frame policy for the digital economy with respect to non-personal data. In particular, it can direct any data processor to “provide any personal data anonymised or other non-personal data to enable better targeting of delivery of services or formulation of evidence-based policies by the Central Government”.
The draft data protection bill also entails setting up of an authority for protecting personal data and also prescribes stiff penalties for violation of various provisions.
