Despite committing a number of times to bring in the legislation to protect personal data, the current government at the Centre appears to have left the matter to the new government which will take over after the general elections, to deal with the issue. As per earlier indications, the Personal Data Protection Bill 2018 was to have been introduced in Parliament during the ongoing session. Now the Ministry of Law has decided that the bill can be introduced only in June 2019, when a new government will be in place. There will be one more session, the Budget session, but then it will be of a short duration since the outgoing government will be only presenting a vote on account.
The Personal Data Protection Bill 2018 is supposed to be ready in all respects, however, the Law Ministry says it wants more time to study the bill before passing on for consideration of the Parliament. The bill has been drafted by the Ministry of Electronics and Information Technology (MEITY). As per practice. the Law Ministry is the final authority on all legislation emanating from any ministry or department of the government. MEITY had received the bill drafted by the Justice BN Srikrishna Committee last year, and the IT ministry has been receiving wide feedback from different stakeholders as well.
The sad part is the very first draft of a data protection bill was made in 2010 and it has taken all these eight years for it to take a final shape and now you have to wait for another six months to know its fate.
Some critics are quick to point out that the alacrity with which the government moved on the Aadhaar Act could have been shown here also.
There are a couple of issues relating to the data protection bill which are rankling the companies directly impacted by the proposed legislation. One is related to the storing of the data collected by them of Indian citizens here. The government took a stand that all such data needs to be stored in servers located within the country. It has subsequently modified to say ‘critical personal data’ needs to be stored here and a copy of other personal data has to be kept here. However, what defines ‘critical personal data’ is yet to be clarified.
The other important aspect would be the quantum of penalties imposed for violation of the act. One may have to wait till June to know where the bill moves next before it is passed by the Parliament and made into law.