Personal Data Protection Act of India (PDPAI) by whatever name it will be finally called is expected to be tabled in the winter session of Parliament. (See Report here). Though the Government is under an obligation to the Supreme Court in the Aadhaar case to pass the law at the earliest, this session is likely to be also kept occupied with the proposed Uniform Civil Code Bill. Hence it is not clear if substantial progress can be made on the passage of the bill during the session.
The industry lobby is however interested in the deferment of the bill until its demand on dilution of the “Data Localization” requirement is conceded. One of the tricks which may be used is to push the bill into a Standing Committee which may delay the passage by an indefinite time.
Though the bill may require some final touches after it is presented, we must appreciate that the bill was drafted under the direction of Justice Srikrishna and would have been further refined after receipt of public opinion. During the discussion in the Parliament itself more refinements will come up for discussion. Hence the need for sending it into a standing committee is low. But the vested industry interests would do their best to ensure that the passage of the bill is delayed by insisting on the bill being sent to the standing committee.
Once the bill is passed by both the houses and gets the assent of the President, the Act will become effective.
Government may not exercise the discretion to make the “Notified Date” different from the “Notification date of the Act” as provided for under Section 97 though a window of 12 months has been provided for the notification of the “Notified Date”.
On the Notified date, the power to make rules and establish the DPA will be with the Government. Within the next 3 months the DPA needs to be appointed. This will be a body of 6 persons with a designated chair person.
Once the DPA is formed and the infrastructure such as the office place and secretariat is provided, the responsibility for further action shifts to the DPA.
The first phase in the road map will therefore be the establishment of the DPA and nothing more.
Subsequently, the DPA will have to draft several regulations as “Rules” and notify the same through a Gazette notification.
Before 12 months from the “Notified Date” DPA will bring out the first set of regulations which will consist of the “Grounds of Processing of Personal Data”. At this time the DPA has to define what is “Personal Data” and what is “Anonymised Data” besides clarifying the applicability of the Act to processing carried out outside India by Indian and non Indian entities.
“Anonymisation” has been defined under the Act as under
Anonymisation in relation to personal data, means the irreversible process of transforming or converting personal data to a form in which a data principal cannot be identified, meeting the standards specified by the Authority.
Personal data has been defined under the Act as under
“Personal data” means data about or relating to a natural person who is directly or indirectly identifiable, having regard to any characteristic, trait, attribute or any other feature of the identity of such natural person, or any combination of such features, or any combination of such features with any other information;
Both these sections need to be elaborated in the rules indicating what is not a personal data and what does not constitute “Anonymisation”.
Additionally the “Codes of Practice” which will cover the substantial aspects of the regulation also “Within 12 months” from the date of notification.
The Government may chose different notification dates for “Notifying the Grounds of Processing as per Section 97(5) and the code of practice as per Section 97(6).
The rules regarding Cross border restrictions for transfer would be notified on a searate date as per Section 97(7)
The residual regulations would be notified within 18 months of the notified date as per Section 97(8) and this date may be different from the date under 97(7).
The entire road map as per Chapter XIV is captured here
In the industry there is already some efforts to provide inputs to the Government on how the regulatory process needs to be streamlined. The effort of select private entities to be part of the regulatory process is to be appreciated though excessive concern is not warranted. For Government legislation is a day to day affair and the officials are well equipped to go through the process systematically.
We may however continue to provide inputs on some of the more technical and legal features of the regulations.
Naavi
