Central Idea

• India’s digital economy is growing rapidly and generating massive amounts of personal data. As citizens embrace convenience, understanding how this data is handled and protected has become critical. The Digital Personal Data Protection (DPDP) Bill 2022 aims to safeguard citizens’ information from misuse and unauthorised access but lacks specificity in certain clauses such as the interaction with sectoral data protection regulations.

The Digital Personal Data Protection (DPDP) Bill 2022

• The Digital Personal Data Protection (DPDP) Bill 2022 is a proposed legislation aimed at safeguarding the personal data of Indian citizens from misuse and unauthorized access.
• The bill aims to regulate the handling of personal data in the rapidly growing digital economy of India.

Seven principles of DPDP Bill, 2022

According to an explanatory note for the bill, it is based on seven principles-

1. Lawful use: The first is that usage of personal data by organisations must be done in a manner that is lawful, fair to the individuals concerned and transparent to individuals.
2. Purposeful dissemination: The second principle states that personal data must only be used for the purposes for which it was collected.
3. Data minimisation: Bare minimum and only necessary data should be collected to fulfill a purpose.
4. Data accuracy: At the point of collection. There should not be any duplication.
5. Duration of storage: The fifth principle talks of how personal data that is collected cannot be stored perpetually by default, and storage should be limited to a fixed duration.
6. Authorized collection and processing: There should be reasonable safeguards to ensure there is no unauthorised collection or processing of personal data.
7. Accountability of users: The person who decides the purpose and means of the processing of personal data should be accountable for such processing

Challenges regarding conflicting sectoral regulations in India

• The DPDP Bill 2022 lacks specificity in certain clauses regarding the interaction with sectoral data protection regulations.
• While the Bill allows for filling regulatory gaps, conflicting sectoral regulations may create confusion.
• India already has sectoral regulations regarding data protection, such as the Reserve Bank of India’s directive on storage of payment data and the National Health Authority’s Health Data Management Policy. Any deviation from existing regulations will further require the industry to readjust their operations again at considerable cost.

Approach to regulate privacy and protect data

• The two major approaches to regulating privacy and protecting data is comprehensive legislation and sector-specific regulations
• The European Union’s General Data Protection Regulation (GDPR) as an example of comprehensive legislation with sector-specific provisions
• The American sectoral approach as a patchwork of regulations tailored to specific industries, with flaws in inconsistent protection, enforcement, and lack of federal regulation

Way ahead: Finding the right balance for India

• There is a need for greater clarity and specificity in the interaction between the DPDP Bill and sectoral regulations in India
• It is important to build on existing sectoral regulations to avoid undermining their efforts and require further costly adjustments
• The role of sectoral experts in ensuring a safer, more secure, and dynamic digital landscape for Indian citizens in the future is important.

Conclusion

• The DPDP Bill must serve as the minimum layer of protection, with sectoral regulators having the ability to build on these protections for a safer and more secure digital landscape.

Are you an IAS Worthy Aspirant? Get a reality check with the All India Smash UPSC Scholarship Test

Get upto 100% Scholarship | 900 Registration till now | Only 100 Slots Left

Get an IAS/IPS ranker as your 1: 1 personal mentor for UPSC 2024

Attend Now