Skip to main content

​All you need to know about the Personal Data Protection Bill, 2018

 With the advancement in technology and the revolutionary increase in the use and dependability of internet, a lot of data is being created and shared by us through mobile applications and websites, including personal information. A lot of this data is also stored in hard disk, cloud, database, memory disk, internet, computer, etc. and the same continues to grow at limitless rates leading some sensitive information to enter the “Public Domain”. Once the data enters the public domain it is subjected to various threats such as the threat from hackers, software threats, misuse or misrepresentation of information, data breaches and leaks creating a need for data protection.

 


What is Data Protection?

The term Data Protection means legal control over access to and use of data stored. In other words, it refers to a series of continuous and repetitive processes, sound policies and privacy laws to reduce intrusion in one’s privacy.

 


Consult: Top Cyber Crime Lawyers in India


 


Data Protection in India

Up until now, privacy laws in India offer little protection against misuse of one’s personal information. The transfer of personal data is currently governed by the Sensitive Personal Data and Information Rules, 2011, which has been proven to be inadequate. With the mounting concerns worldwide regarding the protection and need for legal regulation of an individual’s personal data in the face of various scandals, the need for a similar legislation is of greatest importance in India, where the data-driven services and transactions in the digital economy are ever increasing but apparently, the personal data of Indian nationals sees very little protection.


Recently, an admission was made by Facebook that the data of 87 million users, including 5 lakh Indian users, was shared with Cambridge Analytica, a British political consulting firm which combined data mining, data brokerage, and data analysis with strategic communication during the electoral processes. The very thought of personal data being used for unknown intentions sent ripples across the world. In furtherance to this, the European Union, in order to protect the personal data of individuals had enacted the General Data Protection Regulation (GDPR) which establishes the right to privacy as a Fundamental Right. Following the implementations of the GDPR and taking examples from the legal frameworks of other countries on the subject, the Personal Data Protection Bill 2018 has been introduced by the Justice B.N. Srikrishna Committee to prevent “Personal Data” of individuals from being misused.

 


What are the key aspects of the draft bill?

The Personal Data Protection Bill has introduced concepts which are the essence of data protection, such as:


Data Fiduciary- The Bill defines every entity (a state, a company, any juristic entity or any individual) which determines the purpose and means of processing the personal data as the “Data Fiduciary”.


Data Processor- It refers to every entity (a state, a company, any juristic entity or any individual) which actually processes the personal data on behalf of a data fiduciary as a “Data Processor”.


Data Principal- It means every entity including an individual, a Hindu Undivided Family, a company, a firm, a state, an association of persons or a body of individuals and every artificial judicial person.


The proposed Data Protection Bill states that unless explicit consent is given, your personal data cannot be shared or processed, which means that the onus lies on you to make an informed choice. It also states that any person processing your personal data is obligated to do so in a fair and reasonable manner and it shall not be processed for the purposes it was not intended for in the first place. It makes the data fiduciary responsible for complying with the obligations in respect of any processing undertaken by it or on its behalf.

 


Consult: Top Cyber Crime Lawyers in India


 


Grounds for processing personal data under the Bill

The Bill makes consent an essential part of processing data. No data shall be processed without the consent of the data principal. However, the data shall be processed without consent only on certain grounds specified in the draft bill, such as:


If processing is necessary for any function of Parliament or any State Legislature or for any service or benefit to the data principal.


For compliance with any order or judgment of any Court or Tribunal in India.


To respond to any medical emergency involving a threat to life, a severe threat to the health or outbreak of disease.


Recruitment or termination of employment of a data principal by data fiduciary.


Prevention and detection of any unlawful activity, mergers, and acquisition, credit scoring, recovery of debt and whistleblowing.

 


Grounds for processing sensitive personal data under the Bill

The term 'Sensitive Personal Data' includes passwords, financial data, health data, biometric data, genetic data, and data on caste or tribe or religious and political beliefs. The sensitive personal data may be processed on the basis of explicit consent for:


Any function of Parliament or any State Legislature,


For any service or benefit to the data principal.


For compliance with any order or judgment of any Court or Tribunal in India.


To respond to any medical emergency involving a threat to life, a severe threat to the health or outbreak of disease.

 


Rights of Data Principal

Under the Personal Data Protection Bill, the Data Principal are granted certain rights such as:


Right to confirm whether the data fiduciary is processing or has processed the personal data and access to the data.


Right to correction of inaccurate, misleading or incomplete personal data.


Right to data portability.


Right to be forgotten, i.e., the right to restrict or prevent continuing disclosure of personal data by a data fiduciary.

 


Consult: Top Cyber Crime Lawyers in India


 


Transfer of personal data outside India

Personal data other than those categorized as sensitive personal data may be transferred outside the territory of India under the following conditions:


Transfer is made subject to standard contractual clauses or inter-group schemes that have been approved by the Authority.


The Central Government has prescribed that transfers to a particular country or sector within a country is permissible.


The Authority approves a particular transfer or set of transfers as permissible.


In furtherance to the above, the data principal has consented to such transfer of personal data.

 


Exemptions

Processing of personal data in the interests of prevention, detection, investigation, and prosecution of any offense or any other contravention of law is permitted, provided it is authorized by a law made by Parliament and State Legislature.


The Ministry of Electronics and Information Technology has announced that before the Draft Bill is passed by the Parliament, it will undergo intensive parliamentary consultation. The Ministry solicits comments from General Public on the Draft Bill in order to ensure that it is indeed the need of the hour and beneficial to the interests of the individuals. The Draft Bill, when enacted will give way to new data privacy regime, which is based on trust and efficient mechanism between the Data Fiduciary and Data Principal. The Draft Bill imposes series of obligations on the State and makes it accountable for processing the personal data of an individual, thereby protecting both - the personal data and the constitutionally guaranteed right to privacy.


To read the Personal Data Protection Bill, 2018, click here.

Labels:

Comments

Post a Comment

Popular posts from this blog

Section 58B of The Advocates Act - Special provision relating to certain disciplinary proceedings

 Section 58B The Advocates Act Description (1) As from the 1st day of September, 1963, every proceeding in respect of any disciplinary matter in relation to an existing advocate of a High Court shall, save as provided in the first proviso to sub-section (2), be disposed of by the State Bar Council in relation to that High Court, as if the existing advocate had been enrolled as an advocate on its roll. (2) If immediately before the said date, there is any proceeding in respect of any disciplinary matter in relation to an existing advocate pending before any High Court under the Indian Bar Councils Act, 1926 (38 of 1926), such proceeding shall stand transferred to the State Bar Council in relation to that High Court, as if it were a proceeding pending before the corresponding Bar Council under clause (c) of sub-section (1) of section 56: Provided that where in respect of any such proceeding the High Court has received the finding of a Tribunal constituted under section 11 of the Indian B
Post a Comment
Read more

Case Laws related to Defamation in favour of ClaimantCase Laws related to Defamation in favour of Claimant. TOLLEY Vs, J.S FRY & SONS LTD – (1931) Facts The defendants were owners of chocolate manufacturing company. They advertised their products with a caricature of the claimant, who was a prominent amateur golfer, showing him with the defendants’ chocolate in his pocket while playing golf. The advertisement compared the excellence of the chocolate to the excellence of the claimant’s drive. The claimant did not consent to or knew about the advertisement. Issue The claimant alleged that the advertisement suggested that he agreed to his portrait being used for commercial purposes and for financial gain. He further claimed that the use of his image made him look like someone who prostituted his reputation for advertising purposes and was thus unworthy of his status. At trial, several golfers gave evidence to the effect that if an amateur sold himself for advertisement, he no longer maintained his amateur status and might be asked to resign from his respective club. Furthermore, there was evidence that the possible adverse effects of the caricature on the claimant’s reputation were brought to the defendants’ attention. The trial judge found that the caricature could have a defamatory meaning. The jury then found in favor of the claimant. Held The House of Lords held that in the circumstances of this case – as explained by the facts – the caricature was capable of constituting defamation. In other words, the publication could have the meaning alleged by the claimant. The Lords also ordered a new trial limited to the assessment of damages. NEWSTEAD V LANDON EXPRESS NEWSPAPER LTD, (1939) Facts: A newspaper published a defamatory article about Harold Newstead. However, another person with this name brought an action in libel. He claimed that the article had been misunderstood as leading to him. The defendant newspaper recognised that they published the article. Also, they denied that they had the intention of being defamatory of him. Consequently, the claimant argued that the newspaper was under a duty. The duty was to give a clear and complete description of the correct person. Moreover, the claimant argued that the defendants were in breach of the duty. Issues: The issue in Newstead v London Express Newspaper, was if the reasonable persons would have understood the words complained of to refer to the plaintiff. Held: The Court of Appeal stated that in accordance with the current law on libel, liability for libel does not depend on the intention of the defamer; but on the fact of the defamation. Accordingly, a reasonable man, in this case a newspaper publisher, must be aware of the possibility of individuals with the same name and must assume that the words published will be read by a reasonable man with reasonable care.

  Case Laws related to Defamation in favour of Claimant.  TOLLEY  Vs,  J.S FRY & SONS LTD – (1931) Facts The defendants were owners of chocolate manufacturing company. They advertised their products with a caricature of the claimant, who was a prominent amateur golfer, showing him with the defendants’ chocolate in his pocket while playing golf. The advertisement compared the excellence of the chocolate to the excellence of the claimant’s drive. The claimant did not consent to or knew about the advertisement.   Issue The claimant alleged that the advertisement suggested that he agreed to his portrait being used for commercial purposes and for financial gain. He further claimed that the use of his image made him look like someone who prostituted his reputation for advertising purposes and was thus unworthy of his status. At trial, several golfers gave evidence to the effect that if an amateur sold himself for advertisement, he no longer maintained his amateur status and might be aske
1 comment
Read more

Rules as to delivery of goods

                             Rules as to delivery of goods Section 2(2) of Sale of Goods Act defines ‘delivery’ as a ‘voluntary transfer of possession from one person to another.’ Thus, if the transfer of goods is not voluntary and is taken by theft, by fraud, or by force, then there is no ‘delivery. Moreover, the ‘delivery’ should have the effect of putting the goods in possession of the buyer. The essence of the delivery is a voluntary transfer of possession of goods from one person to another. There is no delivery of goods where they are obtained at pistol point or theft. 1. Mode of Delivery: According to Section 33, delivery of goods sold may be made by doing anything which the parties agree shall be treated as delivery or which has the effect of putting the goods in the possession of the buyer or of any person authorized to hold them on his behalf. Delivery of goods may be actual, symbolic or constructive. 2. Expenses of Delivery: According to Section 36(5), unless otherwise agree
Post a Comment
Read more