Data protection bill presentation to the Union Cabinet today

The data protection bill presentation before the Union Cabinet today (Wednesday), and the legislation is expected to come before the Monsoon session of Parliament after Cabinet approval, says The Indian Express.

A draft of the bill was first introduced last November, after which it went through a few rounds of public consultation. A second draft was prepared and submitted to a few inter-ministerial discussions based on the input received during the consultations.

"The Cabinet is expected to take up the Digital Personal Data Protection Bill, 2022 on Wednesday, and once it gets the approval, the Bill will be tabled in the upcoming Parliament session," a senior government official said, requesting anonymity.

The bill is a crucial pillar of a comprehensive framework of technology regulations that the Center is building, including the Digital India Bill, the proposed successor to the Information Technology Act 2000; India Telecommunication Bill, 2022; and a policy for the governance of non-personal data.

The new draft came after the government withdrew an earlier version from Parliament last August after nearly four years of work, where it went through multiple iterations, including a review by a Joint Committee of Parliament (JCP), and it faced pushback from a range of stakeholders, including tech companies and privacy activists.

The Indian Express previously reported that in a move that could further liberalize conditions for data transfers, the proposed new law could allow global data flows by default to all jurisdictions other than a specific negative list of countries where such transfers would be restricted.

The draft released for public consultation said that the Center would notify countries or territories where the personal data of Indian citizens may be transferred. Sources said this would likely be changed with the bill allowing cross-border data flows to all geographies with an official blacklist from countries where transfers would be restricted.

This change is seen as a move to ensure business continuity and position India as a crucial part of the global data transfer network, an essential element of trade negotiations the country is currently exploring with critical regions such as the European Union.

A "presumed consent" provision in the Digital Personal Data Protection Bill 2022 could also be reworded to be more stringent for private entities and allow government departments to assume consent when processing personal data for national security purposes and public interest. The bill could also incorporate a provision to ensure it does not conflict with pre-existing regulations issued by other departments or ministries, this document previously reported.

Privacy activists have criticized the bill for offering broad exemptions to the Center and its agencies and diluting the role of the data protection board.