The Personal Data Protection Bill, which is expected to be tabled in Parliament this session, will categorise personal data into three categories: personal data, sensitive personal data, and critical personal data, MeitY Minister of State Sanjay Dhotre informed the Lok Sabha in a written response. This is in line with the recommendations made by the Justice B.N. Srikrishna Committee.
DMK MP Shanmuga Sundaram K. had also asked if the Srikrishna Committee had made any recommendations on “non-personal and supersensitive data”. Dhotre did not address that. This is despite the fact that the Srikrishna Committee, in its report, A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians“, recommended that the government come up with a law to protect community data where a community is identifiable.
The government, as it said in the Economic Survey, has been considering monetising its databases by selling the data to private companies. In the last Parliament session, Road Transport Minister Nitin Gadkari had informed Rajya Sabha that the ministry had provided 87 private and 32 government entities access to the Vahan and Sarathi database, and has collected Rs 65 crore so far by giving such access.
To that end, MeitY formed a new Committee of Experts to focus on non-personal data, and to come up with a related data governance framework. Infosys co-founder Kris Gopalakrishnan is heading the committee. The committee has been holding private consultations with multiple stakeholders, and it isn’t clear whether there will be public consultation for regulation of non-personal data. Thus far, the committee has met ride hailing companies Uber and Ola, and e-commerce platforms Amazon and Flipkart.
Question (by Shanmuga Sundaram K.) Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state :
- whether the Government has received Justice B.N. Srikrishna Committee report on data protection;
- if so, the details and the major recommendations thereof along with the action taken by the Government thereon;
- whether the said committee report has any recommendation on the subjects such as personal, non-personal and supersensitive data and if so, the details thereof;
- the categories of personal data identified in the report;
- whether the Government has accepted the said categorisation of personal data by the committee report and if so, the details thereof; and
- whether the Government has prepared any draft legislation with regard to data protection and if so, the details thereof including the details of provisions related to protection of non-personal data in the proposed legislation?
Answer (by Sanjay Dhotre, MoS, MeitY)
(a) and (b): Yes, Sir. The Ministry of Electronics and Information Technology (MeitY) on 31st July 2017, vide OM No.3(6)/2017-CLES, constituted a Committee of Experts under the Chairmanship of Justice B N Srikrishna, Former Judge, Supreme Court of India, to look into all aspects relating to personal data protection. The committee gave its report on 27th July, 2018. The Committee also submitted a draft Personal Data Protection Bill. Wide consultations were held on the draft bill and open feedback was invited on the contents of the bill. These are currently being processed and it is proposed to table the bill in Parliament.
(c), (d), (e) and (f): The committee in its report and the draft bill, proposed to categorise personal data into personal data, sensitive personal data and critical personal data. On the same lines as proposed by the Committee, it is proposed to categorize personal data into three categories of personal data namely personal, sensitive personal and critical personal data.