The much awaited Personal Data Protection Bill, 2019, will finally be introduced, considered and passed in the Winter Session of the Parliament, per a Lok Sabha bulletin released on November 14. The Winter session will begin on November 18, and will last till December 13.

As per the bulletin, the aim of the bill is “[t]o ensure the protection of the personal data of citizens and the growth of digital economy and to regulate all aspects of data and details; various obligations which will be required to be fulfilled wherever the Personal Data is involved”. Apart from this bill, 27 others bills are listed for introduction.

A timeline of the Personal Data Protection Bill

November 2017: Srikrishna Committee releases consultation paper
A committee, led by former Supreme Court Justice B.N. Srikrishna, released a consultation paper with 229 questions for public comments (until December 31, 2017). These comments and the committee’s minutes of meeting were not made public voluntarily, and even upon an RTI filed by MediaNama. MeitY had said that the submissions were “confidential” and “not available for public dissemination” without the consent of the submitting entities.

July 27, 2018: Srikrishna Committee submits draft bill
Justice B.N. Srikrishna Committee submitted the draft Personal Data Protection Bill 2018; also submitted a report about digital economy

August 14, 2018: MeitY invites comments on the bill
MeitY invited public comments on PDP Bill 2018; submissions open for 20 days until September 5, deadline later extended until September 30.

  • MeitY refused to make comments public, but MediaNama compiled a list of submissions here. Dvara Research also compiled a list.
  • In the initial round of consultations, MeitY reportedly got comments from over 600 entities.

August 2019: MeitY seeks further comments from stakeholders, no public consultation follows
MeitY sought additional comments from stakeholders until August 25, 2019. Even though new issues, such as non personal data, were introduced in the questions that MeitY sent to some of the stakeholders, no public consultation followed. MeitY Join Secretary S. Gopalakrishnan defended the lack of public consultation by calling these comments “clarifications”.

  • Not all industry and civil society stakeholders who participated in the initial consultation had received these questions. Gopalakrishnan had said that since the ministry had received comments from over 600 entities, they would not reach out to all of them for further comments.

September 13, 2019: MeitY forms committee to come up with bill about non-personal data
MeitY formed a new Committee of Experts to focus on non-personal data, and to come up with a related data governance framework. Infosys co-founder Kris Gopalakrishnan is heading the committee. It is unclear at this stage if non-personal data will be covered by the PDP Bill. Although the Srikrishna Committee had recommended that the government come up with a law to protect community data, given MeitY’s August 2019 consultations which specifically raised the issue of non-personal data, it is possible that PDP Bill 2019 might deal with it.

November 14, 2019: PDP Bill 2019 listed for introduction in Parliament’s Winter Session

November 18, 2019: Parliament’s Winter Session begins (to last until December 13)