"Prima facie it seems that the draft that was put out in 2019 after widest possible consultations has changed fundamentally, including the title of the bill from Personal Data Protection Bill to Data Protection Bill. Certain other deviations such as the recommendations that social media intermediaries could become publishers in certain circumstances and a few aspects of data localisation norms change the original structure of the Bill substantially," the Internet and Mobile Association of India (IAMAI) said in its statement on the Joint Parliamentary Committee’s Report on the Personal Data Protection Bill, 2019. Read MediaNama's guide to the Data Protection Bill, 2021 What are IAMAI's concerns with the new Bill? Getting permissions for cross-border data flows will be incredibly cumbersome: "The requirement on DPA to consult the Central Government before issuing any approvals or decisions on cross-border data flows would create an incredibly slow and cumbersome process for decisions and would mitigate the autonomy and efficiency of a specialised body such as the DPA," IAMAI said. The Bill requires sensitive and critical personal data to be stored in India but allows the transfer of sensitive personal data outside India under certain conditions. However, these conditions have to be approved by the Central Government and not just the Data Protection Authority as required in the earlier Bill. Algorithmic transparency and data portability impinge upon IP rights: "The Bill will impinge upon the IP rights of the companies as part of the new requirements on data portability and algorithmic transparency. These objectives can be achieved…
