wordpress blog stats
Connect with us

Hi, what are you looking for?

DPDP Bill, 2022: Personal data processing now primed with ‘deemed consent’, and other changes

Digital Personal Data Protection (DPDP) Bill, 2022 has been announced with new provisions on withdrawing consent, and on ‘deemed consent’

Key takeaways:

  • Personal data can be processed for a “lawful purpose” which is any purpose not forbidden by law
  • Government introduces ‘deemed consent’ in case of public interest or any law
  • Data can now be retained for “legal or business purposes”
  • Data fiduciaries to give itemised notice before requesting a Data Principal’s consent to process personal data

The Government of India came out with the fourth version of the data protection Bill, now dubbing it Digital Personal Data Protection Bill, 2022. In this version, the Bill brings back “lawful purpose” of personal data processing, introduces deemed consent and consent manager among other changes.

The feedback on this draft Bill “in a chapter wise manner” can be sent by December 17, 2022 using the MyGov website shared by the government. The notice also specified that “no public disclosure of the submissions will be made.”

Definitions as per the new Bill

The new Bill uses the following terms:

Data Fiduciary: Any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data;
Data Principal: The individual to whom the personal data relates and where such individual is a child includes the parents or lawful guardian of such a child;
Data Processor: Any person who processes personal data on behalf of a Data Fiduciary;
Data Protection Officer: An individual appointed as such by a Significant Data Fiduciary under the provisions of this Act

Changes in obligations of data fiduciaries

Bringing back lawful purpose in processing data: The framing for the Clause on personal data processing was rephrased again. It reintroduced the term “lawful purpose” from the 2019 version, clarifying that the same is “any purpose which is not expressly forbidden by law.” In the new Bill, it now reads:

A person may process the personal data of a Data Principal only in accordance with the provisions of this Act and Rules made thereunder, for a lawful purpose for which the Data Principal has given or is deemed to have given her consent in accordance with the provisions of this Act.”

Lalit Panda, Senior Resident Fellow at Vidhi Centre for Legal Policy, pointed out in a Twitter thread that the Bill removed explicit mention of purpose specification, limitation, safeguards for sensitive personal data, most of which are “core obligations.”

Advertisement. Scroll to continue reading.

Bill introduces ‘deemed consent’: The term ‘deemed consent’ essentially adds in a new clause that a data principal is “deemed” to have consented to the processing of their personal data:

for the performance of any function under any law, or the provision of any service or benefit to the Data Principal, or the issuance of any certificate, license, or permit for any action or activity of the Data Principal, by the State or any instrumentality of the State;

“for the purposes related to employment, including prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information, recruitment, termination of employment, provision of any service or benefit sought by a Data Principal who is an employee, verification of attendance and assessment of performance;

“in public interest”

The latter condition then further elaborates in cases of ”

(a) prevention and detection of fraud;
(b) mergers, acquisitions, any other similar combinations or corporate restructuring transactions in accordance with the provisions of applicable laws;
(c) network and information security;
(d) credit scoring;
(e) operation of search engines for processing of publicly available personal data;
(f) processing of publicly available personal data; and
(g) recovery of debt;
(9) for any fair and reasonable purpose as may be prescribed after taking
into consideration”

Advertisement. Scroll to continue reading.

Panda said that deemed consent was essentially the same as “non-consensual grounds” of processing data. He also mentioned that this clause conflicts with consent withdrawal provisions.

Data can be retain for legal or business purposes: The Bill states that a Data Fiduciary must cease to retain personal data, or remove the means by which the personal data can be associated with particular Data Principals if “retention is no longer necessary for legal or business purposes.

As an example, the Bill talks about how banks are required to retain personal data of customers for a period beyond six months, under KYC rules. In such a case, a bank “may retain” Person ‘A’s’ personal information, collected while opening an account, even after the person closes said account. This is because the KYC rules will serve as a “legal purpose” to retain data.

Panda was worried that this made data retention “porous.”

Advertisement. Scroll to continue reading.

Data Fiduciary to give itemised notice beforehand: Before getting a Data Principal’s consent, a data fiduciary will have to give an itemised notice describing in clear language the personal data sought to be collected and the purpose of processing of such personal data. However, Panda pointed out this only applies to consent. What happens in case of deemed consent?


FREE READ of the day by MediaNama: Click here to sign-up for our free-read of the day newsletter delivered daily before 9 AM in your inbox.


Purpose Limitation 

What the 2018 Bill said: Personal data will be processed only for:

  • Clear, specific, lawful purposes; 
  • Specified or incidental purposes that the data principal would expect given the context in which the data was collected.

What the 2019 Bill said: The Bill was revised to say that personal data processing is prohibited except for specific, clear, lawful purposes. In case, the data is processed, it must be done :

  • In a fair and reasonable processing and ensure the privacy of the data principal’s privacy
  • For the purpose consented to or anticipated by the data principal

What the 2021 Bill said: The Joint Parliamentary Committee felt the previous framing on prohibition had “a negative connotation” and changed it to “the processing of personal data by any person shall be subject to the provisions of this Act and the rules and regulations made thereunder”.

Similarly, the Committee added the expression “or which is for the purpose of processing of personal data under section 12″ in sub-clause 5(b) of the 2019 Act. It felt that the limitations of purpose must be understood in the “context of the purpose.” It also noted there was no mention of grounds for processing data without consent.

Collection Limitation

What the 2018 Bill said: Personal data collection will be limited to data necessary for processing.

What the 2019 Bill said: Language was refined. It read, ” The personal data shall be collected only to the extent that is necessary for the purposes of processing of such personal data.”

Advertisement. Scroll to continue reading.

What the 2021 Bill said: Provision unchanged.

Lawful and Consent-Based Data Processing

What the 2018 Bill said: Under the “lawful processing” provision, personal data and sensitive personal data will only be processed on the basis of the grounds laid out in Chapters III and IV of the Act respectively. 

What the 2019 Bill said: The “lawful processing” provision was deleted. 

Instead, a new provision was inserted on “consent necessary for processing of personal data”. It read, “The personal data shall not be processed, except on the consent given by the data principal at the commencement of its processing.” It also stated that consent will be invalid unless it is free, informed, clear, specific, and capable of being withdrawn.

For sensitive personal data processing, explicit consent would be obtained after clearly informing the data principal of the purpose for processing that is likely to cause significant harm. 

Additionally, the provision of goods or services, performance of contracts, or enjoyment of legal rights or claims will not be conditional on consenting to personal data processing not necessary for that purpose.

Advertisement. Scroll to continue reading.

The burden of proof that the data principal has explicitly consented lies with the data fiduciary. The data principal will bear the legal consequences if they withdraw consent without any valid reason.

What the 2021 Bill said: Provision of goods, services, etc., will additionally not be “denied based on exercise of choice“.

  • JPC Rationale: None provided.

The Committee rephrased the Clause specifying action against data principal for withdrawing consent sans reasoning. It read, “Where the data principal withdraws his consent without any valid reason, the consequences of the same, shall be borne by such data principal.”

  • JPC Rationale: To remove redundancies and superfluous phrases. 

Notices

What the 2018 Bill said: The data fiduciary should provide the data principal with certain information on: 

  • Purposes for data processing; 
  • Categories of data collected; 
  • Identity and contact details of the data fiduciary and data protection officer;
  • Basis for processing data under Sections 12-17 and 18-22 (and consequences of failing to provide such data);
  • Source of data collection, if the personal data is not collected from the data principal;
  • Individuals or entities with whom personal data may be shared;
  • Potential cross-border transfers of personal data; 
  • Period of data retention (if unknown, criteria for determining this period must be conveyed);
  • Right to withdraw consent and the procedure to do so, existence of and procedure for exercising data principal rights (in the case of consent-based processing);
  • Procedure for grievance redressal, existence of a right to file complaints to the Data Protection Authority
  • “Data trust scores” assigned to the data fiduciary;
  • Other information specified by the Authority.

Issuing a notice is not applicable if it “substantially prejudices” data processing under Sections 15 or 21 (processing of personal data and certain categories of sensitive personal data for “prompt action”).

What the 2019 Bill said: Basis for processing data under Sections 12-14 must be provided, and there will be consequences of failing to provide such data. Issuing a notice is not applicable if it would “substantially prejudice” data processing under Section 12. 

Section 12 contains provisions for processing personal data without consent, Section 13 for processing related to “employment, etc”, and Section 14 for processing for “other reasonable purposes”.

What the 2021 Bill said: Barring minor phrasing changes, the provision remained the same.

Sharing, transfer of personal data

What the 2018 Bill said: The fiduciary shall “take reasonable steps to ensure that personal data processed is complete, accurate, not misleading and updated”. In doing so, it should keep in mind whether the personal data:

Advertisement. Scroll to continue reading.
  • Will be used to make a decision about the data principal;
  • Will be disclosed to other individuals or entities;
  • Will be kept in a form distinguishing personal data based on facts, opinions, or personal assessments.

When disclosing personal data that is incomplete, inaccurate, misleading, or outdated to other individuals or entities, the fiduciary shall take “reasonable steps” to notify them of this.

What the 2019 Bill said: Provision remained the same. 

What the 2021 Bill said: Notification in the event of incomplete data disclosures will not apply if doing so prejudices processing personal data without explicit consent.

  • JPC Rationale: Failing to have such a provision “may create hurdles in the smooth functioning of government agencies processing personal data”.

A new provision states “a data fiduciary may share, transfer or transmit the personal data to any person as part of any business transaction in such manner as may be prescribed”. The provision will not apply if it prejudices processing personal data without consent.

  • JPC Rationale: This will “curb the seamless sharing, transfer or transmission of data between various entities and individuals especially under the garb of services.”

Data Storage Limitation

What the 2018 Bill said: Personal data will be retained for as long as is necessary for the purpose-based processing. It may be retained for longer if explicitly mandated, or necessary for legal compliance. Data fiduciaries must periodically review whether it is necessary to retain it—if unnecessary, it should be deleted.

What the 2019 Bill said: The Bill revised certain provisions, namely:

  • Personal data will be retained for as long as is needed for processing, and be deleted at the end of processing;
  • It may be retained if “explicitly consented to by the data principal,” or if necessary for legal compliance.

What the 2021 Bill said: “The data fiduciary shall not retain any personal data beyond the period necessary to satisfy the purpose for which it is processed and shall delete the personal data at the end of such period“.

  • JPC Rationale: The revision will help “the functioning of agencies which process the collected data multiple times for welfare purposes.”

Written with inputs from Aarathi Ganesan 

Note: This story was updated at 3:50 PM on November 19, 2022 with the link to send feedback to the government.

Note: Story updated at 2:27 PM on December 1, 2022, to correct grammatical errors. 


This post is released under a CC-BY-SA 4.0 license. Please feel free to republish on your site, with attribution and a link. Adaptation and rewriting, though allowed, should be true to the original.

Advertisement. Scroll to continue reading.

Written By

I'm interested in the shaping and strengthening of rights in the digital space. I cover cybersecurity, platform regulation, gig worker economy. In my free time, I'm either binge-watching an anime or off on a hike.

Free Reads

News

The service from the tie-up will initally be launched at Bengaluru, Bhubaneswar, Vijayawada and Visakhapatnam railway stations

News

The Minister's response came after an X user posted answers generated by Gemini regarding Prime Minister Narendra Modi.

News

Vaishnaw said that in the next five years, there will be significant disruptions in the way telecom technology operates.

MediaNama’s mission is to help build a digital ecosystem which is open, fair, global and competitive.

Views

News

Notably, Indus Appstore will allow app developers to use third-party billing systems for in-app billing without having to pay any commission to Indus, a...

News

The existing commission-based model, which companies like Uber and Ola have used for a long time and still stick to, has received criticism from...

News

Factors like Indus not charging developers any commission for in-app payments and antitrust orders issued by India's competition regulator against Google could contribute to...

News

Is open-sourcing of AI, and the use cases that come with it, a good starting point to discuss the responsibility and liability of AI?...

News

RBI Deputy Governor Rabi Shankar called for self-regulation in the fintech sector, but here's why we disagree with his stance.

You May Also Like

News

Google has released a Google Travel Trends Report which states that branded budget hotel search queries grew 179% year over year (YOY) in India, in...

Advert

135 job openings in over 60 companies are listed at our free Digital and Mobile Job Board: If you’re looking for a job, or...

News

By Aroon Deep and Aditya Chunduru You’re reading it here first: Twitter has complied with government requests to censor 52 tweets that mostly criticised...

News

Rajesh Kumar* doesn’t have many enemies in life. But, Uber, for which he drives a cab everyday, is starting to look like one, he...

MediaNama is the premier source of information and analysis on Technology Policy in India. More about MediaNama, and contact information, here.

© 2008-2021 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ

Subscribe to our daily newsletter
Name:*
Your email address:*
*
Please enter all required fields Click to hide
Correct invalid entries Click to hide

© 2008-2021 Mixed Bag Media Pvt. Ltd. Developed By PixelVJ