The Union Cabinet approved the introduction of the Person Data Protection Bill in Parliament, the government announced.
The Draft Bill, the Personal Data Protection Bill, 2018, was prepared by a high-level expert committee headed by former Supreme Court judge B.N. Srikrishna. The Bill deals with the broad guidelines on the collection, storage and processing personal data, the consent of individuals, penalties and compensation, and a code of conduct.
The Draft Bill classifies ‘sensitive personal data’ as including passwords, financial data, health data, sex life, sexual orientation, biometric data, genetic data, transgender status, intersex status, caste or tribe, and religious or political belief or affiliation. The draft Bill says that such sensitive personal data can be processed only with the explicit consent of the person, and this consent needs to be informed, clear and specific, as defined by the Bill itself.
The draft bill also has a provision for the right to be forgotten, where the person “shall have the right to restrict or prevent continuing disclosure of personal data”.
There is also a provision for the central government to notify categories of personal data as critical personal data, which will then be only processed in a server or data centre located in India.
Personal data is to be stored in India, but can be processed outside with the consent of the person. The draft Bill also specifies penalties for not following its provisions, including a penalty of 5 crore or 2% of turnover, whichever is higher, if no action is taken on a data leak. The Personal Data Protection Bill will likely be introduced in Parliament during the ongoing Winter Session.