The Union Cabinet has given its approval to the Digital Personal Data Protection Bill (DPDP).
Disclosure of data breaches
The Bill is expected to allow “voluntary undertaking” – meaning that companies can voluntarily disclose data breaches to the Data Protection Board (DPB).
The “voluntary disclosure mechanism is akin to the plea bargain method, an accepted legal procedure in many countries,”an official said.
“Companies can come forward and (admit) to a breach of any (kind) and pay the necessary penalties.”
Data Protection Board
The proposed DPB will consist mostly of independent industry experts and not government officials and will function as a “digital office.”
It will be empowered to levy a penalty of up to Rs 250 crore on organizations found to be in breach which it can increase to a maximum of Rs 500 crore with requisite cabinet approval.
Protecting children
Children have been defined as anyone under the age of 18.
Companies can be asked to delete data that was collected before any digital personal data protection regime was in place, including that of children.
“It was necessary to ensure the safety of children online since they are very vulnerable,” officials said.
Personal data
Personal data can be processed only if an individual has consented to it.
However there are some exceptions for when the government might need data on grounds of national security and law and order.
Individuals will have the right to seek details about their data collection, storage, and processing once the law is implemented.
Cross-border data flows
A key change introduced in the final draft of the Bill pertains to cross-border data flows to international jurisdictions.
Instead of a whitelisting approach, the government would shift to a blacklisting mechanism.
This means that global data flows would be allowed by default to all jurisdictions except for specific countries where such transfers would be restricted- an official blacklist of countries.
The bill is likely to be introduced in the upcoming monsoon session of Parliament to be held from July 20 to August 11.
