Data protection at government’s mercy

The new bill raises the penalty provisions for entities failing to protect individuals from data breaches from Rs 15 crore to Rs 250 crore.

Published: 21st November 2022 12:41 AM  |   Last Updated: 21st November 2022 12:47 AM   |  A+A-

data privacy , cyber security

Image for representation

The government has re-introduced the Personal Data Protection Bill without budging on the most contentious provision to exempt itself from the law. The new draft bill justifies the exemption in the interest of “sovereignty and integrity of India, security of the state, friendly relations with foreign states, maintenance of public order or preventing incitement to any cognizable offence relating to any of these”.
These are wide-ranging conditions under which the government can breach a person’s data privacy without submitting to the regulations against such breaches.

The new bill raises the penalty provisions for entities failing to protect individuals from data breaches from Rs 15 crore to Rs 250 crore. However, it keeps the government out of its ambit for various reasons. These exemptions must be a cause for concern, as they give the state immense power to breach an individual’s privacy under some pretext. The newly introduced bill seems simpler and shorter but has left many loose ends. Data protection activists feel the idea behind keeping them is to let the government have a say in reframing some of the rules and regulations in its favour, if need be, in future. The new bill replaces the Data Protection Authority of India with the Data Protection Board of India. However, the fact that the Union government will have a lot of say in the selection and removal of members of the Board, including the chairperson, puts a question mark on the Board’s independence.

With most democratic institutions today prone to political meddling, it is pertinent to reimagine the powers and controls of newly formed institutions and regulators—especially those that directly impact ordinary people’s freedom and privacy. There are other shortcomings as well. It proposes a penalty of Rs 10,000 for registering a false or frivolous complaint, suppressing material information or furnishing false documents/particulars. This might prove a deterrenent for filing genuine complaints. Personal privacy and data protection is too serious a matter to be left to the discretion of the government alone, given the kind of power the state has over individuals. This is the draft bill, and the government has sought comments from the public. Hopefully, experts and activists will raise these concerns and force the government to re-think the provisions to exempt itself from the scope of the law or at least force a compromise.


Disclaimer : We respect your thoughts and views! But we need to be judicious while moderating your comments. All the comments will be moderated by the editorial. Abstain from posting comments that are obscene, defamatory or inflammatory, and do not indulge in personal attacks. Try to avoid outside hyperlinks inside the comment. Help us delete comments that do not follow these guidelines.

The views expressed in comments published on are those of the comment writers alone. They do not represent the views or opinions of or its staff, nor do they represent the views or opinions of The New Indian Express Group, or any entity of, or affiliated with, The New Indian Express Group. reserves the right to take any or all comments down at any time.

flipboard facebook twitter whatsapp