Personal Data Protection Bill, 2019

Question 1

Applicability

Answer 1

governs the processing of personal data by: (i) government, (ii) companies incorporated in India, and (iii) foreign companies dealing with personal data of individuals in India.

Question 2

What are the types of data created?

Answer 2

Personal data: Data from which an individual can be identified like name, address etc..

Sensitive personal data (SPD): Some types of personal data like as financial, health, sexual orientation, biometric, genetic, transgender status, caste, religious belief, and more.

Critical personal data: Anything that the government at any time can deem critical, such as military or national security data.

Question 3

what is data fiduciary?

Answer 3

entity or individual who decides the means and purpose of processing personal data. -> can be service provider companies.

Question 4

Rights of the individual?

Answer 4

(i) obtain confirmation from the fiduciary on whether their personal data has been processed
(ii) seek correction of inaccurate data
(iii) have personal data transferred to any other data fiduciary
(iv) restrict continuing disclosure

Question 5

Grounds for processing personal data

Answer 5

• if consent is provided by the individual
• If needed by state by the State for providing benefits to the individual, (ii) legal proceedings, (iii) to respond to a medical emergency.

Question 6

restrictions on social media intermediaries

Answer 6

intermediaries which have users above a notified threshold, and whose actions can impact electoral democracy or public order, have certain obligations, which include providing a voluntary user verification mechanism for users in India.

Question 7

amendments to other laws?

Answer 7

amends the Information Technology Act, 2000 to delete the provisions related to compensation payable by companies for failure to protect personal data.

Question 8

provisions related to Sharing of non-personal data with government?

Answer 8

(i) non-personal data and (ii) anonymised personal data (where it is not possible to identify data principal) for better targeting of services.

Question 9

Functions of data protection authority

Answer 9

Bill sets up a Data Protection Authority to (i) protect interests of individuals

(ii) prevent misuse of data
(iii) ensure compliance

elligibiility for authority : 10 years’ expertise in the field of data protection and information technology

appeals against it : Orders of the Authority can be appealed to an Appellate Tribunal. Appeals from the Tribunal will go to the Supreme Court.

Question 10

Transfer of data outside India

Answer 10

• if explicitly consented to by the individual

- personal data notified as critical personal data by the government can only be processed in India.

Question 11

Exemptions

Answer 11

central government can exempt any of its agencies from the provisions of the Act: (i) in interest of security of state, public order, sovereignty and integrity of India and friendly relations with foreign states, and (ii) for preventing incitement to commission of any cognisable offence (i.e. arrest without warrant) relating to the above matters. Processing of personal data is also exempted from provisions of the Bill for certain other purposes such as: (i) prevention, investigation, or prosecution of any offence, or (ii) personal, domestic, or (iii) journalistic purposes.