Govt May Drop Centralised Data Protection Authority From New Privacy Bill: Report

The government may drop the proposal for setting up a centralised data protection authority (DPA) in the new privacy bill it is working on. The concept of DPA was proposed in the Personal Data Protection Bill, which was withdrawn by the government earlier this month after facing a lot of criticism from privacy advocates and tech companies. 

In place of the DPA, the government is planning to introduce a grievance redressal mechanism for aggrieved individuals, Hindustan Times reported.

“A lot of the functions that were allotted to DPA were out of its remit; the collection, storage and sharing of personal data will either be worked into the law itself or be included in the rules that will be made under the law,” the report quoted an official as saying. 

According to the official, the government does not want to not overwhelm one authority and increase compliance costs for small companies.

Another official was quoted as saying that the government is looking at making the bill as uncomplicated as possible.

While a grievance redressal mechanism is being considered for users who feel that their data has been misused, nothing has been finalised yet. Moreover, the proposals will be circulated as a draft for public feedback.

Earlier this month, the government withdrew the Personal Data Protection Bill after 81 amendments were proposed by a joint parliamentary committee (JPC). At the time of the withdrawal, the government said it was planning to introduce a new Bill.

“Considering the report of the JPC, a comprehensive legal framework is being worked upon. Hence, in the circumstances, it is proposed to withdraw The Personal Data Protection Bill, 2019 and present a new bill that fits into the comprehensive legal framework,” Minister of Electronics and Information Technology (MeitY) Ashwini Vaishnaw said.

Besides data protection, the withdrawn bill also covered other areas like cybersecurity, national data governance policy, data management and safety. However, Minister of State in MeitY Rajeev Chandrasekhar said that the bill would have hurt startups, while the big tech companies would have just hired more lawyers to comply with the regulations.

The data protection bill was first drafted in 2017 by a panel led by retired Supreme Court Judge BN Srikrishna. Later, the Personal Data Protection Bill was introduced in the Parliament in 2019.

However, following opposition by political parties, it was sent to the parliamentary panel for discussion. The panel submitted its report to the Parliament last year, following which the Personal Data Protection Bill, 2021 was presented.