India’s personal data protection bill: impact on technology and tech-firms

Abstract

India’s Personal Data Protection Bill has been under draft process, headed by the Srikrishna committee since 2018. Tabled in the Parliament in the Lok Sabha in 2019, the bill has since been a major point of contention between the Government, the Public, and the Industry – particularly the technology sector. Finding its roots in the General Data Protection Regulation of 2016 in the European Union, the bill focuses to bring Privacy rights to individuals by specifying data collection, storage, processing and sharing norms for businesses. Violation of the same would lead to steep fines, to the tune of 2-4% of global revenues of the firm in question. This mandates Privacy by design, data minimalism and affixes responsibility of the collected to the firm as a fiduciary. The Indian bill augments certain critical features over GDPR, for instance - 1. Data Localization foe sensitive and critical data 2. Inferential Personal data 3. Deletion of data beyond stipulated retention period 4. Exemptions to the Government Since the introduction of this bill, there has been an ongoing tug of war between the Government of India and Tech companies – both global and domestic. With the government's focus on citizen's data privacy, the bill has taken an inherently restrictive stance. This hamstring the functioning of several dominant and emerging technologies, inherently affecting their business potential. In this study, we focus on the probable impacts of this bill, if passed in the current form without major modifications to key provisions, on the technology sector.