{"id":702,"date":"2022-11-24T06:55:25","date_gmt":"2022-11-24T06:55:25","guid":{"rendered":"https:\/\/cryptolegal.in\/staging\/?p=702"},"modified":"2024-05-15T15:48:01","modified_gmt":"2024-05-15T15:48:01","slug":"the-deemed-data-protection-bill-2022-2","status":"publish","type":"post","link":"https:\/\/cryptolegal.in\/?p=702","title":{"rendered":"The Deemed Data Protection Bill 2022"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t

The Deemed Data Protection Bill 2022<\/h1>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\n

The Boring Part: DPB 2019<\/h2>\n\n

The Data Protection Bill 2019 (DPB 2019) was introduced in the lower house of the Indian parliament, the Lok Sabha, on December 11, 2019. It sought to provide a framework for the regulation of data processing activities in India. It was criticized by privacy advocates for its weak protections for data subjects and its failure to address key concerns related to data governance. The bill was pending before a parliamentary committee, but was withdrawn on August 3, 2022.<\/p>\n\n

The DPB 2019’s (promised) key features were:<\/p>\n\n

    \n
  1. Establishing the Data Protection Authority of India (DPAI) as the primary regulator of data processing activities in India.<\/li>\n\n
  2. Vesting the DPAI with the power to issue guidelines, conduct investigations, and impose penalties for violations of the data protection regime.<\/li>\n\n
  3. Requires data processors<\/em> to take reasonable security measures to protect data from unauthorized access, disclosure, or destruction.<\/li>\n\n
  4. Requiring data processors<\/em> to provide data subjects<\/em> with access to their data upon request and to allow them to correct or delete inaccurate data.<\/li>\n\n
  5. Exempting certain data processing activities from compliance with the data protection regime, including activities relating to national security, law enforcement, and research.<\/li>\n\n
  6. Including specific provisions for the transfer of data to foreign jurisdictions.<\/li>\n\n
  7. Imposing fines of up to Rs. 5 crore (approx. US$700,000) or 2% of a data processor’s global turnover, whichever is higher, for violations of the data protection regime.<\/li>\n<\/ol>\n\n

    Critics were quick to point out many issues with the DPB 2019. For instance, it did not require companies to get consent from individuals before collecting, using or sharing their personal data. It also did not place any restrictions on how companies could use or share individuals’ biometric data, or even require companies to disclose data breaches to affected individuals. It did not give individuals the right to know what personal data is being collected about them (which makes sense given they were classified as data ‘subjects’).<\/p>\n\n

    Fast forward to 2022: the government seems to have taken heed of some these concerns while drafting the Data Protection Bill 2022. Or it least it says so.<\/p>\n\n

    The Brief Story of a Failed Rebranding: DPB 2022<\/h2>\n\n

    On November 18, 2022 the legislature proposed a new bill which is now under civil society review (yes, I do secretly hope this<\/em> CSR catches on). Its USP is that it would require data handlers (not a legal term yet) to take steps towards the protection of personal data<\/em> of Indians and would give individuals the right to know what personal data is being collected about them, the right to change their consent for the collection and use of their personal data, and the right to file a complaint if they feel their rights have been violated.<\/p>\n\n

    And since no Indian legislation is complete unless it sets up its own governing authority, the DPB 2022, just like its predecessor, promises to establish a data protection authority to oversee the implementation of the law. But relax, it’s called a ‘board’ now. And remember the data ‘subject’? She’s been rebranded as the data ‘principal’. Hare Krishna! What could possible go wrong?<\/p>\n\n

    In a word\u2026lawyers. The government is a disguised army of lawyers (I’ll rant about this some other time because it has to do with HLA Hart). As tweefolk<\/a>\u00a0have already started noticing, the DPB 2022 plays the ambiguity card well. It tries to preserve the real rule-making powers to itself through transparency-deferral-devices such as ‘deemed consent’ and ‘as may be prescribed’. The long and short of it is that the DPB 2022 guarantees nothing on any of its key promises. In fact, it seems to tilt the scales more heavily in favour of big tech than previously.<\/p>\n\n

    Sample this, there are new obligations on data principals for inaccurate information, and a total cap of 500cr INR (Zuck’s revenue from India last year was worth almost thrice<\/a> this amount) for breaches by data fiduciaries. Moreover, there are explicit provisions permitting the free global transfer of data with little to no protection (PWC say that data localisation<\/em> principles have been ‘eased out’). There’s a lot more detail but I think you get the big picture. My favourite part? ‘consent managers’, go figure.<\/p>\n\n

    Whataboutery Blockchain<\/h3>\n\n

    So if GDPR is the gold standard in terms of data protection laws, we can firmly say that the DPB 2022 is swiggy – promising much, delivering nothing. Seriously, this was the government’s chance to showcase that Digital India is a forward looking venture, not some back-office-hack-job for big tech. There is zero mention of leveraging new or emergent technologies for protecting personal data. Instead, the government chose to bury or defer all the important decisional criteria and facilitate a market for Indian citizens’ personal data.<\/p>\n\n

    Does this have any direct implications for the blockchain industry? Sure. Depending on the protocol and its function, it may incur obligations, liabilities, and rights of data processors or fiduciaries. Conceptually speaking, if it is fully decentralised, then these obligations would be hard to pin down on one person. And just like in the Ooki DAO case, the Data Protection Board may find itself chasing a bunch of code.<\/p>\n\n

    What I find truly surprising\/distressing is the lack of coordination between government departments, and their mutual blindness. On the one hand, ethical AI and blockchain<\/strong><\/a> technologies are being promoted, while on the other its genuine potential to create public good is being overlooked.<\/p>\n\n

    Let there be no confusion about this, the DPB 2022 is not badly drafted, it is just anachronistic. Its aim is to resuscitate big tech in an age when we should be giving it some more milk of the poppy.<\/p>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

    \n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t

    RECENT BLOGS<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

    The Deemed Data Protection Bill 2022 The Boring Part: DPB 2019 The Data Protection Bill 2019 (DPB 2019) was introduced in the lower house of the Indian parliament, the Lok Sabha, on December 11, 2019. It sought to provide a framework for the regulation of data processing activities in India. It was criticized by privacy advocates for its weak protections for data subjects and its failure to address key concerns related to data governance. The bill was pending before a parliamentary committee, but was withdrawn on August 3, 2022. The DPB 2019’s (promised) key features were: Critics were quick to point out many issues with the DPB 2019. For instance, it did not require companies to get consent from individuals before collecting, using or sharing their personal data. It also did not place any restrictions on how companies could use or share individuals’ biometric data, or even require companies to disclose data breaches to affected individuals. It did not give individuals the right to know what personal data is being collected about them (which makes sense given they were classified as data ‘subjects’). Fast forward to 2022: the government seems to have taken heed of some these concerns while drafting the Data Protection Bill 2022. Or it least it says so. The Brief Story of a Failed Rebranding: DPB 2022 On November 18, 2022 the legislature proposed a new bill which is now under civil society review (yes, I do secretly hope this CSR catches on). Its USP is that it would require data handlers (not a legal term yet) to take steps towards the protection of personal data of Indians and would give individuals the right to know what personal data is being collected about them, the right to change their consent for the collection and use of their personal data, and the right to file a complaint if they feel their rights have been violated. And since no Indian legislation is complete unless it sets up its own governing authority, the DPB 2022, just like its predecessor, promises to establish a data protection authority to oversee the implementation of the law. But relax, it’s called a ‘board’ now. And remember the data ‘subject’? She’s been rebranded as the data ‘principal’. Hare Krishna! What could possible go wrong? In a word\u2026lawyers. The government is a disguised army of lawyers (I’ll rant about this some other time because it has to do with HLA Hart). As tweefolk\u00a0have already started noticing, the DPB 2022 plays the ambiguity card well. It tries to preserve the real rule-making powers to itself through transparency-deferral-devices such as ‘deemed consent’ and ‘as may be prescribed’. The long and short of it is that the DPB 2022 guarantees nothing on any of its key promises. In fact, it seems to tilt the scales more heavily in favour of big tech than previously. Sample this, there are new obligations on data principals for inaccurate information, and a total cap of 500cr INR (Zuck’s revenue from India last year was worth almost thrice this amount) for breaches by data fiduciaries. Moreover, there are explicit provisions permitting the free global transfer of data with little to no protection (PWC say that data localisation principles have been ‘eased out’). There’s a lot more detail but I think you get the big picture. My favourite part? ‘consent managers’, go figure. Whataboutery Blockchain So if GDPR is the gold standard in terms of data protection laws, we can firmly say that the DPB 2022 is swiggy – promising much, delivering nothing. Seriously, this was the government’s chance to showcase that Digital India is a forward looking venture, not some back-office-hack-job for big tech. There is zero mention of leveraging new or emergent technologies for protecting personal data. Instead, the government chose to bury or defer all the important decisional criteria and facilitate a market for Indian citizens’ personal data. Does this have any direct implications for the blockchain industry? Sure. Depending on the protocol and its function, it may incur obligations, liabilities, and rights of data processors or fiduciaries. Conceptually speaking, if it is fully decentralised, then these obligations would be hard to pin down on one person. And just like in the Ooki DAO case, the Data Protection Board may find itself chasing a bunch of code. What I find truly surprising\/distressing is the lack of coordination between government departments, and their mutual blindness. On the one hand, ethical AI and blockchain technologies are being promoted, while on the other its genuine potential to create public good is being overlooked. Let there be no confusion about this, the DPB 2022 is not badly drafted, it is just anachronistic. Its aim is to resuscitate big tech in an age when we should be giving it some more milk of the poppy. RECENT BLOGS Read More Explainer Lessons from the FTX Collapse Lessons from the FTX Collapse The FTX collapse is a major blow to the crypto industry. It is a reminder that the industry is still in its early stages and February 3, 2024 Read More Explainer De-freezing bank accounts of crypto P2P traders: A Legal primer De-freezing bank accounts of crypto P2P traders: A Legal primer Introduction Peer-to-Peer (P2P) crypto transactions executed by Indian traders have reportedly increased significantly in the last few years. These P2P transactions February 3, 2024 Read More Explainer FIU Registration of VDA Service Providers FIU Registration of VDA Service Providers Introduction Regulatory landscape for cryptocurrencies i.e. virtual digital assets (VDAs) has significantly evolved in India in the last two years. Though a VDA specific January 23, 2024 Read More Uncategorized Are Payment gateways ‘reporting entities’ under PMLA? Are Payment gateways ‘reporting entities’ under PMLA? Introduction Should a word or a phrase defined similarly in two different statutes be interpreted differently? Hon\u2019ble Delhi High Court has answered this July 28, 2023 Read More Explainer An Overview of DAO Legal Wrappers An Overview of DAO Legal Wrappers Exploring the Benefits of DAO Legal Wrappers for BusinessesBusinesses are increasingly turning<\/p>\n","protected":false},"author":64,"featured_media":10197,"comment_status":"closed","ping_status":"open","sticky":false,"template":"elementor_header_footer","format":"standard","meta":{"rank_math_lock_modified_date":false,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[19,28],"tags":[58,48,57,54,47],"class_list":["post-702","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-development","category-opinion","tag-bill","tag-blockchain","tag-data-protection","tag-jurisdiction-ind","tag-privacy"],"_links":{"self":[{"href":"https:\/\/cryptolegal.in\/index.php?rest_route=\/wp\/v2\/posts\/702","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptolegal.in\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptolegal.in\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptolegal.in\/index.php?rest_route=\/wp\/v2\/users\/64"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptolegal.in\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=702"}],"version-history":[{"count":31,"href":"https:\/\/cryptolegal.in\/index.php?rest_route=\/wp\/v2\/posts\/702\/revisions"}],"predecessor-version":[{"id":20584,"href":"https:\/\/cryptolegal.in\/index.php?rest_route=\/wp\/v2\/posts\/702\/revisions\/20584"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptolegal.in\/index.php?rest_route=\/wp\/v2\/media\/10197"}],"wp:attachment":[{"href":"https:\/\/cryptolegal.in\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=702"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptolegal.in\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=702"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptolegal.in\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=702"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}