The withdrawal negates years of preparatory work but controversial revisions and possibly unconstitutional recommendations could drag parliament debates for years

India’s recent withdrawal of a supposedly flawed 2019 Personal Data Protection Bill (PDP Bill) is supposed to lead the way to a better set of legislations.

According to the country’s Minister of Electronics & Information Technology Ashwini Vaishnaw, the replacement bill will have to be a “comprehensive framework” that is in alignment with “contemporary digital privacy laws”.

However, the withdrawal has actually drawn mixed reactions from various sectors due to fears of protracted parliamentary discord and delays.

One legal practitioner, Managing Partner Abhishek Malhotra, TMT Law Practice, explained the logic for the withdrawal: “In my opinion, it is correct to have the bill to be withdrawn. The bill suffered from shortcomings that required a complete overhaul. Also, the fact that it considered regulating non-personal data and allowed for the government to seek access to anonymized data constitutes a stark departure from any other jurisdiction required that a new law be brought to the fore.”

Yet, another lawyer, Sajai Singh, Partner, JSA (Law Firm) noted: “India is a plural country and (she is) represented by members of parliament from various regions and political affiliations. Unless each one of these, or at least a majority, is on the same page, a Bill can languish as a Bill and never see the light of day as a statute.”

Singh added that privacy matters will continue to be addressed by the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, but he believed the wait for a better Bill should not be too long: “I believe the Government is working overtime to make this a reality sooner than later.”

Fine tuning a bill or languishing?

While it was possible not to withdraw the Bill buy implementing some tweaks in the draft, several exceptions were deemed to require a rethink of entire document—such as whether to include non-personal data in the ambit. This was cited as the main reason why PDP Bill was withdrawn at the first place.

As a follow-up to the withdrawal, the Indian government has set up a 30-member Joint Parliamentary Committee (JPC) to ensure that the views of all stakeholders on the proposed PDP bill will be considered. So far, the JPC has recommended 81 amendments and 12 recommendations. However, one controversial proposal was to deal with both personal and non-personal datasets with a single law, while mandating all data be stored within the country. Another alarming idea was for the new legislation to grant sweeping powers to the government in certain segments.

A coalition of technology firms, the Information Technology Industry Council (ITI), has also brought its weight to bear on the situation, claiming that the recommendations “run counter to global standards for data protection and competition, and the absence of formalized and robust public debate on these significant new provisions deviates from good regulatory practices. Mandates for companies to locally store their data in India will degrade the privacy and cybersecurity protections by limiting state-of-the-art solutions that are globally available. When these and other recommendations are considered as a whole, their result, if enacted, would lead to a significant deterioration in India’s business environment, degrading the ease of doing business in and with India, and negatively impacting India’s domestic start-up ecosystem and global competitiveness.”

With so much at stake, one cybersecurity-law expert, Pavan Duggal has warned against “humongous” challenges in getting any PDP laws enacted: “Citing that the old bill was not sufficient enough, the government has said that the new law is going to cover not just personal data but sensitive non-personal data. So now a new ecosystem is going to be prepared. Let’s be prepared for a humongous legislation that is going to come up, and the need for tightening our belts is going to be very high. Let’s be prepared for a humongous amount of legislation that is again going to come up.”