India's Data Protection Rules: Balancing Innovation && Citizen Rights

New Delhi, Jan 4 (PTI) The Digital Personal Data Protection Rules drafted by the government create a balance between regulation and innovation while protecting citizens' rights, Union minister Ashwini Vaishnaw said on Saturday.

The government has issued draft rules for the Digital Personal Data Protection Act on Friday for public consultation till February 18.

"Rules have to be within four walls of the Act. It is within the ambit of the Act passed by Parliament. These rules have been framed to ensure a balance between regulation and innovation while completely safeguarding the rights of citizens," Vaishnaw told PTI in an interview.

The minister said earlier there was only one template available to the world -- the European data protection rule with high level of regulation -- but Indian rules have attempted to balance the regulation with innovation to safeguard the boom in innovation ecosystem developing among start-ups in the country.

He said extensive consultation has been held with the industry and a digital office is being put in place for registration of complaints, their handling and adjudication.

The minister said the final rules will be placed before Parliament in the monsoon session and all entities handling data digitally will get two years to adapt their system and comply with the law.

"All entities covered under the Act will have to review existing consent after the rules are in place," Vaishnaw said.

He said the rules may be improvised based on the experience of the new data regime.

"As far as possible, minimum prescription has been kept in the rules to ensure simple implementation of the Act. The rules have carefully addressed the large harm that the digital world may pose to the privacy of people, especially that of children," Vaishnaw said.

The Digital Personal Data Protection draft rules specify that a parent's verifiable consent will have to be obtained by social media or online platforms before children can create an account.

Parents' identity and age will have to be checked through voluntarily provided identity proof or virtual tokens.

"We have also kept graded penalties to protect the interests of micro, small and medium enterprises. It is to save businesses that may be running using a single computer. However, Big Techs have higher obligations under the rules. Minor breaches will attract small penalties and big breaches will lead to higher penalties," Vaishnaw said.

He said the penal provision will be implemented as per the Act and the rules prescribe the way to implement them.

The Act has the provision to impose a penalty of up to Rs 250 crore on data fiduciaries.

"There is a provision... under the Act where an entity can give voluntary undertaking in respect of any breach to the Data Protection Board which will deal with it as per the Act," Vaishnaw said.

As per the DPDP Act, the acceptance of the voluntary undertaking by the Board shall constitute a bar on proceedings under the provisions of this Act as regards the contents of the voluntary undertaking.

If a person fails to adhere to any term of the voluntary undertaking accepted by the Data Protection Board (DPB), it will be deemed as a breach of the provisions of the Act and the board, after giving an opportunity to the person to explain his position, may take action as per the penal provisions.

The minister said utmost precaution has been taken to protect small businesses as per the basic principle laid down in the Act.

Vaishnaw said the rules for data processing overseas will be implemented while keeping in mind citizen's rights and national interests.

"The country should be able to take benefit of all the new opportunities that are emerging out of the digital economy," Vaishnaw said.

However, the rules will not have an impact on existing norms under which news media operate. "Media rights will continue to remain as it is. Press will continue to function as per the current framework," Vaishnaw said.

Vaishnaw added that the digital platforms will also have to inform and take consent of people in English or any of the 22 Indian languages listed in the Constitution in the language of their choice.