On August 3, 2022, the Centre announced the withdrawal of the Personal Data Protection Bill (“PDP Bill”) with the aim of introducing a new comprehensive bill on this subject. The PDP Bill was introduced in the Lok Sabha on December 11, 2019, for the purposes of protection and privacy of personal data of individuals. The PDP Bill further encompassed provisions with regards to the transferring, processing and storage of all data and was drafted keeping in mind the broad and utopian General Data Protection Regulation (the prevailing data protection law in the European Union).
The PDP Bill was further referred to a Joint Committee (comprising of the members from the Lok Sabha and the Rajya Sabha). The Joint Committee reverted with a total of 81 amendments and 12 recommendations proposing a ‘comprehensive bill’. The extent of recommendations and amendments suggested, were the accumulated reasons for the withdrawal of the PDP Bill by the Union Minister Ashwini Vaishnaw (Ministry of Electronics and Information Technology) in the current session of the parliament.
Presently, India regulates the protection of personal data under the Information Technology Act, 2000 and the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011. However, the government is yet to introduce a comprehensive legislation in order to deal with the intricacies of collection, usage, storage and transfer of personal data.
Even though the PDP Bill has been withdrawn, the Centre has not yet provided clarity on the timeframe under which a new bill would be drafted and introduced in the Parliament.