Digital Personal Data Protection Act 2023 and Net Neutrality

It aims to regulate the processing of digital personal data in a manner that recognizes both the right of individuals to protect their personal data and the need to process such data for lawful purposes. It was based on the recommendations of Justice B.N. Srikrishna Committee.

Salient features of Digital Personal Data Protection Act 2023

• Applicability: The processing of digital personal data within India applies to data collected in both digital and non-digital forms, or data that is digitized subsequently.
  • Processing personal data outside India is applicable if it involves offering goods or services within India.
• Consent: Personal data may only be processed for lawful purposes with the consent of the Data Principal, who can withdraw consent at any time.
  • For children or persons with disabilities, consent will be provided by the parent or legal guardian.
• Data Protection Board of India (DPBI): The Central government establishes the DPBI with key functions including monitoring compliance, imposing penalties, directing data fiduciaries in case of data breaches, and hearing grievances.
• Rights and Duties of Data Principal: Data principals (“Data Principal” means the individual to whom the personal data relates and where such individual is a child includes the parents or lawful guardian of such a child) have the right to obtain information about processing, seek correction and erasure of personal data, grievance redressal, and the right to nominate a person to exercise rights in case of death or incapacity.
• Obligations of Data Fiduciaries: Data fiduciaries (entities determining the purpose and means of processing) must ensure accuracy and completeness of data, implement reasonable security safeguards, inform DPBI and affected persons in case of a breach, and erase personal data when the purpose is met and retention is not necessary for legal purposes.
• Significant Data Fiduciaries (SDF): The Central Government may notify any data fiduciary as SDF based on factors like volume and sensitivity of data processed, risk to the rights of the data principal, potential impact on India’s sovereignty and integrity, security of the State, risk to electoral democracy, and public order.
  • SDFs have additional obligations, including appointing a data protection officer and an independent data auditor, and undertaking impact assessments.

• Processing of Personal Data of Children: While processing the personal data of a child, data fiduciaries must avoid processing likely to cause detrimental effects on the child’s well-being and tracking, behavioral monitoring, or targeted advertising.
• Cross-border Transfer: The bill allows the transfer of personal data outside India, except to countries restricted by the government.
• Penalties: Penalties for various offenses are specified, such as up to Rs 200 crore for non-fulfillment of obligations for children and Rs 250 crore for failure to take security measures to prevent data breaches.

Conclusion

The Digital Personal Data Protection Act, 2023 seeks to protect individuals’ digital personal data rights while allowing lawful data processing. Meanwhile, net neutrality ensures a fair and unbiased internet experience for users by preventing discrimination or preferential treatment by internet service providers.