TL;DR: India's comprehensive data protection bill continues to sit in turmoil as Parliament can not agree on its scope and exemptions, as opposition MPs cite potential for government abuse and surveillance.
India lacks both a comprehensive data protection law and a proper data protection authority, but the country has been trying to pass something to help extend data rights to its citizens and to shore up its digital economy for several years. India's Parliament saw a comprehensive bill introduced in 2019, but after widespread criticism, it was shelved.
That legislation was revived as the Digital Personal Data Protection Bill (DPDP) in late 2022 and was modeled after the EU's GDPR. DPDP has been greeted slightly more enthusiastically than its 2019 version, although there is still plenty of debate over the regulation's contents and it only covers personal data, as years of negotiating have gradually whittled the regulatory scope down.
The most recent development in the saga came last week, as opposition MPs in Parliament's Standing Committee on Information Technology suggested 40 amendments to the DPDP draft.
Much of the criticism focuses on the lack of empowerment the proposed Data Protection Board, as the Indian government has carved out exemptions for itself on matters such as indefinitely storing an individual's data and "deemed consent" situations where it is in the "public interest" to process data. With a vague definition of
"public interest," many MPs feel uncomfortable passing the bill as currently written due to the potential for government overreach.
Politician John Brittas has argued the current DPDP draft does not uphold the 2017 Right to Privacy verdict of the Supreme Court that enshrined privacy as a fundamental right in the Indian Constitution. Brittas noted during interviews, "National security should not be a ploy to defeat the purpose of the [DPDP] Bill.”
With this large slate of newly proposed amendments, there is still no clear timetable for when the bill might make an appearance on the Parliament floor for an official vote.
Developments on India's data protection and DPDP will be a key data protection story to watch globally as 2023 continues.