New Delhi: The Central government proposes a penalty of up to Rs 15 crore or four per cent of the global turnover (whichever is higher) on companies that violate the Personal Data Protection law, approved by the Cabinet on Wednesday. For minor violations, the penalty will only Rs 5 crore or two percent of global turnover.
The government, however, wants any critical data to be mandatorily stored in India while sensitive data can be processed abroad — with the explicit consent of the data owner. The proposed law comes after a public hue and cry over a controversy involving WhatsApp. The Opposition had inquired whether the government negotiated any business with the Israel-based tech firm NSO that developed Pegasus Spyware to spy on 1,400 users across the world, including 121 Indian journalists and activists.
In line with the European Union’s General Data Protection Regulation (GDPR), the government last year introduced a draft personal data protection Bill to regulate the use of an individual’s data by the government and private companies. “Data privacy law exempts processing of data without consent in case of issues around sovereignty, national security, court order etc,” a top government source said.
As the proposed Bill is to be tabled in Parliament during the ongoing Winter Session, the government is expected to bring in a detailed framework to the public domain, which will include processing of personal and private data by public and private entities, among others.
“Storage and processing of personal data, broad guidelines on collection, consent of individuals, penalties and compensation, code of conduct and an enforcement model are likely to be a part of the law,” the source said. “We will not be able to share details about the Bill as it will be introduced in Parliament soon,” said Union minister Prakash Javadekar after the Cabinet meeting. Last week, IT minister Ravi Shankar Prasad hinted that India would never compromise on data sovereignty and would soon introduce a robust and balanced Personal Data Protection law in Parliament.
The draft Personal Data Protection Bill, 2018, was prepared by a high-level expert group headed by former Supreme Court judge B.N. Srikrishna. There was a delay in approval amid inter-ministerial consultation.
