Personal data protection law likely to see more delay

The final report was to be submitted in March but it got an extension till the second week of the monsoon session that began September 14.

The Personal Data Protection Bill 2019 will be delayed further.

Pressed for time, with a long list of stakeholders still waiting to depose, and several thorny privacy issues pending resolution, the Joint Parliamentary Committee (JPC) on the Bill will not make the deadline for its final report and is expected to seek a second extension.

The final report was to be submitted in March but it got an extension till the second week of the monsoon session that began September 14.

The Bill, which will provide the architecture for policy on all private data, was referred to a JPC soon after the legislation was tabled.

The JPC is currently holding hearings.

“There are nearly 200 stakeholders and we have met a few,” said a participant in the 28-member committee.

“It is highly unlikely that the final report will be ready by September 20.”

“I really don’t think so” said another MP, when asked if the committee will be able to meet the deadline.

Representatives of the Reserve Bank of India (RBI) are expected to depose on concerns in the banking sector.

Although the RBI had sought exemption from deposition and wanted to give its point of view in writing, it is not clear if its request has been accepted.

The RBI’s deposition will be crucial for banks and payment firms like PayTM, as well as new payment gateways seeking government permission to launch their services, like WhatsApp pay.

Costs could go up for the sector if RBI recommends enhanced security features.

What constitutes personal data is only one part of the committee’s remit.

Who will control and regulate this data is another aspect. So far, the committee seems to be divided.

While private companies see data as a new way to expand their business, and have deposed that companies wanting to do business in India must share data with the Indian government, there are MPs on the committee who reject this understanding and argue that privacy, not sovereignty should drive data protection laws.

“More foreign companies will invest in India if they are sure that their data will remain private.

"The analogy is the loose Intellectual Property Right (IPR) protection regime in India.

"Most foreign companies don’t want to invest here because they are not sure if IPR will be safe.

"The same thing should not happen with data protection,” said an MP.

The Committee, headed by BJP MP Meenakshi Lekhi, held no meetings between March and June.

However, written submissions have not yet been circulated to all members of the committee.

As a result, members, especially from Opposition parties, are worried that a consultative exercise might turn into a one-sided echo-chamber, especially in areas involving national security.

Photograph: Kacper Pempel/Reuters