Advertisement
The government issued draft rules for the Digital Personal Data Protection (DPDP) Act on Friday for public consultation till February 18.
“Rules have to be within four walls of the Act. It is within the ambit of the Act passed by Parliament. These rules have been framed to ensure a balance between regulation and innovation while completely safeguarding the rights of citizens,” Vaishnaw told PTI in an interview.
The minister said earlier there was only one template available to the world — the European data protection rule with a high level of regulation. However, Indian rules have attempted to balance the regulation with innovation to safeguard the boom in the innovation ecosystem developing among startups in the country.
Related Articles
Advertisement
The minister said the final rules will be placed before Parliament in the monsoon session for approval and all entities handling data digitally will get two years to calibrate their systems as per the law.
“All the entities covered under the Act will have to review existing consent within two years after the rules are in place,” Vaishnaw said.
He said the rules will be improvised based on the experience of the new data regime.
“As far as possible, minimum prescription has been kept in the rules to ensure simple implementation of the Act. The rules have carefully addressed the large harm that the digital world poses to the privacy of people, especially children,” Vaishnaw said.
The DPDP draft rules specify that a parent’s verifiable consent will have to be obtained by social media or online platforms before children can create any account.
Further, parents’ identity and age will also have to be validated and verified through voluntarily provided identity proof “issued by an entity entrusted by law or the government”, as per the draft rules.
“We have also kept graded punishments to protect the interests of micro, small and medium enterprises. It is to save businesses who may be running their business using a single computer. However, Big Techs have higher obligations under the rules. Minor breaches will attract small penalties and big breaches will lead to higher penalties,” Vaishnaw said.
He said the penal provision will be implemented as per the Act and the rules prescribe the way to implement them.
The Act has the provision to impose penalty of up to Rs 250 crore on data fiduciaries.
“There is a provision on voluntary undertaking under the Act where an entity can voluntarily disclose any breach to authorities and the Data Protection Board (DPB) will deal with it as per Act,” Vaishnaw said.
As per the DPDP Act, the acceptance of the voluntary undertaking by the Board will protect an entity from proceedings under the provisions of this Act. However, the protection will be subject to the approval of the DPB.
If a person fails to adhere to any term of the voluntary undertaking accepted by the DPB, it shall be deemed a breach of the provisions of the Act and the board after giving an opportunity of being heard to the person may proceed to act as per the penal provisions.
The minister said utmost precaution has been taken to protect small businesses as per the basic principle laid down in the Act.
Vaishnaw said the rules for data processing overseas will be implemented while keeping in mind citizen rights and national interests.
“The country should be able to take benefit of all the new opportunities that are emerging out of the digital economy,” Vaishnaw said.
The rules will not have an impact on existing rules under which news media operate, he said, adding, “Media rights will continue to remain as it is. Press will continue to function as per the current framework.” Digital platforms will also have to be informed and they will need to take consent of people in English or official languages as mentioned in the Constitution, Vaishnaw added.