How the new data protection law will impact your privacy

After intense drama, India has now introduced a Digital Privacy and Data Protection law after the bill was given the go-ahead by both houses of Parliament. India's bill is often compared to the European Union's General Data Protection Regulation (GDPR).

The IT Ministry takes pride in introducing a bill that uses "she" instead of "he" for the first time in an Indian document. This law is set to reshape the landscape for Indian citizens and their data.

PHYSICAL vs DIGITAL DATA

As an Indian citizen, it's important to understand the distinction between physical data and digital data.

The new law specifically covers digital data, not physical data - any data available in digital form, including photographs of data, falls under this law.

Any digital data related to Indian citizens will now be subject to this rule.

However, if someone exclusively uses paper and avoids digitalization, they are exempt from these rules, regardless of the amount of data they possess.

As an Indian citizen going online, you will observe several changes. Upon being online, you'll encounter clearer privacy notices, options to decline, alerts for data misuse, and the right to access and rectify data.

For instance, from now on:

1. Online businesses will inform you about your data usage.
2. Websites and apps will seek permission before utilizing your data.
3. Consent will be required before receiving promotional emails or texts.

IMPACT ON INDIAN CITIZENS' DATA

Processing of Indians' Data

Under the new law, the definition of "processing" has been adjusted to include wholly or partially automated data. Unless you explicitly indicate non-consent, your data can be processed.

Here are scenarios where private entities can use your data:

If you share your phone number at a movie hall, they can use it to inform you about upcoming movies or offers, falling under reasonable use.

Similarly, if you provide your number at a restaurant, they can use it to share information about new dishes, launches, or reservations.

Data can only be processed for the specific purpose it was given for and must be necessary to fulfill that purpose.

Individuals have the right to correct or erase their data. This allows individuals to:

1. Rectify inaccurate personal data, such as correcting their name's spelling.
2. Complete incomplete personal data, like missing PIN codes.
3. Update personal data, such as changing phone numbers or email addresses.
4. Erase personal data no longer needed, unless retained for legal reasons.

Data for Subsidies, Services, Permits

Companies offering benefits, certificates, licenses, etc., can process your data if you've consented or if your data was previously obtained by a state entity.

If your data is available online for these purposes, it can be processed for subsidies, benefits, services, etc.

Government Use of Your Personal Data

Government entities have more flexibility in using citizens' data, bypassing norms requiring explicit consent in certain cases.

During emergencies, your data can be used without consent, such as in natural disasters.

You can appeal decisions made by the data protection board before the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

Seeking Remedies

The law is explicit: a citizen can appeal to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) if they find the decisions of the data protection board unfair.

This right empowers citizens. If consent hasn't been obtained or data is being misused, approaching the TDSAT is a citizen's prerogative.

Once you, as an Indian citizen, approach the TDSAT, your case will be heard, and the Tribunal will decide after investigation.

The government has established rules for private entities: data accuracy must be upheld, data should be kept secure, and data should be deleted once its purpose is fulfilled.

If these rules are violated, the Tribunal can take action and impose penalties.

Access to Your Data

Now, global companies can process a citizen's data on foreign soil.

If you provide details to international brands like Starbucks, Louis Vuitton, or Ferrari, your data might be processed anywhere in the world, including the United States or France.

Companies handling personal data can transfer it to other nations for processing, unless restricted by the central government.

So, if you, as a citizen, consent or don't explicitly reject it, your data can be processed by foreign companies. This advantage to private entities raises concerns about long-term impacts, according to experts.

The current Bill uses a blacklisting system, unlike the previous version that only allowed data transfer to government-notified locations.

Cracking Down on Social Media

The law now empowers the government to block public access to information on a computer source for public interest reasons.

The Data Protection Board can advise on blocking public access to a platform or computer resource.

This means if a person posts content on platform X that the government deems a national threat or disruptive to the country's harmony, the government can block public access to the platform.

Citizens won't be able to access the platform until the government lifts the order.

The Board can make such a recommendation if the data fiduciary has been fined monetarily on more than two occasions.

Penalties for Companies

Entities like social media platforms, startups, banks, etc., can face penalties up to Rs 250 crore for misusing or failing to protect individuals' digital data. Repeated offenses lead to increased penalties.

In conclusion, consent and government oversight will guide data handling. While Indians have a say in consent, misuse will result in stricter regulations.