New personal data law has stiff fines

New Delhi: In a bid to fix companies who violate the proposed personal data protection law, the government is likely to impose a penalty of up to Rs 15 crores, or four per cent of their global turnover, whichever is higher may be applicable as fine for the violation. For minor violations, there may be a penalty of Rs 5 crores, or two per cent of their global turnover.

As per the bill, which got an in-principle approval by the Union Cabinet on Wednesday, the government, however, wants any critical data needs to be mandatorily stored in India, while sensitive data can be processed outside only with the explicit consent of the data owner.

The government’s move comes after a public hue and cry over a controversy involving WhatsApp, where the Opposition asked if the government had negotiated any deal or did any business transaction with the Israel-based tech firm NSO that developed Pegasus Spyware to spy on 1,400 users worldwide, including 121 journalists and activists in India.

A top government source said: “In case of major violations, the Personal Data Protection Bill proposes penalties of up to Rs 15 crores or four per cent of global turnover (whichever is higher). For minor violations, a penalty of `5 crores or two per cent of global turnover is proposed.”

In line with European Union’s General Data Protection Regulation (GDPR), the government had last year introduced a draft personal data protection bill to regulate the use of individual data by the government and private companies. “Data privacy law exempts the processing of data without consent in case of issues around sovereignty, national security, court orders, etc”, the source said.

As the proposed bill is likely to be tabled in Parliament in the ongoing Winter Session, the government is likely to bring in a detailed framework in the public domain, which will include processing of personal and private data by public and private entities, among others.

“Storage and processing of personal data, Broad guidelines on collection, consent of individuals, penalties and compensation, code of conduct and an enforcement model are likely to be a part of the law,” the source said.

However, the government said it would share the details with the public soon after the bill is tabled in Parliament. “Will not be able to share more details about the bill as it will be introduced in Parliament soon,” Union minister Prakash Javadekar said after the Cabinet meeting.

Last week, IT minister Ravi Shankar Prasad had hinted that India would never compromise on data sovereignty and would soon introduce a robust and balanced law on personal data protection in Parliament. The draft bill, also known as the Personal Data Protection Bill 2018, was prepared by a high-level expert group headed by former Supreme Court judge B.N. Srikrishna. However, there was a delay in its approval amid inter-ministerial consultations.