NEW DELHI: Strongly advocating the need to protect the privacy of individuals, the Joint Parliamentary Committee on Personal Data Protection Bill has asked the Centre to take “concrete steps” to ensure a mirror copy of sensitive and critical personal data in possession of foreign entities be mandatorily brought to India.
The JPC headed by BJP’s P P Chaudhary has said once the Data Protection Authority is set up, the Centre “must ensure data localisation clauses under this legislation are followed in letter and spirit by all local and foreign entities, and India must move towards data localisation gradually”.
The committee has asked the Centre to consider an individual’s ‘right to be forgotten’ by clarifying the responsibilities of data fiduciaries, but noted this may depend on available technology and practicability of such applications.
The panel has held it may not always be easy to distinguish between “non personal” and “personal” data and the proposed authority must consider both within its ambit.
To this end, the JPC has called for a mechanism to certify the integrity of hardware equipment. The report also calls for an alternative to the SWIFT system of funds transfer, saying that there have been worrying instances of breaches by Chinese lending apps in India with huge implications for privacy of individuals that needs to be addressed.
“The committee is of the view that an alternative to SWIFT payment system may be developed in India which will not only ensure privacy, but will also give boost to the domestic economy.”
The report bats for a regulatory system on the lines of the Press Council of India (PCI) for social media (SM) platforms, saying there should be a statutory media regulatory authority to regulate content of such media irrespective of where their content is published — online, print or otherwise.
It also, importantly, calls on SM platforms to verify users once users complete verification procedures.
“SM platforms, which do not act as intermediaries, should be treated as publishers and be held accountable for the content they host. A mechanism may be devised (where such platforms) will be held responsible for content from unverified accounts on their platforms. Once application for verification is submitted with necessary documents, the social media intermediaries must mandatorily verify the account,” the report states.
The JPC has sought the inclusion of hardware manufacturers, who collect data through digital devices, in the law, noting that this is a loophole.
“(The committee) desires that a new sub-clause as 49(2) (o) may be inserted to enable DPA for framing regulations to regulate hardware manufacturers and related entities.”
It has called for a mechanism for formal certification process for all digital and IoT devices (sensors, gadgets) to ensure their integrity by setting up labs throughout the country.
The committee has asserted the need to “design and set up processes to unify data across public sector, private sector, and academic and research institutions”, and formulate “robust data management policies, standards and best practices with accurate data, appropriate data access, strong data security, privacy and ownership rights”.
“It has also been observed that national security is of paramount importance and India can’t compromise it on the ground of promotion of businesses. Therefore, the Committee feel that though there are provisions under Clauses 33 and 34 for crossborder transfer of data, some concrete steps must be taken by the Central government to ensure that a mirror copy of the sensitive and critical personal data which is already in possession of the foreign entities be mandatorily brought to India in a time bound manner,” the report says.
The panel also said that though social media (SM) platforms were designated as intermediaries under the IT Act, the law failed to regulate the SM platforms adequately, having failed to keep pace with the changing SM ecosystem.
The PDP Bill has similarly general provisions regarding SM platforms and intermediaries, the panel said, relaying its “strong view” that designated intermediaries may be working as publishers of content.
The JPC had on Monday adopted the draft report with seven of its 31 members moving dissent notes against various clauses.




Source link