Dvara Research is an Indian not-for-profit policy research and advocacy institution guided by our mission of ensuring that every individual and every enterprise has complete access to financial services. Our work addresses emerging issues in policy and regulation for consumer protection, affecting individuals accessing
finance in light of the sweeping changes that are reshaping retail financial services in India. The regulation and protection of consumer data has been a core area of our recent research.
In this document, we present our comments on the draft Personal Data Protection Bill 2018 (hereafter “the draft Bill”) in response to the call for comments from the public by MEITy (Ministry of Electronics and Information Technology, 2018). We are deeply concerned that the draft Bill, in its current form, fails to provide adequate user protection.
Despite speaking in the language of empowerment and fiduciary responsibility, the draft Bill fails to give users a wide set of rights or incentivise effective, user-focussed grievance redress by data fiduciaries. The legal obligations on data fiduciaries’ require greater detail and clarity to ensure they are meaningful and not
merely broad aspirations. The emphasis on consent as a ground for processing in the new regime risks continuing the unfair burden on consumers to make decisions about their personal data when operating under information asymmetries. Without these and other concerns (set out in our response) being addressed, the draft Bill could miss the opportunity to fulfil the aspirations set out in the final report of the Committee of Experts. We welcome this attempt to erect a much-needed data protection law for India but urge further development of the draft Bill to arrive at a truly user-protecting framework.
Our comments are presented in two sections. In the first section titled “I. Overarching Comments”, we raise eleven overarching concerns about the draft Bill. In the second section titled “II. Section-specific Comments”, we provide section-by-section feedback and proposals on particular provisions of the draft Bill. The thinking presented here builds on our past work on the principles and design required for an effective, consumer-friendly data protection framework that takes into account the unique exigencies of the Indian context.
To read the full report click here.
