Clear ambiguities on PDP Bill and mechanism on kids' data: IAMAI urges Centre

As India prepares for guardrails to protect its citizens' data, the Internet and Mobile Association of India (IAMAI) on Monday said the government needs to provide some clarifications regarding the Digital Digital Personal Data Protection (DPDP) Bill, including children's personal data.

On behalf of its members, the association requested the government to provide clarifications regarding the DPDP so that once it is passed into an Act, there is better compliance by IAMAI members.

"In particular, there remain ambiguities surrounding the timelines for implementing the various provisions of the Bill and mechanisms for obtaining verifiable parental consent to process the personal data of children," said the association.

The deadline for public consultation on the PDP bill was till January 2, according to Union Minister of State for Electronics and Information Technology Rajeev Chandrasekhar.

The IAMAI also requested the government to clearly indicate reasonable timelines by which the various provisions of the DPDP will be implemented and to adopt a graded approach to prescribing such timelines.

The government in August withdrew the contentious PDP Bill that saw 81 amendments in the past three years, aiming to introduce a new bill that fits into the comprehensive legal framework and protects the data of billions of citizens.

The new draft will allow cross-border transfer of some users' data with "certain notified countries and territories".

The new PDP bill has also proposed harsh penalties of as much as Rs 250 crore on people and companies that fail to prevent data breaches.

The IAMAI hailed the liberalised framework for cross-border data flows and the exclusion of non-personal data from the ambit of the DPDP Bill.

"By following a deep and wide process of consultation including that of a joint parliamentary committee (excluding non-essential provisions), by making a clear commitment that no rules exceeding the provisions of the Act would be made, and yet protecting the interests of the state, citizens and the digital economy, this Bill has possibly set up new standards of law-making," IAMAI President, Dr Subho Ray, said.

The association said the Bill imposes only financial penalties for non-compliance as opposed to both financial and criminal penalties.

According to the feedback received from the majority of IAMAI members, the reconceptualisation of the data protection framework in the DPDP to balance innovation and economic growth with the interests of users will go a long way to assuage concerns of digital businesses and help make India a trillion-dollar digital economy by 2025.