Background:
- The Ministry of Electronics and Information Technology released the draft rules for the Digital Personal Data Protection (DPDP) Act, 2023, on January 3, 2025.
- Concerns have been raised about the adequacy of the existing legislation in creating a comprehensive data privacy framework.
Relevance : GS 2(Governance)
Data Localisation Mandate:
- Definition: Data localisation involves restricting the transfer of data across borders, ensuring that data related to a country’s citizens is stored within its own borders.
- Expansion Beyond DPDP Act: The draft rules extend the localisation mandate, which previously applied only to specific notified countries under the DPDP Act.
- New Government Committee: A government-appointed committee will decide which types of data cannot be exported from India. This could affect major tech companies like Meta, Google, Apple, Microsoft, and Amazon, classified as significant data fiduciaries (SDFs) due to their high volume and sensitive data processing.
- Challenges for Tech Companies:
- Operational difficulties in segmenting and storing data in different locations.
- Increased operational costs and restrictions on business activities.
- Two-Year Compliance Timeline: Companies are expected to comply with localisation requirements within two years, with support from a central committee to streamline the process and prevent fragmented mandates from different departments.
Concerns on Executive Overreach:
- Section 36 of the DPDP Act & Rule 22:
- These provisions grant the Union government extensive discretionary powers to demand any information from data fiduciaries or intermediaries for national security or sovereignty reasons.
- This power could potentially be misused for surveillance.
- Impact on End-to-End Encryption:
- Rule 22 could require social media companies like WhatsApp to compromise end-to-end encryption for compliance with government demands.
- Meta previously raised concerns about this potential breach of privacy in their challenge to the 2021 Intermediary Guidelines.
- Lack of Oversight:
- The government could requisition data without checks, bypassing judicial scrutiny, and without notifying affected individuals (in violation of the 2012 expert committee’s recommendation).
- Critics argue this could lead to abuses of power, particularly in politically sensitive situations.
Potential Impact on Businesses and Individuals:
- For Tech Companies:
- High costs and operational hurdles to ensure compliance.
- Risk of affecting business operations due to restrictive data handling.
- For Citizens:
- Greater vulnerability to surveillance.
- Lack of transparency in government access to personal data.
- Concerns about the erosion of privacy rights with inadequate safeguards.
Expert Opinions:
- Aparajita Bharti (Tech Compliance Expert):
- The localisation mandate will cause significant operational challenges, especially for start-ups and smaller companies.
- Apar Gupta (Internet Freedom Foundation):
- The lack of adequate restrictions on government access to data could lead to misuse, harming privacy rights and political freedoms.
- Amar Patnaik (Advocate):
- Calls for more scrutiny of the rules, suggesting they be reviewed by a parliamentary standing committee to ensure accountability.
