A draft bill has been released in November 2022 called Data Protection Bill. It restricts itself to personal data of the citizens. It is a short, crisp and to the point draft. The idea is to ensure the ease of doing business.

Some clarity is required whether the social media intermediaries would be immune to legal liabilities for their content under the IT Rules and whether they would be governed by the Data Protection Law. To begin with, the government insisted on the localisation of data within the country. The digital economy is based on the flow of data, and recognising this, the Bill allows transfer of data between countries and territories which are categorised by the government as friendly nations. It comes as a big relief to the Big Tech.

There are no provisions related to the criminal liability, and for breaches of the provisions, only fines have been prescribed. Previously, the fines were set at 2-4 per cent of the global revenue but are now fixed between Rs.150 crore to Rs.500 crore.

The previous bill talked of the hardware regulation. This has been dropped from the ambit of the Bill.

The new Bill has put in caveats for data on children.

One area that has not been addressed is the power of the government to exempt any government agency from all or any of the provisions relating to the processing of personal data. (Sec 35). It leaves room for misuse of power. This needs to be looked at afresh.

The Government is likely to pass the Bill in the Budget Session of the parliament. (February 2023).

The Government proposes to set up a Data Protection Board of India which will manage compliance framework.