IT Minister Ravi Shankar Prasad (R) with retired Supreme Court judge BN Srikrishna (L).
Highlights
- Centre's panel files draft bill, report on personal data protection
- Draft lays rules for companies, suggests penalties for violations
- It will now be discussed by ministers, reviewed by parliament
All critical personal data on people in India should be processed within the country and explicit consent should be taken for collecting sensitive information like religious or political beliefs, sexual orientation and biometric data, a government panel said on Friday.
The recommendations come at a time when data breaches are becoming common globally and there is heightened scrutiny by governments on how companies handle user data.
The panel, headed by former Supreme Court judge BN Srikrishna, also presented a draft bill that will go before parliament designed to enhance data protection. It also provided for the "right to be forgotten" (to have your digital data scrubbed from databases) and prescribed steep penalties for violations.
The legislation, named "Personal Data Protection Bill, 2018", provides for a penalty of Rs 15 crore or 4 per cent of the total worldwide turnover of any data collection entity, including the state, for violation of personal data processing provisions.
The panel said "personal data determined to be critical" will be subject to the requirement of being processed "only in India", according to its 213-page report released on Friday.
"The central government should determine categories of sensitive personal data which are critical to the nation," the panel said, adding that there will be a prohibition against cross-border transfer of such data.
The government panel also recommended setting up a "data protection authority", an agency which would look at enforcement and implementation of the new data protection law.
Set up in 2017 to craft the data protection framework, the panel wrapped up nearly one year of deliberations by handing the report to IT Minister Ravi Shankar Prasad.
"It is a monumental law and we would be like to have widest parliamentary consultation... We want Indian data protection law to become a model globally, blending security, privacy, safety and innovation," Mr Prasad said.
He added that the report will go through the process of inter-ministerial consultations and cabinet as well as parliamentary approval.
India has in recent months become increasingly conscious of the risk of data breaches.
The government on Thursday said it had asked the Central Bureau of Investigation to probe misuse of Facebook user data by Cambridge Analytica, a political consultancy which was earlier this year accused of improperly using data of 87 million Facebook users.
(With inputs from Reuters and PTI)