Tech giants are expecting utmost protection and safety from the Personal Data Protection Bill

The governmental intervention in deciding the mode of data generation and protection, it seems, has created a disturbance in the Information Technology (IT) sector. There is a perception that the draft report adopted on 22 November by the Joint Committee (JPC) on the Personal Data Protection Bill, if it finally turns into an act, may lead the dominant tech firms and Internet service providers to approach the judiciary for grievance redressal.  The draft was not adopted unanimously as it induced seven members of the 31 member-strong committee to present the note of dissent. But the point remains that most members approved it.

The bone of contention is the social media. The committee has a proposal to designate social media platforms as 'publishers' and this does not go well with the high tech firms. Their objection is made on the ground that the protection and safety provided to them regarding the content generation by the Information Technology Act (2000) will be nullified if this proposal is accepted by the Parliament. There is no prize for guessing that the aggrieved parties include the firms which matter most— Facebook (now Meta), WhatsApp, Twitter, and YouTube.

The main source of agitation is that such sweeping change is recommended by a committee on its own without taking into confidence the major stakeholders in the information technology domain. Apart from the aforementioned issue, there are several other issues as well. They are the inclusion of non-personal data in the privacy law, provisions for certifying hardware devices and the clause stipulating that sensitive personal data and critical personal data have to be stored locally. If this is not all, media reports also suggest that the JPC is determined to exert greater compliance of the companies also by way of reporting instances of data breach within seventy-two hours, mandatory disclosure of instances of transfer of information from principal data owner to someone else, and compulsory appointment of senior managers as data protection officers with the liability of lapses or violations of data laws.

The companies are no less agitated over another issue: that regarding certain functions like maintaining law and order the State has been relieved of the mandatory clause of disclosing third party sharing need to the data principal. This leads to the allegation of unequal treatment privileging the State not just by the corporate giants but also by the civil society organizations. On the whole, the way to legalize the Right to Privacy, a fundamental right since 2017, seems to be somewhat jerky.