Why Non-Personal, What's Critical ... & Snooping?

JPC report on data protection raises questions for privacy, business & regulation

- Sreenidhi Srinivasan and Anirudh Rastogi

The Joint Parliamentary Committee (JPC) examining the Personal Data Protection Bill 2019 adopted its report on Monday after two years of discussions. The committee’s recommendations will now be tabled in Parliament in the upcoming winter session. Much media reporting has been on the privacy concern on allowing government agencies broad exemptions, and seven opposition MPs’ dissent notes on the issue. But there are other concerns.

Let’s first summarise the key suggestions.

What are the four key JPC recommendations?

The committee has recommended an expansion in the scope of the bill, renaming it ‘Data Protection Bill’ dropping the word ‘personal’. The report recommends that the same regulator should govern both personal data (data about an individual) and non-personal data (anonymised data, business data).

The JPC also recommends that the government should set up certification labs for testing the integrity of all digital and IoT devices. This seems to be triggered by concerns around breaches, the use of Chinese equipment in manufacturing and foreign surveillance.

On data localisation, the JPC suggests that sensitive and critical personal data must be stored in India, in line with what the 2019 bill proposed.