EU flags concerns on Data Protection Bill, provisions of localisation norms

The European Union has expressed concerns over data localisation stipulations and certain other provisions of India's draft Personal Data Protection Bill.

The union also asserted that the proposed Data Protection Authority (DPA) needs to be allowed to function independently and impartially.

In its submission to the Indian IT Ministry, the delegation of the European Union to India and Bhutan said the law, if adopted, will contribute to facilitating data flows between the EU and India, and could open the way for a possible adequacy dialogue between the two sides.

However, it also made certain observations across various aspects of the Bill that was drafted by the committee led by Justice BN Srikrishna to develop a framework on data protection norms in India.

"...in general, the draft law in a number of places leaves discretion to decide key matters in the hands of the Central Government or the DPA rather than dealing with them in the draft itself. This could create some uncertainties which could perhaps be avoided by providing further clarifications..." it noted.

The submission pointed out that having a data protection authority is important for both - citizens and businesses.

It emphasised that to effectively play its role, it is essential that the authority "acts with complete independence and impartiality in performing its duties and exercising its powers, free from any external influence".

"While the draft law highlights this aspect for the Adjudicating Officers, we did not find a clear statement in this regard for the DPA as such. Similarly, the articles concerning the Appellate Tribunal could benefit from further clarifications as regards the qualifications, terms and conditions of appointments, grounds for removal, etc of its members, as it is the case for the Data Protection Authority," it explained.

Also, on the matter of data localisation, European Union said the data localisation requirements stated in the draft Bill "appear both unnecessary and potentially harmful as they would create unnecessary costs, difficulties and uncertainties that could hamper business and investments".

"In our view, such localisation requirements are not necessary, be it from a data protection standpoint, as a matter of economic policy or from a law enforcement perspective..." it added.

The submission was made by Bruno Gencarelli, Head of Unit - International Data Flows and Protection, Eurpean Commission.

The IT Ministry had received more than 400 responses from companies, industry bodies and government departments on the draft Bill.

Many global industry bodies have contended that data localisation proposed in the draft bill could have "significant negative effects" on the ability of companies to do business in India.

The ministry hopes to take stock of all the feedback and give final touches to the draft by November-end, for its subsequent introduction in Parliament, according to sources.