Processing of sensitive personal data needs 'explicit consent': Draft bill

Recognising privacy as a fundamental right, a draft personal data protection bill today proposed "explicit consent" for processing 'sensitive personal information' like religious or political belief, sexual orientation and biometric information.

It also provided for the right to be forgotten and prescribed steep penalties for violations.

The draft of Personal Data Protection Bill, 2018 -- which is based on the recommendations of the government-constituted high-level panel headed by Justice B N Srikrishna -- restricts and imposes conditions on the cross-border transfer of personal data, and suggests setting up of Data Protection Authority of India to prevent any misuse of personal information.

The panel submitted its report on data protection as also the draft of the bill to the government today.

The draft provides for a penalty of Rs 15 crore or 4 per cent of the total worldwide turnover of any data collection entity, including the state, for violation of personal data processing provisions.

Failure to take prompt action on a data security breach can attract up to Rs 5 crore or 2 per cent of turnover, whichever is higher, as a penalty.

"The Bill provides that right to privacy is a fundamental right and it is necessary to protect personal data as an essential facet of informational privacy," the draft said.

It allowed processing of personal data only for the purpose it is collected or for compliance of any law, employment and for any function of Parliament or any state legislature.

'Sensitive personal data' comprises passwords, financial data, health data, sex life, sexual orientation, biometric data, genetic data, caste or tribe and religious or political belief or affiliation.

According to the draft, personal data means "data about or relating to a natural person who is directly or indirectly identifiable, having regard to any characteristic, trait, attribute or any other feature of the identity of such natural person, or any combination of such features, or any combination of such features with any other information."
The Bill in the works aims to "protect the autonomy of individuals in relation with their personal data, to specify where the flow and usage of personal data is appropriate, to create a relationship of trust between persons and entities processing their personal data."