Explained: How Data Protection Bill compares with its EU counterpart
The
Indian Express
Karishma
Mehrotra
The
Personal Data Protection (PDP) Bill, 2019, has significant parallels to the
European Union’s General Data Protection Regulation (GDPR).
Where they differ
The Personal Data Protection (PDP) Bill, 2019,
introduced in Lok Sabha this week, has been referred to a joint select committee. It has significant
parallels to the European Union’s General Data Protection Regulation (GDPR).
These two overarching data regulations mirror each other in some ways, but also
present some notable divergences.
Data transfer abroad: One
significant difference between the GDPR and the PDP Bill is the framework built
around deciding whether or not data can leave the country. Both give a
government authority the power to decide if data transfers can occur, but the
GDPR more clearly lays out the parameters of this decision. Their “adequacy
decision” is made based on the country’s rule of law, authorities, and other
international commitments. The transfer can be made without this decision if
there are legally binding rules or other codes of conduct that allow for it.
The PDP simply states that the Authority has to have approval of the transfer
of any sensitive personal data abroad, without specifying as many details about
the other country’s “adequacy” in receiving the data.
Automated decisions: The
GDPR much more directly addresses personal harm from automated decision-making.
The PDP Bill requires an assessment in cases of large-scale profiling, but does
not give the citizen the right to object to profiling, except in the cases of
children. This decision making includes, for example, a corporation deciding
your credit score as well as profiling an individual to target them with
advertising that has now become the bedrock of the data economy. The GDPR
states: “Where personal data are processed for the purposes of direct
marketing, the data subject should have the right to object to such processing,
including profiling to the extent that it is related to such direct marketing,
whether with regard to initial or further processing, at any time and free of
charge. That right should be explicitly brought to the attention of the data
subject and presented clearly and separately from any other information.”
Personal data types: To
give special attention to particularly important types of data, India’s PDP
Bill categorises personal data much more explicitly. In the Indian Bill, a
sub-category of personal data called sensitive personal data has a
pre-determined list including health, financial, caste, and biometric data. It
resembles the list of “special categories” in the GDPR, but the GDPR does not
have separate localisation rules for this type of data. The PDP Bill, on the
other hand, does not allow for sensitive personal data to be stored abroad and
can only be processed abroad with authority approval. In addition, the PDP Bill
categorises “critical personal data” as an open-ended category in which
government can define from time to time. Critical personal data can never leave
the country, for storage or processing, according to the PDP. The PDP Bill,
unlike the draft Bill, has allowed the Government of India to direct any entity
handling data to provide them with “non-personal data”, or anonymised data. The
GDPR, on the other hand, states: “This Regulation does not therefore concern
the processing of such anonymous information, including for statistical or
research purpose”.”
Supervision & data handling: The
GDPR Bill also gives wide-ranging discretion to “ supervisory authorities”
created in each of the ‘US’s member states to oversee this topic. Aspects of
the Bill, such as penalties, are left up to these authorities.
Where they are alike
Exceptions: The
exceptions given to the Indian Bill and the EU Regulation look similar. Both
allow data processing for prevention, investigation, detection, or prosecution
of criminal offences. Both also discuss “public security”, “defence”, and
“judicial” proceedings. The GDPR states: “This Regulation does not apply to
issues of protection of fundamental rights and freedoms or the free flow of
personal data related to activities which fall outside the scope of Union law,
such as activities concerning national security. This Regulation does not apply
to the processing of personal data by the Member States when carrying out
activities in relation to the common foreign and security policy of the Union.”
Consent: The
PDP Bill and the GDPR are founded upon the concept of consent. In other words,
data processing should be allowed when the individual allows it. Consent
carries similar meanings, with words like “free”, “specific”, and “informed”.
“Reasonable expectations” are also a parameter for processing, as are limiting
the collection and purposes for collection. They also both given special
protection to children’s lack of ability to give consent.
Individual’s rights: Both
have similar rights given to the individual, including the right to correction,
the right to data portability (transferring your data to another entity), and
the right to be forgotten (the right to erase the disclosure of your data).
But, as mentioned above, the right to object to profiling is in the GDPR and
not the PDP Bill.
Other similarities: Both
place responsibility on the fiduciaries, such as building products that include
privacy by their design and transparency about their data-related matters. The
European Data Protection Board in the GDPR and the Data Protection Authority in
the PDP Bill have some similar duties, such as dispute resolution and codes of
conduct.
Comments
Post a Comment