The new draft of India’s digital data protection bill is praised for its simplicity and relatability, although it has raised concerns for its lack of detail and government exemptions. The draft also misses key concepts like data portability and uses non-standard terminology.
The latest draft of India’s Digital Data Protection Bill, 2022, stands out for its simplicity and new concepts like “voluntary undertaking” and official recognition of “consent managers.” However, it omits features like data portability and the right to be forgotten. Critics argue the draft lacks safeguards and over-delegates legislative authority, particularly around the concept of “deemed consent.” But the principles-based approach it espouses could ensure agile and enduring data protection regulation.
Data asymmetry allows those with access to large data sets to gain insights that can be used for various purposes, including manipulation. Solutions like India’s DEPA framework aim to reduce this asymmetry. However, challenges remain in knowledge and intelligence asymmetry, requiring democratisation of data science techniques and addressing biases in AI algorithms.
In India, the absence of comprehensive privacy law has led to over-reliance on CERT-In Rules, 2013, for data breach guidance. Recent directions by the Ministry of Electronics and Information Technology has expanded mandatory reporting requirements, raising concerns about inundating CERT-In with trivial incidents and, as a result, hindering its ability to respond to serious breaches.
John Perry Barlow’s 1996 “A Declaration of the Independence of Cyberspace” argued for internet exceptionalism, where the online world would be free from real-world regulations. This belief shaped the liberal terms of service on websites, but with the internet’s growth and concentration in the hands of dominant platforms, the enforcement of these terms has led to serious global consequences. Barlow’s vision of a more humane online civilization may have been overly optimistic.
