Even government will be held accountable for data breach

If the government agencies breached personal data, they are accountable under the proposed Digital Personal Data Protection Bill, said the government here.

"The bill is mainly to make those entities accountable, which are monetising data. In case of data breach even the government is not exempted," sources in the Ministry of Electronics and Information Technology said here on Friday.

The Ministry on Friday released a draft Digital Personal Data Protection Bill 2022 seeking public comments.

The draft has exempted certain entities notified as data fiduciaries by the government from various compliances, including sharing details for the purpose of data collection.

Also Read | Government proposes penalty of up to Rs 500 crore for data breach under Data Protection Bill

The bill will only cover aspects around digital data as the Ministry of Electronics and IT's mandate is to deal around digital and cyber space.

The bill proposes to exempt government notified data fiduciaries from sharing details of data processing with the data owners under the "Right to Information about personal data".

Defending the government decision to impose a hefty fine up to Rs 500 crore against entity for breach of personal data instead of criminal cases, sources said that this was done deliberately by the government to reduce the burden on courts.

“ If we keep on filing criminal cases against breach of data, then investigating agencies and courts are burdened with cases. Even getting justice is also delayed. Imposing fines would help to punish the guilty quickly,” sources said.

With the proposed legislation also allowing the transfer and storage of personal data in some countries, the source said, " Data transfer and storage in other countries will be done based on mutual agreement and recognition of each other. The government will notify such countries or territories outside India to which a data fiduciary may transfer personal data."

The very purpose of the bill is to prevent breach of personal data. The explanatory issued by the Ministry of Electronics and IT says the usage of personal data by organisations must be done in a manner that is lawful, fair to the individuals concerned and transparent to individuals and personal data is used for the purposes for which it was collected.