Need for a Data Privacy Law

Five years after the Supreme Court’s judgment in the Puttaswamy case recognising the fundamental right to privacy; four years after the Justice Srikrishna Committee report; two and a half years after the introduction of the Personal Data Protection Bill, 2019; and over half a year after the presentation of the report of the joint committee, the union minister for electronics and information technology abruptly withdrew the Personal Data Protection Bill, 2019 from the Lok Sabha on 3 August 2022. The minister stated that the government is working on a “comprehensive legal framework” and will present a new bill in this regard. Importantly, no timeline was even hinted at for the framing and introduction of this new bill. This withdrawal is abrupt because, in February 2022, the union minister had stated that there were no plans to scrap the existing bill and that the government was hopeful of getting the bill passed “definitely, by the monsoon session.”

The first signs of changes in India’s information technology law were signalled by the minister of state for electronics and information technology Rajeev Chandrasekhar in April 2022, when he mentioned the need for a digital India act to replace the Information Technology Act, 2000. Subsequently, in an answer before the Rajya Sabha, the minister stated that the government continues to have discussions with relevant stakeholders, but there are no plans to form an expert committee. On the point of the Personal Data Protection Bill, the minister had said that the report of the joint committee and the bill were under examination. The withdrawal of a bill from Parliament is not unprecedented, and one or two bills are withdrawn from the Lok Sabha every year. The withdrawal of a bill from Parliament is preceded by a cabinet decision, but there is no press release concerning a cabinet decision on the withdrawal of the Personal Data Protection Bill, 2019.