Parliamentary Report Keeps India’s DP Bill Partly within GDPR Orbit

The thirty-member Joint Parliamentary Committee (JPC) of India’s two legislative chambers presented its Report on The Personal Data Protection Bill 2019 in December 2021, two years after receiving the Bill. This article examines the most important amendments proposed by the Report, rather than the aspects of the government’s Bill to which no amendments have been proposed. The Report includes 140 pages of a clause-by-clause examination of the Bill with recommendations for amendments, and 40 pages of dissenting reports. Among the proposed amendments are those that have the effect of:• Reduction of the independence of the proposed Data Protection Authority of India (DPIA), by increasing the scope of instructions the government can give it.• Extending the scope of the Act to ‘all data’ not only ‘personal data’.• Additional special regulations on social media platforms.• Increased control by the DPIA and the government over data exports and data localisation.• Attempting to deem the exemption procedure to be a ‘just, fair, reasonable and proportionate procedure’, which most of the dissenting reports criticize.• Weakening the requirement of lawful grounds of processing.• An overall strengthening of many of the data subject rights in the Bill.The JPC’s recommended amendments to the government Bill leave its structure unchanged in its essentials, but if adopted en bloc, these variations would move India’s Bill further away from many core elements of the EU’s notion of ‘adequacy’, while still remaining within the overall orbit of the GDPR