The PDP Bill categorises “critical personal data” as an open-ended category in which government can define from time to time. Critical personal data can never leave the country, for storage or processing, according to the PDP. (Getty Images)
The Personal Data Protection (PDP) Bill, 2019, introduced in Lok Sabha this week, has been referred to a joint select committee. It has significant parallels to the European Union’s General Data Protection Regulation (GDPR). These two overarching data regulations mirror each other in some ways, but also present some notable divergences.
Where they differ
Data transfer abroad: One significant difference between the GDPR and the PDP Bill is the framework built around deciding whether or not data can leave the country. Both give a government authority the power to decide if data transfers can occur, but the GDPR more clearly lays out the parameters of this decision. Their “adequacy decision” is made based on the country’s rule of law, authorities, and other international commitments. The transfer can be made without this decision if there are legally binding rules or other codes of conduct that allow for it. The PDP simply states that the Authority has to have approval of the transfer of any sensitive personal data abroad, without specifying as many details about the other country’s “adequacy” in receiving the data.
Automated decisions: The GDPR much more directly addresses personal harm from automated decision-making. The PDP Bill requires an assessment in cases of large-scale profiling, but does not give the citizen the right to object to profiling, except in the cases of children. This decision making includes, for example, a corporation deciding your credit score as well as profiling an individual to target them with advertising that has now become the bedrock of the data economy. The GDPR states: “Where personal data are processed for the purposes of direct marketing, the data subject should have the right to object to such processing, including profiling to the extent that it is related to such direct marketing, whether with regard to initial or further processing, at any time and free of charge. That right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information.”
Personal data types: To give special attention to particularly important types of data, India’s PDP Bill categorises personal data much more explicitly. In the Indian Bill, a sub-category of personal data called sensitive personal data has a pre-determined list including health, financial, caste, and biometric data. It resembles the list of “special categories” in the GDPR, but the GDPR does not have separate localisation rules for this type of data. The PDP Bill, on the other hand, does not allow for sensitive personal data to be stored abroad and can only be processed abroad with authority approval. In addition, the PDP Bill categorises “critical personal data” as an open-ended category in which government can define from time to time. Critical personal data can never leave the country, for storage or processing, according to the PDP. The PDP Bill, unlike the draft Bill, has allowed the Government of India to direct any entity handling data to provide them with “non-personal data”, or anonymised data. The GDPR, on the other hand, states: “This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purpose”.”
Supervision & data handling: The GDPR Bill also gives wide-ranging discretion to “ supervisory authorities” created in each of the ‘US’s member states to oversee this topic. Aspects of the Bill, such as penalties, are left up to these authorities.
Where they are alike
Exceptions: The exceptions given to the Indian Bill and the EU Regulation look similar. Both allow data processing for prevention, investigation, detection, or prosecution of criminal offences. Both also discuss “public security”, “defence”, and “judicial” proceedings. The GDPR states: “This Regulation does not apply to issues of protection of fundamental rights and freedoms or the free flow of personal data related to activities which fall outside the scope of Union law, such as activities concerning national security. This Regulation does not apply to the processing of personal data by the Member States when carrying out activities in relation to the common foreign and security policy of the Union.”
Consent: The PDP Bill and the GDPR are founded upon the concept of consent. In other words, data processing should be allowed when the individual allows it. Consent carries similar meanings, with words like “free”, “specific”, and “informed”. “Reasonable expectations” are also a parameter for processing, as are limiting the collection and purposes for collection. They also both given special protection to children's lack of ability to give consent.
Individual’s rights: Both have similar rights given to the individual, including the right to correction, the right to data portability (transferring your data to another entity), and the right to be forgotten (the right to erase the disclosure of your data). But, as mentioned above, the right to object to profiling is in the GDPR and not the PDP Bill.
Other similarities: Both place responsibility on the fiduciaries, such as building products that include privacy by their design and transparency about their data-related matters. The European Data Protection Board in the GDPR and the Data Protection Authority in the PDP Bill have some similar duties, such as dispute resolution and codes of conduct.
Don't miss from Explained: Data, their types, and other terms described in India's PDP Bill