The government has issued draft rules for the Digital Personal Data Protection Act on Friday for public consultation till February 18.
“Rules have to be within four walls of the Act. It is within the ambit of the Act passed by Parliament. These rules have been framed to ensure a balance between regulation and innovation while completely safeguarding the rights of citizens,” Vaishnaw told PTI in an interview.
The minister said earlier there was only one template available to the world — the European data protection rule with high level of regulation — but Indian rules have attempted to balance the regulation with innovation to safeguard the boom in innovation ecosystem developing among start-ups in the country.
He said extensive consultation has been held with the industry and a digital office is being put in place for registration of complaints, their handling and adjudication.
The minister said the final rules will be placed before Parliament in the monsoon session and all entities handling data digitally will get two years to adapt their system and comply with the law.
He said the rules may be improvised based on the experience of the new data regime.
“As far as possible, minimum prescription has been kept in the rules to ensure simple implementation of the Act. The rules have carefully addressed the large harm that the digital world may pose to the privacy of people, especially that of children,” Vaishnaw said.
The Digital Personal Data Protection draft rules specify that a parent’s verifiable consent will have to be obtained by social media or online platforms before children can create an account.
Parents’ identity and age will have to be checked through voluntarily provided identity proof or virtual tokens.
“We have also kept graded penalties to protect the interests of micro, small and medium enterprises. It is to save businesses that may be running using a single computer. However, Big Techs have higher obligations under the rules. Minor breaches will attract small penalties and big breaches will lead to higher penalties,” Vaishnaw said.
As per the DPDP Act, the acceptance of the voluntary undertaking by the Board shall constitute a bar on proceedings under the provisions of this Act as regards the contents of the voluntary undertaking.
If a person fails to adhere to any term of the voluntary undertaking accepted by the Data Protection Board (DPB), it will be deemed as a breach of the provisions of the Act and the board, after giving an opportunity to the person to explain his position, may take action as per the penal provisions.
The minister said utmost precaution has been taken to protect small businesses as per the basic principle laid down in the Act.
Vaishnaw said the rules for data processing overseas will be implemented while keeping in mind citizen’s rights and national interests.
However, the rules will not have an impact on existing norms under which news media operate. “Media rights will continue to remain as it is. Press will continue to function as per the current framework,” Vaishnaw said.