独家
数据在受信任国家内的自由跨境流动也在讨论之中
周五公布的《2022年数字个人数据保护法案》的最新草案供公众咨询，该中心提出了有关“受信任”司法管辖区内印度用户数据自由跨境流动的建议。
该中心在最新的数字协议草案中提议，在“受信任的”司法管辖区内，印度用户的数据可以自由跨境流动《个人资料保障条例草案》该计划于上周五向公众征求意见。
缩短比尔-仅包含30个条款，而早期版本有99个条款-还要求以“简单易懂的语言”(包括地区语言)告知用户数据收集的目的以及与之共享数据的机构。用户也有权撤回同意，并要求删除或更正个人资料。
ET是第一个报道该规定的11月16日版本的新数据法案．
联邦电子和信息技术、铁路和通信部长阿什瓦尼称该法案“技术不可知论，易于阅读，实施完全是数字化设计”Vaishnaw他说，拟议中的立法将“允许创业生态系统增长，法案的一些条款将被世界效仿。”
“我们起草了这项法案，保留了所有既定的隐私原则和全球经验，”这位部长告诉印度经济时报。
Vaishnaw指出，印度语言已经得到了应有的通知，同意，要求使用附表8中规定的任何一种印度语言，Vaishnaw说，与政府对女性的关注一致，立法草案只使用“法案中的女性代词”。
全面的框架
草案还要求在发生数据泄露以及未能告知用户或政府的情况下进行严厉的处罚，最高可达50亿卢比。
它还建议成立印度数字数据保护委员会，以裁决滥用和误用个人数据的纠纷，并决定处罚措施。委员会由一名主席及数名全职及兼职成员组成，并有权在有需要时传唤及审查宣誓的人士，检查任何资料、簿册、文件或登记册、账簿或资料受托人的任何其他文件。
信息技术部长称DPDP法案为“现代立法”拉杰夫钱德拉塞卡该法案的新草案是“全面法律和规则框架的一部分，包括IT规则、DPDP法案、国家数据治理框架政策以及新的数字印度法案”。
钱德拉塞卡说:“(草案)实现了看似矛盾的目标，即保护公民的数据，为企业提供便利的商业环境，以及有效治理和国家安全的公共利益。”
在草案中，政府保留了“儿童”的定义，即任何未满18岁的人，并规定在处理儿童数据时需要征得父母同意。
谷歌等大型科技公司不太可能接受这一规定元，这些网站的一些用户年龄在18岁以下。
印度数据安全委员会(Data Security Council of India)前首席执行官拉玛·维达什里(Rama Vedashree)表示，这是一项全面的数据保护法案，包括非个人数据，对此“没有混淆”。“我认为他们很好地加强了同意原则和DP委员会的作用。
然而，曾在2018年起草第一版《个人数据保护法案》的正义BN Srikrishna委员会任职的Vedashree认为，“对于中央政府豁免任何数据受托人免受法案约束的权力，不存在制衡”。
她补充说，在公众咨询之后，该法案有望变得更加“全面”。
其他如互联网自由基金会认为草案“缺乏贯穿始终的立法指导”。“在30条中，我们注意到，‘视规定而定’一词出现了18次，往往没有任何立法指导。这创造了模糊的，不受引导的力量联合政府制定规则”政策倡导组织说。
草案还引入了第三方机构的概念，称为同意管理人，该机构将通过透明和可互操作的平台代表用户管理、审查或撤回同意。
政府还根据正在处理的个人数据的数量和敏感性、对数据主体的损害风险以及国家安全等参数引入了重要数据受托人的概念。
重要数据受托人可以任命一名数据保护官和一名独立数据审计员，以评估其对法规的合规性。
使用者亦有权索取个人资料摘要;以及与之共享个人数据的所有数据受托人的身份。
新法案草案还提出，如果数据处理者或数据受托人未能采取合理的安全措施来防止个人数据泄露，将处以最高25亿卢比的罚款。如果这些数据处理者或受托人未能通知数据委员会或数据泄露的受影响个人，将处以最高20亿卢比的罚款。另一方面，不履行与儿童有关的额外义务也可能招致20亿卢比的罚款。
最高法院高级律师Gopal Jain告诉印度经济时报，该法案草案“是聪明法律的一个很好的例子，它简单灵活，管理了利益相关者的利益。”
缩短比尔-仅包含30个条款，而早期版本有99个条款-还要求以“简单易懂的语言”(包括地区语言)告知用户数据收集的目的以及与之共享数据的机构。用户也有权撤回同意，并要求删除或更正个人资料。
ET是第一个报道该规定的11月16日版本的新数据法案．
“我们起草了这项法案，保留了所有既定的隐私原则和全球经验，”这位部长告诉印度经济时报。
Vaishnaw指出，印度语言已经得到了应有的通知，同意，要求使用附表8中规定的任何一种印度语言，Vaishnaw说，与政府对女性的关注一致，立法草案只使用“法案中的女性代词”。
全面的框架
草案还要求在发生数据泄露以及未能告知用户或政府的情况下进行严厉的处罚，最高可达50亿卢比。
它还建议成立印度数字数据保护委员会，以裁决滥用和误用个人数据的纠纷，并决定处罚措施。委员会由一名主席及数名全职及兼职成员组成，并有权在有需要时传唤及审查宣誓的人士，检查任何资料、簿册、文件或登记册、账簿或资料受托人的任何其他文件。
钱德拉塞卡说:“(草案)实现了看似矛盾的目标，即保护公民的数据，为企业提供便利的商业环境，以及有效治理和国家安全的公共利益。”
在草案中，政府保留了“儿童”的定义，即任何未满18岁的人，并规定在处理儿童数据时需要征得父母同意。
谷歌等大型科技公司不太可能接受这一规定元，这些网站的一些用户年龄在18岁以下。
印度数据安全委员会(Data Security Council of India)前首席执行官拉玛·维达什里(Rama Vedashree)表示，这是一项全面的数据保护法案，包括非个人数据，对此“没有混淆”。“我认为他们很好地加强了同意原则和DP委员会的作用。
然而，曾在2018年起草第一版《个人数据保护法案》的正义BN Srikrishna委员会任职的Vedashree认为，“对于中央政府豁免任何数据受托人免受法案约束的权力，不存在制衡”。
她补充说，在公众咨询之后，该法案有望变得更加“全面”。
其他如互联网自由基金会认为草案“缺乏贯穿始终的立法指导”。“在30条中，我们注意到，‘视规定而定’一词出现了18次，往往没有任何立法指导。这创造了模糊的，不受引导的力量联合政府制定规则”政策倡导组织说。
草案还引入了第三方机构的概念，称为同意管理人，该机构将通过透明和可互操作的平台代表用户管理、审查或撤回同意。
政府公布《保障个人数码资料条例草案》拟稿
然而，利益相关者对数据保护法案的意见和提交的内容不会公开披露，“以使提交反馈的人能够自由地提供反馈”。
政府还根据正在处理的个人数据的数量和敏感性、对数据主体的损害风险以及国家安全等参数引入了重要数据受托人的概念。
重要数据受托人可以任命一名数据保护官和一名独立数据审计员，以评估其对法规的合规性。
使用者亦有权索取个人资料摘要;以及与之共享个人数据的所有数据受托人的身份。
新法案草案还提出，如果数据处理者或数据受托人未能采取合理的安全措施来防止个人数据泄露，将处以最高25亿卢比的罚款。如果这些数据处理者或受托人未能通知数据委员会或数据泄露的受影响个人，将处以最高20亿卢比的罚款。另一方面，不履行与儿童有关的额外义务也可能招致20亿卢比的罚款。
最高法院高级律师Gopal Jain告诉印度经济时报，该法案草案“是聪明法律的一个很好的例子，它简单灵活，管理了利益相关者的利益。”
The Centre has proposed free cross-border flow of data pertaining to Indian users within \"trusted\" jurisdictions in the latest draft of the Digital Personal Data Protection Bill<\/a>, 2022, which was released for public consultation on Friday.
The shortened Bill<\/a> \u2014 containing only 30 clauses compared to 99 clauses in earlier versions \u2014also mandates that users be informed of the purpose of data collection and the agencies with which it\u2019s being shared, in \"plain and simple language\" including in regional languages. Users will also have the right to withdraw consent and seek for erasure or correction of personal data.
ET was the first to report on the provisions of the new data Bill in its edition dated November 16<\/a>.
The shortened Bill<\/a> \u2014 containing only 30 clauses compared to 99 clauses in earlier versions \u2014also mandates that users be informed of the purpose of data collection and the agencies with which it\u2019s being shared, in \"plain and simple language\" including in regional languages. Users will also have the right to withdraw consent and seek for erasure or correction of personal data.
ET was the first to report on the provisions of the new data Bill in its edition dated November 16<\/a>.
<\/div><\/div>Terming the Bill \"technology agnostic, simple to read and implementation (as) completely digital by design,\" the union minister of electronics & information technology, railways and communication Ashwani Vaishnaw<\/a> said the proposed legislation would \"allow the start-up ecosystem to grow and (that) some of the provisions of the Bill will be emulated by the world.\"
\"We have drafted this bill keeping all established principles of privacy and the global experience,\" the minister told ET.
Pointing out that Indian languages have been given their due with notices, consents, required to be in any one of the Indian languages specified in Eighth Schedule, Vaishnaw said in line with the government\u2019s focus on women, the draft legislation uses only \" female pronouns in the bill\".
Comprehensive Framework
<\/strong>
The draft also calls for stiff penalties \u2013 going up to a maximum of Rs 500 crore \u2013 in the event of a data breach as well as failure to intimate users or the government about it.
It also proposes the establishment of a digital Data Protection Board of India, to adjudicate disputes of abuse and misuse of personal data, along with deciding the penalties. The board\u2014comprising a chairperson and several full-time and part-time members\u2014will also have the power to summon and examine people under oath, inspect any data, book, document or register, books of account of any other document of a data fiduciary if such a need arises.
\"We have drafted this bill keeping all established principles of privacy and the global experience,\" the minister told ET.
Pointing out that Indian languages have been given their due with notices, consents, required to be in any one of the Indian languages specified in Eighth Schedule, Vaishnaw said in line with the government\u2019s focus on women, the draft legislation uses only \" female pronouns in the bill\".
Comprehensive Framework
<\/strong>
The draft also calls for stiff penalties \u2013 going up to a maximum of Rs 500 crore \u2013 in the event of a data breach as well as failure to intimate users or the government about it.
It also proposes the establishment of a digital Data Protection Board of India, to adjudicate disputes of abuse and misuse of personal data, along with deciding the penalties. The board\u2014comprising a chairperson and several full-time and part-time members\u2014will also have the power to summon and examine people under oath, inspect any data, book, document or register, books of account of any other document of a data fiduciary if such a need arises.
<\/div><\/div>Calling the DPDP Bill a \"modern legislation\", the minister of state for information technology Rajeev Chandrasekhar<\/a> said that the new draft of the bill is \"a part of a comprehensive framework of laws and rules that include the IT rules, DPDP bill, National Data Governance Framework Policy<\/a> and a new Digital India Act\".
\"(The draft) achieves the seemingly contradictory objectives of data protection of our citizens, ease of doing business for industry and public interest of efficient governance and national security,\" Chandrasekhar said.
In the draft bill, the government has retained the definition of \u2018child\u2019 to be anyone who has not attained the age of 18 and mandated that parental consent is needed for the processing of data of a child.
The provision is unlikely to go down well with big tech companies such as Google, and Meta<\/a>, which have several users in the below-18 category.
Rama Vedashree, the former chief executive officer at Data Security Council of India said there is \"no confusion\" of it being an overall data protection bill and including non-personal data. \"I think they are reinforcing well the principles of consent and role of DP Board.
However, Vedashree -- who served on the Justice BN Srikrishna committee that drafted the first version of the Personal Data Protection Bill in 2018\u2014is of the view that there are no \"checks and balances on the central government\u2019s power to exempt any data fiduciary being exempt from the bill.\"
\"The bill would hopefully become a little more \"comprehensive\" after the public consultations, she added.
Others such as The Internet Freedom Foundation<\/a> held that the draft had \"a lack of legislative guidance throughout\". \"For the 30 clauses, we have noticed the phrase, \u2018as may be prescribed\u2019 mentioned 18 times, often without any legislative guidance. This creates vague, unguided power for the Union Government<\/a> to frame rules,\" the policy<\/a> advocacy group said.
The draft Bill has also introduced the concept of a third-party agency called the consent manager, which will manage, review or withdraw consent on behalf of a user through a transparent and interoperable platform.
\"(The draft) achieves the seemingly contradictory objectives of data protection of our citizens, ease of doing business for industry and public interest of efficient governance and national security,\" Chandrasekhar said.
In the draft bill, the government has retained the definition of \u2018child\u2019 to be anyone who has not attained the age of 18 and mandated that parental consent is needed for the processing of data of a child.
The provision is unlikely to go down well with big tech companies such as Google, and Meta<\/a>, which have several users in the below-18 category.
Rama Vedashree, the former chief executive officer at Data Security Council of India said there is \"no confusion\" of it being an overall data protection bill and including non-personal data. \"I think they are reinforcing well the principles of consent and role of DP Board.
However, Vedashree -- who served on the Justice BN Srikrishna committee that drafted the first version of the Personal Data Protection Bill in 2018\u2014is of the view that there are no \"checks and balances on the central government\u2019s power to exempt any data fiduciary being exempt from the bill.\"
\"The bill would hopefully become a little more \"comprehensive\" after the public consultations, she added.
Others such as The Internet Freedom Foundation<\/a> held that the draft had \"a lack of legislative guidance throughout\". \"For the 30 clauses, we have noticed the phrase, \u2018as may be prescribed\u2019 mentioned 18 times, often without any legislative guidance. This creates vague, unguided power for the Union Government<\/a> to frame rules,\" the policy<\/a> advocacy group said.
The draft Bill has also introduced the concept of a third-party agency called the consent manager, which will manage, review or withdraw consent on behalf of a user through a transparent and interoperable platform.
![](\"https:\/\/st.etb2bimg.com\/Themes\/Release\/images\/responsive\/ettelecom-default.jpg\")
<\/a><\/figure>