The draft Personal Data Protection Bill, 2018 – part of the Srikrishna panel report – provides for regulations on how personal data is to be handled by various entities, including the state. However, it does make key exemptions, such as consent, under special circumstances.
For instance, section 42 states that when there is a need to access or process citizens’ data for reasons of national security, this will be exempt from key rules that protect data, as provided in the draft bill. However, these exemptions will apply only when it is authorized by law.
Whatever the exemptions, personal data must always be handled in a “fair and reasonable ma- nner” that respects the “privacy of the data principal”, the draft bi- ll states. Data principal, as defin- ed by the bill, refers to any person whose data is being referred to.
Similar exemptions have been made in the draft bill for processing of personal data for police investigations and detentions or prosecution for any offence committed. But such exemptions only apply when permission has been granted by law. The implication of these provisions is that Parliament and states will have to make a separate law to allow for these exemptions.
Exceptions have also been proposed in the draft bill for legal proceedings. When personal data needs to be accessed to enforce any legal right or claim, seeking any relief, defending a criminal charge, opposing any claim, or obtaining any legal advice from an advocate, major provisions of the draft bill do not apply.