Synopsis
Five months after establishing the Data Protection Board of India (DPBI), the government has yet to set up search-cum-selection committees to appoint its chairperson and four members. While the Digital Personal Data Protection (DPDP) rules are in force, the quasi-judicial body remains unstaffed, even as its framework and portal are being prepared.Listen to this article in summarized format
The Digital Personal Data Protection (DPDP) rules, notified on November 13 last year, have put in place the new personal data governance regime that will regulate the processing and protection of personal data by all data fiduciaries.
On the same day, notifications were issued to establish the DPBI consisting of a chairman and four full-time members as a statutory compliance watchdog, tasked with investigating reported data breaches. While the DPDP rules are being implemented in a staggered manner over 18 months, provisions pertaining to the DPBI had become effective immediately.
Officials at the Ministry of Electronics and Information Technology (MeitY) maintained that the process is ongoing and the DPBI's portal for filing complaints is being made ready.
"It is a critical process and is ongoing. The software and other modalities have been chosen,” said an official, who did not want to be identified. Provisions on the DPBI came into effect immediately when the rules were released, he said, adding: “This was done to prioritise the establishment of the board, since the process of appointments takes time.”
Although the board has yet to have any members, it has already been as signed its first set of responsibilities. Last week, the Indore bench of the Madhya Pradesh High Court directed a petitioner, who had challenged Instagram's decision to discontinue end-to-end encrypted messaging from May 8 to first approach the DPBI.
It also directed the board to pass a "reasoned and speaking order" within 15 days of receiving the representation, in accordance with legal provisions. Under the rules, the committee for picking the DPBI chairperson has to be composed of the cabinet secretary as the chairperson and include the secretaries of the Department of Legal Affairs and MeitY and two experts. A separate committee will identify the four members.
Officials had earlier said that the government was looking to have a fully functional board in place before the DPDP provisions concerning the industry came into effect. The DPBI will be armed with powers to impose penalties up to Rs 250 crore on data fiduciaries for failing to implement reasonable security safeguards to prevent personal data breaches. This amount would go into the Consolidated Fund of India.
