How soon can users expect the Data Protection Board to be up and running?
We operate everything on sound principles. The DPDP represents a new regime, a new framework. We don’t want the transition to the new regime to be anything but orderly. We don’t want consumers or industry to be hit by some artificial timeline for it. We will consult them. Companies have asked for some time. Some companies have asked for a longer time. We also have a duty to ensure that citizens’ rights are not delayed too much. We will draw a good balance and we will see.
Will there be any consultations for the rulemaking?
Yes, absolutely. There will be a consultation, but it won’t be a consultation on the policy itself. I will speak to all stakeholders.
Is there a tentative timeline by which the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) can be expected to settle into its new mandate?
Discover the stories of your interest
An institution like the TDSAT already has capacities and capabilities. This is just a new type of adjudication in a new space. They’re already dealing with appeals in several other areas between companies and citizens, which are going to the Telecom Regulatory Authority of India and then getting referred to the TDSAT. I think the TDSAT is ready. Whether they’re ready or not, we’ll see from the performance of how they deal with the appeals.Also read | Decoding the Digital Personal Data Protection Bill 2023
You had previously mentioned that on the day the law comes into force, all data fiduciaries will be required to send notices to data principals and take their consent on using their personal data. Do you think this will lead to consent fatigue among users on Day Zero as they will be flooded with notices?
This is as per the law. Our principle is that consent must be taken from a data principal. We have enacted the law after consultations on certain principles. The principle here is that there should be consent of the citizen before his or her data is processed for any purpose by the data platform.
The Act provides for the data principal to give, manage, review, or withdraw her consent to the data fiduciary through a consent manager. Will users be able to choose from multiple consent management apps to control the permissions given?
That’s the idea, that users will be able to choose from multiple consent managers they trust. We will give them a multiplicity of options and the data principal will be able to choose his or her consent manager from among the options he or she has.
Also read | Digital economy to contribute over 20% of India’s GDP by 2026: MoS IT Rajeev Chandrasekhar
How will government exemptions work? Will various agencies be left to interpret what constitutes national security or law and order?
Even under the IT Act, national security is not defined. There must be a specific order from a ministry if something is a threat to national security.
For the Data Protection Board to suggest the issue of blocking orders, a firm should have violated the law at least twice and public interest concerns should have arisen. Can you give some examples of public interest?
The basic principle of blocking is if you violate the law twice, the government has the right to say you’re a repeat offender. The government is giving them two chances.
