In the matter of Justice K.S. Puttaswami and another Vs. Union of India [WP 494 of 2012], a nine Judge Constitutional Bench of the Supreme Court, while delivering its judgment on 24th August, 2017, declared "privacy" as a fundamental right under article 21 of the Constitution. Subsequently, on 26th September, 2018, a five Judge Constitutional Bench of the Supreme Court while delivering its final judgment in the above case impressed upon the Government to bring out a robust data protection regime.

2. The Government on 31st July, 2017 constituted a "Committee of Experts on Data Protection" chaired by Justice B.N. Srikrishna to examine the issues relating to data protection. The said Committee examined the issues on data protection and submitted its Report on 27th July, 2018. On the basis of the recommendations made in the said Report and the suggestions received from various stakeholders, it is proposed to enact a legislation, namely, the Personal Data Protection Bill, 2019.

3. The proposed Legislation seeks to bring a strong and robust data protection framework for India and to set up an Authority for protecting personal data and empowering the citizens' with rights relating to their personal data ensuring their fundamental right to "privacy and protection of personal data".

4. The salient features of the Data Protection Bill, 2019, inter alia, are as under—

(i) to promote the concepts such as consent framework, purpose limitation, storage limitation and the data minimisation;

(ii) to lay down obligations on entities collecting personal data (data fiduciary) to collect only that data which is required for a specific purpose and with the express consent of the individual (data principal);

(iii) to confer rights on the individual to obtain personal data, correct inaccurate data, erase data, update the data, port the data to other fiduciaries and the right to restrict or prevent the disclosure of personal data;

(iv) to establish an Authority to be called the "Data Protection Authority of India" (the Authority) which shall consist of a Chairperson and not more than six whole-time Members to be appointed by the Central Government;

(v) to provide that the Authority shall protect the interests of data principals, prevent any misuse of personal data, ensure compliance with the provisions of the proposed legislation and promote awareness about the data protection;

(vi) to specify a provision relating to "social media intermediary" whose actions have significant impact on electoral democracy, security of the State, public order or the sovereignty and integrity of India and to empower the Central Government, in consultation with the Authority, to notify the said intermediary as a significant data fiduciary;

(vii) to confer a "right of grievance" on data principal to make a complaint against the grievance to the data fiduciary and if aggrieved by the decision of such data fiduciary, he may approach the Authority;

(viii) to empower the Central Government to exempt any agency of Government from application of the proposed Legislation;

(ix) to empower the Authority to specify the "code of practice" to promote good practices of data protection and facilitate compliance with the obligations under this legislation;

(x) to appoint the "Adjudicating Officer" for the purpose of adjudging the penalties to be imposed and the compensation to be awarded under the provisions of this legislation;

(xi) to establish an "Appellate Tribunal" to hear and dispose of any appeal from an order of the Authority under clause 54 and the Adjudicating Officer under clauses 63 and 64; and

(xii) to impose "fines and penalties" for contravention of the provisions of the proposed legislation.

5. The Notes on Clauses explain in detail the various provisions contained in the Bill.

6. The Bill seeks to achieve the above objectives.

The 5th December, 2019.