Meta, Alphabet and Other Tech Firms Face New Data Rules in India
Companies have to get explicit permission from users for data handling, but the law carves out many exemptions for the government The bill allows allows the government to limit the transfer of data outside India. Photo: Dhiraj Singh/Bloomberg News By Newley Purnell and Tripti Lahiri Aug. 9, 2023 10:13 am ET India’s Parliament on Wednesday passed a data-protection bill years in the making that the government says is needed to regulate big tech firms and protect citizens, but that rights groups say gives New Delhi too much power. The bill, called the Digital Personal Data Protection Act, says firms must get consent from users before collecting their personal data and says they must use it for the stated purposes. It allows the government to limi
The bill allows allows the government to limit the transfer of data outside India.
Photo: Dhiraj Singh/Bloomberg News
India’s Parliament on Wednesday passed a data-protection bill years in the making that the government says is needed to regulate big tech firms and protect citizens, but that rights groups say gives New Delhi too much power.
The bill, called the Digital Personal Data Protection Act, says firms must get consent from users before collecting their personal data and says they must use it for the stated purposes. It allows the government to limit the transfer of data outside India and penalizes firms for breaking the rules.
“Many platforms and many companies…have been collecting personal data of citizens, not just in India but all around the world,” said the junior technology minister, Rajeev Chandrasekhar, in a video posted on X, previously known as Twitter, last week, when the legislation was introduced in the lower house of India’s Parliament. Technology companies “essentially creating business models by misusing and exploiting digital personal data of citizens is something that this bill intends to address.”
Rights groups, however, argue the legislation gives the government excessive power. It doesn’t create an independent regulator and allows the government to exempt itself from the bill’s obligations, according to digital-rights group Access Now. One provision adds to the government’s ability to block online information, while another partly dilutes a transparency law enabling citizens to get information from public authorities.
The Editors Guild, a press association, in a statement expressed concern over what it called a “widening of censorship powers” in the bill.
“This will increase censorship powers well beyond what is presently provided for…and may even be unconstitutional,” the group said.
While the bill represents a significant step in enhancing users’ privacy protections and will mandate firms to manage data more responsibly, it also allows authorities to collect data without individuals’ consent “under exceptional circumstances, potentially paving the way for an infrastructure of mass surveillance,” said Akshara Bassi, a senior research analyst at technology market research firm Counterpoint Research.
The ministry for information technology didn’t immediately respond to a request for comment.
A date for enactment hasn’t been announced. An internet-policy expert noted that the bill leaves many specifics, including which territories might be blocked from data transfers, to be dealt with under rules that will be drafted by the government to implement the law.
“There is a lot of discretion and control that the executive is retaining for itself,” said Prateek Waghre, policy director at the Internet Freedom Foundation, an Indian digital-rights organization, adding that companies won’t fully know how the law could impact them until those rules are out.
An earlier version of the bill released in 2018 prompted concern among tech firms that it would be onerous to implement. The U.S. flagged that version of the bill in an annual report on trade barriers as an initiative that could “potentially threaten innovation and economic growth.”
The rules are the latest challenge to American technology companies that have hundreds of millions of users in the world’s most populous democracy.
New Delhi has in recent years passed rules to counter the rise of problematic material online, tightened e-commerce regulations, and cracked down on virtual private networks, which let internet users shield their identities online.
Indian government officials have in past years spoken about the need for data sovereignty in India and articulated a desire for homegrown tech startups to flourish as they have in China, where American players are locked out.
U.S. tech companies such as Meta Platforms, Alphabet’s Google and Amazon.com
have hundreds of millions of users in India. They have also been investing billions of dollars in the South Asian nation, the world’s last great untapped tech market, where hundreds of millions of people have been getting online for the first time thanks to inexpensive smartphones and cheap mobile data.Amazon and Meta declined to comment. A representative for Google didn’t immediately respond to a request for comment.
India’s digital economy should grow from about $175 billion last year to about $1 trillion by 2030, according to a June report from Google, Singapore state-investment firm Temasek Holdings and consulting firm Bain & Company.
Write to Newley Purnell at [email protected] and Tripti Lahiri at [email protected]
What's Your Reaction?
