President Draupadi Murmu’s approval has cemented the Digital Personal Data Protection (DPDP) Bill, 2023, as official law, ushering in changes to our daily lives. Here’s a comprehensive examination of the DPDP law:
The Union government introduced the revised DPDP Bill in Parliament after over six years of deliberation, aiming to safeguard data.
So, what transformations does this new law entail?
1. Purpose Limitation: Businesses can’t misuse phone numbers collected for billing. Consent is needed for promotional messages, withdrawal allowed via email to the consent manager.
2. Parental Consent: Under-18s must have parental consent to register on websites/apps, verified through OTP or ID.
3. Advertisement Rules: Companies can’t target children with ads based on search history or track their online activities.
4. Data Disclosure: Facebook notifies users about data usage, providing withdrawal process and grievance officer details.
5. Relevant Data: Companies can only request necessary data, which must be deleted once the purpose is fulfilled.
6. Agency Responsibilities: Mobile service agencies must halt data processing when app option is selected, deletion required.
7. RTI and DPDP: Amendment removes personal data denial for RTI, retaining access right.
8. Data Control: Users can inquire about data from companies, request corrections.
9. Posthumous Data Handling: Citizens can nominate data handlers posthumously.
10. Data Leaks: Companies must report data breaches to users and Data Protection Board, with fines for non-compliance.
11. Government Data Use: Govt. can use personal data for scheme eligibility checks.
12. Penalties: False data leak claims attract fines; citizens must adhere to norms.
Additional instances of the DPDP law’s impact include:
• Hotels need permission to store Aadhaar card scans, leakage leads to penalties.
• Phone numbers from room bookings can’t be used for marketing without prior notice.
• Banks must clarify reasons for ID document photocopies during account setup.
• Facebook must specify reasons for collecting personal info, including birthdates.
• Services can cease if withdrawn data impacts operations.
Post Your Comments