The Road to the Act: Srikrishna and Three Bills

In one line

A committee under Justice B.N. Srikrishna reported in 2018, its Bill was introduced as the Personal Data Protection Bill 2019, a Joint Parliamentary Committee reported in 2021, the Bill was withdrawn in 2022, a much shorter draft replaced it, and the Digital Personal Data Protection Act, 2023 was assented on 11 August 2023.

The starting point

Puttaswamy, chapter 1150, decided on 24 August 2017. Chandrachud J held that informational privacy is a facet of the right, that the danger comes from non-state actors as well as the State, and commended to the Union Government the need to put in place a robust data protection regime, noting that a committee chaired by Justice B.N. Srikrishna had been constituted for that purpose.

So the committee predates the judgment by a few weeks and the judgment blessed it. The committee was constituted by the Ministry of Electronics and Information Technology on 31 July 2017.

The Srikrishna Committee, 2017 to 2018

Composition. Chaired by Justice B.N. Srikrishna, a retired judge of the Supreme Court, with members drawn from government, academia and industry.

Its report, submitted in July 2018, was titled "A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians", and it came with a draft Personal Data Protection Bill, 2018.

Four ideas from that report survive into the Act and should be named.

One: the fiduciary relationship. The report's central conceptual move was to describe the entity handling personal data as a data fiduciary owing duties of loyalty and care to a data principal, rather than as a "controller" exercising power. Both terms are in the Act.

Two: the trinity. The report framed the problem as balancing the interests of the individual, the State and industry, and argued that none should be sacrificed to the others.

Three: an independent regulator. A Data Protection Authority of India, with rule-making, enforcement and adjudication functions.

Four: consent as a contract of trust, coupled with a recognition that consent alone cannot carry the whole load, hence a list of non-consensual grounds.

And two ideas that did not survive.

Data localisation. The draft of 2018 required a serving copy of all personal data to be kept in India, and allowed the Central Government to notify critical personal data that could be processed only in India. The Act of 2023 abandoned this entirely for a negative-list model in section 16, chapter 1310.

Justice Srikrishna's own criticism. He publicly criticised later drafts, in particular the breadth of the exemptions available to the State, and said that a law with such exemptions could turn India into an Orwellian state. That criticism is the ancestor of the section 17(2)(a) debate, chapter 1310.