NEW DELHI (AP) — Indian lawmakers Wednesday approved a data protection legislation that aims to regulate big tech firms and penalize companies for data breaches, while raising concerns over citizens’ privacy rights.
The legislation will restrict cross-border data transfer and establish a data protection authority to ensure tech companies comply, according to Information Technology and Telecom Minister Ashwini Vaishnaw.
Opposition lawmakers and digital experts argue that the legislation would allow the government and its agencies to access user and personal data without consent, and potentially weaken the Right To Information law. This law currently allows citizens to request data from public officials, such as state employees’ salaries.
Digital rights group Access Now criticized the legislation, stating that it threatens privacy, grants excessive exemptions to the government, and lacks an independent regulator. They also expressed concerns about increased government control over personal data and censorship.
The Digital Personal Data Protection bill was passed by the upper house of Parliament and is expected to be signed into law by the ceremonial president. It follows two previous unsuccessful attempts to pass similar legislation and comes after a landmark 2017 court ruling that affirmed privacy as a fundamental right of every citizen.
Supporters argue that a data protection law is necessary in India to combat financial fraud and data leaks, as well as protect personal information from misuse for commercial and political purposes.
In 2021, India introduced regulatory laws to oversee social media companies and digital platforms, citing misinformation and hate speech concerns. Critics fear the laws could lead to online censorship, particularly on platforms like X (previously known as Twitter).