Lok Sabha Question No. 1402 (UNSTARRED), answered on 2024-07-31
Subject: Digital Personal Data Protection Act, 2023
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: Smt. Kanimozhi Karunanidhi, Shri Saptagiri Sankar Ulaka, Shri Abhishek Banerjee, Shri Anto Antony

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA UNSTARRED QUESTION NO.  1402

TO BE ANSWERED ON: 31.07.2024

## DIGITAL PERSONAL DATA PROTECTION ACT 2023

## 1402. SHRI SAPTAGIRI SANKAR ULAKA:

SHRI ANTO ANTONY:

SHRI ABHISHEK BANERJEE:

SMT. KANIMOZHI KARUNANIDHI:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

- (a) whether the Government has formed the Data Protection Authority as mandated under the Digital Personal Data Protection (DPDP) Act, 2023;
- (b) if so, the details thereof;
- (c) if not, the reasons therefor; and

(d)  whether  the  Government  proposes  any  plans  to  tackle  the  issues    related  to  data security and data privacy in the absence of a Data Protection Authority along with the plan to  address  in  unique  challenges  posed  by  AI  (Artificial  Intelligence)  technologies  like deepfakes?

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI JITIN PRASADA)

(a) to (d):The Digital Personal Data Protection Act, 2023 ('DPDP Act') was passed by the Parliament on8 th August, 2023. Hon'ble President of India gave assent on 11th August, 2023. Ministry of Electronics  and  Information Technology  ('MeitY') has initiated the process of drafting Rulesin accordance with the DPDP Act. The formation of the Data Protection Board is a subsequent step after the notification of the Rules under DPDP Act.

The  Central  Government,  in  exercise  of  its  powers  under  section  43A  of  the  Information Technology Act, 2000 through the Information Technology (Reasonable Security Practices and  Procedures  and  Sensitive  Personal  Data  or  Information)  Rules,  2011  has  prescribed reasonable security practices and procedures on the sensitive personal data or information.

According  to  these  Rules,  all  organizations  processing  or  storing  sensitive  and  personal information need to implement reasonable security practices and procedures. Such measures must be proportionate to the value of the information assets being safeguarded and the nature of  the  business  of  the  organization.  If  there  is  a  breach  of  information  security,  the organization or a representative acting on its behalf must be able to prove, when requested by the  authorized  agency,  that  they  have  implemented  security  measures  in  accordance  with their documented information security programme and policies.

Besides,  MeitY  has  notified  the  Information  Technology  (Intermediary  Guidelines  and Digital  Media  Ethics  Code)  Rules,  2021  ('IT  Rules,  2021')  on  25.02.2021  which  were subsequently amended 28.10.2022 and 6.4.2023.

IT Rules, 2021 cast obligations on the intermediary platforms to not allow hosting, sharing, uploading, transmitting, etc. of any prohibited information under Rule 3(1)(b) that includes information  which  is  obscene,  pornographic,  paedophilic,  invasive  of  another's  privacy including bodily privacy, etc. Rule 3(1)(b)(v)  and  (vi)  of  the  IT  Rules,  2021  prohibits  misinformation  and  patently  false information that impersonates another person. Rule  3(1)(l)  of  the  IT  Rules,  2021  mandates  the  intermediary  to  report  cyber  security incidents and share related information with the CERT-In in accordance with the policies and procedures as mentioned in the Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013. Where any information that falls within the categories prohibited under Rule 3(1)(b) of the IT Rules,  2021  is  available  on  an  intermediary  platform,  a  user  may  make  a  request  to  the Grievance  Officer  of  the  concerned  intermediary.  Upon  receipt  of  such  request,  the intermediary is required to act expeditiously and in any case within the timelines prescribed under Rule 3(2) of the IT Rules, 2021. Under Rule 3A of the IT Rules, the Government has also established Grievance Appellate Committees  under  the  IT  Rules,  2021  to  allow  users  and  victims  to  appeal  online  on www.gac.gov.in against decisions taken by the Grievance Officers of intermediaries in case

they are dissatisfied with the decision of the Grievance Officer.

*******