Lok Sabha Question No. 70 (STARRED), answered on 2024-02-07
Subject: Clubbing of Non-Personal Data
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: Thalikkottai Rajuthevar Baalu

## GOVERNMENT OF INDIA

## MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA

## STARRED QUESTION NO. *70

TO BE ANSWERED ON: 07.02.2024

## CLUBBING OF NON-PERSONAL DATA

## *70. SHRI T.R. BAALU:

Will  the  Minister  of  Electronics  and  Information  Technology  be  pleased  to state:

(a) whether it is a fact that the clubbing of non-personal data under the ambit of the proposed data protection law is hugely problematic since non-personal data

has huge ramifications;

- (b) if so, the details thereof;
- (c) the steps proposed to be taken by the Government in this regard keeping in view that the handling, access to and rights over such data require a different kind of skill set and mindset, which a privacy regulator tasked with primarily looking at personal data  might lack; and
- (d) if not, the reasons therefor?

## ANSWER

## MINISTER OF ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI ASHWINI VAISHNAW)

(a) to (d):  A statement is laid on the Table of the House.

## STATEMENT REFERRED TO IN THE REPLY TO LOK SABHA STARRED QUESTION  NO.*70  FOR  07.02.2024  REGARDING  CLUBBING  OF  NONPERSONAL DATA

...........

(a) to (b):  The policies of the Government are aimed at ensuring that the Internet in India is Open, Safe & Trusted and Accountable to all our Digital Nagriks.

The  Digital  Personal  Data  Protection  Act,  2023  (DPDP  Act)  was  passed  by  the Parliament  on  8 th August,  2023  and  got  the  assent  on  the  Hon'ble  President  on 11 th August, 2023. The Act pertains only the personal data and doesn't deal with the non-personal  data.  The  Act  aims  to  establish  a  comprehensive  legal  framework governing  digital  personal  data  protection,  by  framing  out  the  rights  and  duties  of Data Principals and the obligations of Data Fiduciaries, empowering Data Principals and fixing accountability of Data Fiduciaries. The Act provides for the processing of digital personal data in a manner that recognizes both the rights of the individuals to protect  their  personal  data  and  for  the  Data  Fiduciaries  the  need  to  process  such personal data for lawful purposes.  The Act puts the obligation on Data Fiduciary to protect personal data in its possession or under its control, including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach. The  Act may  bring in behavioural  changes  in  the  data  processing  activities  of  the  data  fiduciaries  and prevent the exploitation and misuse of the personal data of the data principals.

(c) to (d):  In the DPDP Act, there is a provision of a Data Protection Board, that may consist of a chairperson and members of ability, integrity and standing who possesses special knowledge  or practical experience in the fields of data governance, administration  or  implementation  of  laws  related  to  social  or  consumer  protection, dispute resolution, information and communication technology, digital economy, law, regulation  or  techno-regulation.  The  Data  Protection  Board,  on  receipt  of  an intimation of personal data breach inquire into such personal data breach can direct any  urgent  remedial  or  mitigation  measures  and  impose  monetary  penalty  on  Data Fiduciary based on the significance of the data breach.

*******