The upper house of the Indian parliament has granted its approval to the long-delayed legislation, which will give the government greater control over how Big Tech companies process user data.
The Digital Personal Data Protection Bill allows companies to transfer some user data abroad and imposes penalties on companies for breaches in data security. The law will also allow the government to seek information from firms and issue directions to block content on the advice of a data protection board appointed by the federal government.
Under the new rules, firms will also be banned from processing personal data that could negatively impact a child's wellbeing. In addition, the law will require parental consent for processing the personal data of children and force companies to delete user data once it has fulfilled its original business intent.
The vote faced no resistance from the opposition, which opted not to participate. The legislation has, however, faced criticism from human rights groups, which claim it will weaken the 2005 Right To Information law that allows citizens to seek data from public officers, such as the salaries of state employees.
They also warned that the legislation would allow the government and its agencies to access user data from companies and the personal data of individuals without their consent.
"It jeopardises privacy, grants excessive exemptions to the government, and fails to establish an independent regulator," digital rights group Access Now said in a statement.
"An effective, world-class data protection law requires core tenets: an independent regulator; actionable rights and remedies; clarity on cross-border data flows; and business certainty and meaningful accountability from all data collectors, including the government. The bill is devoid of each of these."
The Editors Guild of India added that the law "creates an enabling framework for surveillance of citizens, including of journalists and their sources".
India's deputy minister for information technology, Rajeev Chandrasekhar, said that the law will protect the rights of all citizens, allow the innovation economy to expand, and permit the government legitimate access in the case of national security emergencies and natural disasters.
The communications and information technology minister, Ashwini Vaishnaw, added that the bill is "very pro-citizen and pro-privacy," stressing that it will ensure that "every citizen's data is fully protected."
