Govt extends deadline for comment on data privacy framework to Oct 10

New Delhi: The government Friday extended the deadline for public comments on the draft Personal Data Protection Bill, 2018 by 10 days to October 10.

An official statement said multiple quarters have requested for extending the deadline and therefore, it has been "decided that a final extension of time will be granted and that the deadline for submission of feedback on the Draft Personal Data Protection bill has been extended till midnight of 10th October 2018".

The draft Personal Data Protection Bill was uploaded on the Ministry of Electronics and IT's website on August 16 for feedback from the public. The last date for submission of feedback was fixed for September 10, which was then extended to September 30.

According to sources, the date has been extended following the recent judgement of the Supreme Court restricting the use of Aadhaar by private entities.

The bill is based on recommendations made by a panel headed by former Justice B N Srikrishna. The committee submitted its report to the government on July 27, suggesting steps for safeguarding personal information, defining obligations of data processors as also rights of individuals, and mooting penalties for violation.

The Justice Srikrishna panel on data protection has recommended that the Aadhaar Act be amended "significantly" to bolster privacy safeguards and mooted that only public authorities approved by the UIDAI or entities mandated by law be given the right to request for identity authentication.

The panel -- whose views on Aadhaar are captured in its 213-page report, but are not part of the draft Personal Data Protection Bill, also submitted by it to the government -- seeks greater autonomy, both functional and financial, for the Aadhaar-issuing body.

The panel asserted that the Unique Identification Authority of India (UIDAI) should not only be autonomous in its decision-making, functioning independently of the user agencies in the government, but also be vested with powers akin to a traditional regulator for enforcement actions.

It has prescribed that UIDAI should be granted powers to impose civil penalties on various errant entities and be armed with power to give directions, issue cease and desist orders to state and private contractors in cases involving statutory violations or non-compliance, and for actual or impending privacy breach.