Q. Why is this in News?
A. The Ministry of Electronics and Information Technology will soon come up with the Digital India Act, 2023 which will replace the Information Technology Act (IT Act) of 2000.
- The Indian parliament plans to implement the Digital India Act alongside the Digital Personal Data Protection Bill, 2022, proposed in November 2022, where the two legislations will work in tandem with each other.
Q. What is the Need for a New Act?
A.
- Since the IT Act of 2000 was enacted, there have been many revisions and amendments (IT Act Amendment of 2008, IT Rules 2011) in attempts to define the digital space in which it regulates while trying to put more emphasis on the data handling policies.
- However, because the IT Act was originally designed only to protect e-commerce transactions and define cybercrime offenses, it did not deal with the nuances of the current cybersecurity landscape adequately nor did it address data privacy rights.
- Without a complete replacement of the governing digital laws, the IT Act would fail to keep up with the growing sophistication and rate of cyber-attacks.
- The new Digital India Act envisages to act as catalysts for Indian economy by enabling more innovation, more startups, and at the same time protecting the citizens of India in terms of safety, trust, and accountability.
Q. What are the Likely Provisions under Digital India Act 2023?
A.
- Freedom of Expression:
- Social media platforms’ own moderation policies may now be reduced to constitutional protections for freedom of expression and Fundamental speech rights.
- An October 2022 amendment to the IT Rules, 2021 says that platforms must respect users’ free speech rights.
- Three Grievance Appellate Committees have now been established to take up content complaints by social media users.
- These are now likely to be subsumed into the Digital India Act.
- Online Safety:
- The Act will cover Artificial Intelligence (AI), Deepfakes, cybercrime, competition issues among internet platforms, and data protection.
- The government put out a draft Digital Personal Data Protection Bill in 2022, which would be one of the four prongs of the Digital India Act, with the National Data Governance Policy and amendments to the Indian Penal Code being others, along with rules formulated under the Digital India Act.
- New Adjudicatory Mechanism:
- A new “Adjudicatory Mechanism” for criminal and civil offenses committed online would come into place.
- Safe Harbour:
- The government is reconsidering a key aspect of cyberspace — ‘safe harbour’, which is the principle that allows social media platforms to avoid liability for posts made by users.
- The term has been reined in recent years by regulations like the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, which require platforms to take down posts when ordered to do so by the government, or when required by law.
Q. What is the Digital Personal Data Protection Bill?
A.
- The Bill will apply to the processing of digital personal data within India where such data is collected online, or collected offline and is digitised. It will also apply to such processing outside India, if it is for offering goods or services or profiling individuals in India.
- Personal data may be processed only for a lawful purpose for which an individual has given consent. Consent may be deemed in certain cases.
- Data fiduciaries will be obligated to maintain the accuracy of data, keep data secure, and delete data once its purpose has been met.
- “Data Fiduciary” is defined as any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data.
- The Bill grants certain rights to individuals including the right to obtain information, seek correction and erasure, and grievance redressal.
- The central government may exempt government agencies from the application of provisions of the Bill in the interest of specified grounds such as security of the state, public order, and prevention of offences.
- The central government will establish the Data Protection Board of India to adjudicate non-compliance with the provisions of the Bill.
