India withdraws data protection and privacy bill

The 2019 law had proposed stringent regulations on cross-border data flows but had raised concerns among tech giants.

India’s government has withdrawn a data protection and privacy bill which was first proposed in 2019 and had alarmed big technology companies such as Facebook and Google, announcing it was working on a new comprehensive law.

The 2019 law had proposed stringent regulations on cross-border data flows and proposed giving the Indian government powers to seek user data from companies, seen as part of Prime Minister Narendra Modi’s stricter regulation of tech giants.

A government notice on Wednesday said the decision came as a parliamentary panel’s review of the 2019 bill suggested many amendments, leading to the need for a new “comprehensive legal framework”. The government will now “present a new bill”, the notice added.

IT minister Ashwini Vaishnaw said the government has started drafting the new bill, “which is in good advanced stages”, with a public release “very close”.

The government aims to get the new bill approved and made into law by early 2023 in the parliament’s budget session which typically runs January-February, he said.

The 2019 privacy bill was designed to protect Indian citizens and establish a so-called data protection authority, but it had raised concerns among Big Tech giants that it could increase their compliance burden and data storage requirements.

Agencies