Right to Privacy & Digital Personal Data Protection Bill (DPDP Bill), 2022

I. Introduction

The biggest question while discussing privacy and data security is whether privacy is a right or a pre-requisite? Indian policy think tanks, Parliament and even lawyers have had this dilemma for five years. This eventually led us to the second draft.

The proposed data protection framework is in line with the decision of the Supreme Court of India in the Puttaswamy case². The Supreme Court held that the right to privacy is a fundamental right flowing from the right to life and personal liberty, like other fundamental rights guaranteed by the Constitution. Privacy itself was considered to have a negative side (the right to be alone) and a positive side (the right to self-development)³. The right to privacy comes under the ambit of privacy. The right assumes that all information about a person is essentially his own and there is a right to freedom to communicate it or to have it with him. Thus, at the core of information privacy is the right to autonomy and self-determination with respect to one's personal data. The court observed as follows-

Designing a regime for data protection is a complex exercise undertaken by the State after balancing the legitimate concerns of the State with other values of data security and privacy requirements.

Privacy can also be regulated under well defined circumstances.

1. There is a legitimate state interest in controlling the right.

2. The control is necessary and proportionate to obtain the interest.

3. Regulation is by law.

The general framework of a free and fair digital economy can provide a useful reference point for balancing whether in a particular case, a claimed right to privacy exists, and whether a legitimate state interest exists. How to protect the needs of a free and fair digital economy. Liberty and justice are the bedrock of our constitutional framework and the reason for our struggle for independence.

This case is the cornerstone of the 'Right to Privacy' Act in India. In this case, a nine-judge bench unanimously affirmed the right to privacy as a fundamental right guaranteed by the Constitution of India. The court held that the right to privacy is an inherent aspect of dignity, autonomy and liberty and an integral part of the freedoms guaranteed by the Constitution of India.

The case began with the question whether the right to privacy is a fundamental right in the arguments relating to the legal validity of the Aadhaar database in 2015. The State Attorney General argued that the existence of the right to privacy was called into question by two judgments: M.P. Sharma Vs. Satish Chandra, District Magistrate, Delhi ((1954) SCR 1077), as held by an Eight Judge Bench in Kharak Singh v. State of Uttar Pradesh ((1964) 1 SCR 332. According to the state, there were observations in both the cases that the Constitution does not explicitly protect the right to privacy as a fundamental right. Several subsequent judgments over the years have simultaneously recognized the right to privacy as a fundamental right. However, subsequent judgments affirming the existence of the right to privacy have been issued by benches with fewer members than in M.P. Sharma and Kharak Singh. The case was left to a nine-judge Supreme Court bench due to concerns over the precedential value of the decisions and the far-reaching significance of the right to privacy.

The Court said that "the right to privacy is protected as an inherent part of the right to life and personal liberty guaranteed by Article 21 and as part of the freedoms guaranteed by Part III of the Constitution." It thus overturned previous Supreme Court decisions in M.P. Sharma and Kharak Singh, which held that the right to privacy was not recognised under the Indian Constitution. The right to privacy Is inextricably linked to all exercises of human liberty, both explicitly enumerated in Part III and guaranteed in Article 21 of Constitution. It is distributed across the various articles in Part III and takes the form of whichever of their enjoyments its violation restricts.

The Court in its judgement stressed upon the following points:

• It was held that privacy concerns in this day and age of technology can arise from both the state as well as non-state entities and as such, a claim of violation of privacy lies against both of them.
• The Court also held that informational privacy in the age of the internet is not an absolute right and when an individual exercises his right to control over his data, it may lead to the violation of his privacy to a considerable extent.
• It was also laid down that the ambit of Article 21 is ever-expanding due to the agreement over the years among the Supreme Court judges as a result of which a plethora of rights has been included within Article 21.

The judgement in this landmark case was finally pronounced by a 9-judge bench of the Supreme Court on 24th August 2017 upholding the fundamental right to privacy emanating from Article 21. The court stated that Right to Privacy is an inherent and integral part of Part III of the Constitution that guarantees fundamental rights. The conflict in this area mainly arises between an individual’s right to privacy and the legitimate aim of the government to implement its policies and a balance needs to be maintained while doing the same.

The SC also declared that the right to privacy is not an absolute right and any incursion of privacy by state or non-state actors must satisfy the following triple test:

• Legitimate Aim
• Proportionality
• Legality

The decision of all the nine judges also held the following:

• The decision given in M.P. Sharma v Satish Chandra (1954 AIR 300)⁴, which held that the Right to Privacy is not protected by the Constitution of India, stands over-ruled.
• The decision in Kharak Singh (1963 AIR 1295)⁵, to the degree it holds that Right to Privacy is not guaranteed by Part III, also stands over-ruled.
• The right to privacy of an individual is not only protected by the Constitution under Article 21 but is also an intrinsic part of the scheme of Part III which guarantees fundamental rights.

II. Digital Personal Data Protection Bill, 2022⁶

On 18 November 2022, the Ministry of Electronics and Information Technology (MeitY) released the draft Digital Personal Data Protection Bill, 2022 (DPDB) which is open for public comment till 17 December 2022. On 4 August 2022, MeitY withdrew the Data Protection Bill 2021, on the basis that the Joint Committee had recommended significant amendments to the original draft, highlighting the need to develop a “comprehensive” legal framework aligned with contemporary privacy laws. The ever-evolving nuances of the digital ecosystem. ,

The DPDB restates and narrows the focus of the proposed legislation on digital personal data, aiming to set processing standards that balance an individual’s rights in personal data and the right to process personal data for legitimate purposes, economic necessity. The DPDB comes with an explanatory note to aid in the interpretation of the proposed provisions, with a disclaimer that such a note does not form part of the DPDB. Organized into 6 chapters and 1 schedule, DPDB proposes 30 sections to regulate digital personal data processing, including illustrations to explain the purpose of some sections and a significantly condensed version compared to previous bills.

1. Application and scope: The DPDB will apply to (i) digital personal data processing subject to exemptions (material scope), (ii) processing carried out within India, and, in some cases, those carried out outside of India(territorial scope)⁷. The proposal aims to ensure the protection of user data and online privacy. The bill talks about big entities, social media platforms and even companies being accountable for the consumer data and seeks to prohibit misuse of personal data of users.

To fully appreciate the scope, it is important to understand what personal data and processing is covered under the DPDB, what the exemptions are and who are the key stakeholders in the processing lifecycle.

• Personal data is broadly defined as data3 defined as relating to an individual or identifiable in relation to such data and includes opinion. However, the DPDB only covers digital personal data, i.e. it is collected online or offline, and is subsequently digitized.
• Processing means automated operations performed on digital personal data throughout its lifecycle, such as collection, recording, organization, structure, storage, alteration, sharing, transfer, erasure, etc. Automated processing operations include any digital process that is capable of operating automatically according to instructions. Given or otherwise.
• The above two defined terms read together, DPDB will apply to automated processing of digital personal data. To this effect, the DPDB states that it does not apply to (i) non-automated processing and (ii) offline personal data. Therefore, manual data processing such as structured filing systems is out of scope. It is unclear whether DPDB applies to mechanical and semi-automatic data processing. Additionally, the DPDB does not apply to personal data processed by an individual for personal or household purposes and stored for 100 years or more.
• There is no provision for specific categories of sensitive personal data or critical data, and consequently, there are no specific requirements applicable to the processing of sensitive data sets such as health, financial, biometrics, etc. MeitY notes that all forms of personal data come with an inherent expectation of information privacy, and therefore, there is no need to make a distinction. This approach contrasts with the existing Information Technology (Reasonable Security Practices and Procedures for Sensitive Personal Data or Information) Rules, 2011 (IT Rules) and data protection laws in other jurisdictions. This does not take into account the possibility that processing may require more stringent standards due to the sensitive nature of certain datasets and the possibility of additional holidays for sector-specific regulators such as the Reserve Bank of India and the Securities and Exchange Board of India. Window requirements.
• The DPDB applies to 3 main participants in the data processing cycle: (i) data fiduciary (analogous to controller) – any person who, alone or with others, determines the purposes and means of processing, (ii) data processor – any person who processes personal data for a data fiduciary purpose, and (iii) Data principal (same as a data subject) – the person to whom the personal data relates, which in the case of children (eg, 18 years of age or under), includes their parents and legal guardians.

In terms of territorial scope, the DPDB will apply to data subjects and processors processing in India whether they are foreign persons or not. Where digital personal data is processed outside India, DPDB shall apply externally if such processing is for profiling of the data principal in India or for the provision of goods or services to such data principal. Consequence – The territorial scope is simplified to link the place of processing and the physical presence of the data principal in India.

2. Consent and implied consent: Digital personal data processing must be for a legitimate purpose with the consent or deemed consent of the data principal. Fines for breaching consent or compliance requirements can be as high as 500 million (approximately US$6.1 million).

Consent is the primary basis for processing, but with weak parameters. DPDB’s consent is required to be independent, specific, informed and clear. It must be limited to specific purposes and by the affirmative action of the data principal. At or before consent is obtained, the data controller must provide an itemized notice (ie presented as a list of different items) in clear and unambiguous language describing the personal data to be processed and its purpose. The data fiduciary must also provide contact details of an authorized person who will respond to communications and relevant requests from the data principal.

Therefore, only limited information disclosure is considered for obtaining consent and additional details such as type of processing, InfoSec measures put in place to protect personal data, rights available to data principals and privacy practices followed need not be part of it. Subtleties of Cross-Border Transfers. Consent letter The language of notice and consent may be English or any regional language specified in the Eighth Schedule to the Constitution of India, as per the preference of the data principal. Furthermore, the Data Principal may withdraw consent at any time and the consequences of such withdrawal shall be borne by the Data Principal. The data fiduciary has the burden of proof that the processing is consensual, and under the scheme under consideration, a fiduciary will have a relatively low burden of discharge if the notification seeking consent has provided minimal information, and the consent is derived from the data principal to which it points.

In the following circumstances, the DPDB assumes the data principal's consent to processing, i.e. consent as a basis for processing. These are:

• Personal data is voluntarily provided by the data principal and it is reasonable to expect them to provide personal data such as entering into or performing a contract;
• Process the State for performance of any function under law, or providing any service or benefit to the data principal (such as providing benefits under social welfare schemes), or issuing any certificate / license / permit to the data principal (eg collection of biometrics for providing Aadhaar unique identifier);
• compliance with any judgment or order;
• Response to a medical emergency that threatens the life or health of the data principal or other person;
• providing medical treatment or health services to any person during a public health crisis, such as an epidemic, disease outbreak or contact tracing;
• Disaster management or public disorder;
• career goals;
• IN PUBLIC INTEREST; It explains the interest to prevent DPDB from committing any culpable offense “in public interest” in relation to sovereignty and integrity of India, state security, friendly relations with foreign countries, maintenance of public order and interests mentioned earlier and prevents dissemination of false statements or facts; And
• For any fair and reasonable purposes, other “fair and reasonable processing grounds” which may be prescribed later, the Central Government shall consider the legitimate interests of data integrity in the processing, whether such interests are principled, outweigh the adverse public interest in the context of the processing and the reasonable expectations of the data principal.

Essentially, the consent options considered include processing bases recognized in other jurisdictions, such as legal contracts, legitimate interests, benefits of the data principal, and processing by states or judicial bodies for re-purpose. New grounds are also likely to be announced in future. However, in these options, there is no need to provide ex ante or post facto notice to the data principal. As a result, data principals may not be aware of what, why, how and when their personal data has been processed, and this undermines the principles of transparency and accountability that are fundamental to the protection of information privacy.

3. Obligations of the Data Fiduciary: The basic principle is that the data fiduciary shall be primarily responsible for compliance with the DPDB notwithstanding any agreement to the contrary or any action on the part of the data principal. This is the existing practice under IT regulations and data protection laws in other jurisdictions.

The following obligations apply to all data fiduciaries are

• make reasonable efforts to maintain the accuracy and completeness of personal data processed, where the personal data may be used to make decisions affecting the data principal, or subsequently disclosed to another data fiduciary;
• Implement appropriate technical and organizational measures in accordance with the DPDB;
• take appropriate security measures to protect personal data and prevent data breaches; Penalties for non-compliance can be up to INR 2,500 million (approximately 30.5 million USD⁸);
• Report data breach incidents to the designated regulatory body under DPDB, namely the Data Protection Board of India (DPBI) and the affected data principal; Fines for non-compliance can be up to Rs 2,000 million (approx. US$ 24.5 million). This is a welcome move as the previous bill mandated notification of data principals about breaches without risk and risk analysis.
• Stop retaining personal data, or eliminate means of identifying personal data, as soon as the retention purpose is fulfilled, or is no longer required for any other business purposes. Retention of permit even when processing and lawful purposes are achieved;
• publish the business contact information of your Authorized Person responding to inquiries from the Data Principal;
• establishing procedures and effective mechanisms for grievance redressal; And
• Engage a data processor, or transfer personal data to another fiduciary, only with the consent of the data principal and under a contract, this obligation appears to be specifically exempted from the obligation where processing is based on consent.

The penalty for non-compliance with other fiduciary obligations may be up to INR 500 million (approximately 6.1 million USD) for certain obligations, except as specifically stated above. DPDB imposes limited obligations on data fiduciaries compared to previous bills. Perhaps the spirit is to enable self-regulation, which would reduce compliance burdens and costs for businesses. At the same time, it may affect the privacy governance model implemented.

At this point it is important to refer to the Explanatory Note which is not part of the main text of the DPDB. It said that DPDB is designed keeping in mind 7 fundamental principles of data processing such as lawful, fair and transparent processing. Objective hierarchy; data minimization; accuracy of personal data; Storage limits; integrity and confidentiality; and responsibility. But these are not clearly mentioned in the DPDB and only a few derivatives are added as legal obligations. In the absence of a specific obligation, these should be included as broad principled obligations on data integrity, to be determined based on fundamental principles and specific facts. This approach is not unique and has been adopted in various landmark judgments under the EU GDPR. In the absence of these, limited obligations may result in fewer checks and balances that may adversely affect the privacy expectations of data principals.

4. Significant data fiduciaries: Central Government may notify any data fiduciary or class thereof as Significant Data Fiduciary (SDF). While determining them, the quantity and sensitivity of the personal data processed, potential harm to the data principal, impact on India's sovereignty and integrity and security of the State and risks will be taken into account. Elections will be assessed on democracy, public order and other dimensions. I think it's necessary. Previous versions included more details on the criteria and attempted to include some social media moderators in the scope of the SDF, which is now open-ended. In addition to the obligations in #3 above, an SDF must (i) appoint an individual based in India to act as its Data Protection Officer (DPO), who reports to the data fiduciary's governing body (such as a board); Director of a company) will act as the SPOC of the Grievance Redressal Mechanism, (ii) appoint an independent data auditor to assess compliance, and (iii) take other steps such as assessing the data protection implications for compliance with the intent of the Act. and periodic audit.

Therefore, the details of who qualifies as SDFs, the additional obligations they must meet and the manner of compliance are left to the legislative process, and the scope of the additional obligations needs to be fully assessed. Wait for them. The fine for non-compliance with the proposed SDF obligations can be up to 1,500 million rupees (about 18.3 million US dollars).

5. Rights and duties of data principal⁹: The DPDB has limited the scope of rights of data principals with respect to their personal data and seeks to impose certain obligations on them. A data controller has the right to:

• confirmation of the processing carried out;

• access summary of personal data processed, processing operations carried out, identity of all data fiduciaries with whom personal data is shared and other information as may be prescribed;

• Personal data that is inaccurate or misleading must be corrected.

• completion of incomplete personal data;

• Personal data update;

• Erasure of personal data no longer required for processing purposes or for any legal purpose => Please note that Fiduciary is permitted to retain personal data if it is required for a business purpose, therefore, the right to erasure is unclear and may or may not override such right of Fiduciary, requiring clarification;

• File a complaint with Data Integrity;
• Complain to DPBI if they receive unsatisfactory response to registered complaints or no response from the Data Trustee; And
• Nominate someone else to act for them in the event of death or incapacity.

The data principal will not have the right to be forgotten, the right to object to certain types of processing (an important area of the Automated Data Processing Regulation that the principal cannot object to) or the right to data portability. Controversial issues globally. The manner, timeline, format and other details on how to exercise the rights are left to the administration.

However, in order to exercise these rights, the data principal is obliged to perform certain duties. One of them requires the data principal to comply with the provisions of all applicable laws. This is ambiguous because a breach of any applicable law may mean a denial of the data principal’s rights, even in situations where there is no connection between the right to exercise and the non-compliance. No connection. For example, a literal interpretation would indicate that an offender has no data principal rights under the DPDB. It is also unclear who will determine and verify that the data principal complies with applicable law.

Further, the Data Principal shall not falsely or frivolously file a complaint with the Data Fiduciary, or file a complaint with the DPBI. It appears that the discretion to determine whether a complaint or complaint is false or frivolous is left to the data fiduciary and the DPBI respectively. Further, when applying for any documents, services, unique identifier, proof of identity or proof of address, the data principal shall be obliged to provide accurate and material information; All information submitted to exercise the right to rectification or erasure must be verifiably authentic. A data principal can be fined up to 10,000 rupees (about $122) for breaching his duties. At the same time, a fine of up to 500 million (about US$6.1 million) can be imposed when a data fiduciary fails to respect the rights of a validly exercised data principal.

6. Cross-border data transfer: The framework for cross-border data transfer under previous bills has been extensively discussed by stakeholders, with soft and hard data localization norms being the main push. DPDB is doing away with such localization criteria, which is a welcome move. It states that the Central Government may, after assessment of factors considered necessary, notify such jurisdictions to which personal data may be transferred on specified terms and conditions. This implies that the central government will have a free hand to determine the jurisdiction (either sufficient or insufficient) and to come up with provisions for data transfer. There is no mention of alternative options for cross-border transfers, such as corporate laws, standard contractual clauses and occasional cases of data transfers.

Currently, IT regulations require the data transferee to assess whether the data transferee will provide the same level of data protection as the personal data, and cross-border transfer is only allowed if there is consent or when this is necessary. Performance of such transfers. Executed contract with data principal. Therefore, DPDB seeks to further relax the existing restrictions and until such time transfer restrictions are in place, it appears that data fiduciaries and processors are free to transfer personal data outside India.

7. Exemptions: The DPDB considers broad exemptions from the state and adequate provisions for certain types of processing. Any restrictions on cross-border transfers may be notified later + any data confidentiality or SDF obligations (other than the need to take appropriate security measures to protect personal data) do not apply to the processing of personal data (i) for the enforcement of legal rights or claims, (ii) a judicial, quasi-judicial or other body in the exercise of judicial or quasi-judicial functions, (iii) for the prevention, detection and prevention of the commission of any crime or offence, or (iv) in the interest of the law of prosecution in relation to persons outside India, when processed pursuant to an agreement entered into between a foreigner and an Indian.

Additionally, the DPDB states that retention and storage limits do not apply to the state or its instrumentalities, meaning they can retain personal data for as long as they see fit. In addition, the central government reserves the right to exempt certain data fiduciaries from complying with the requirements of notification, data accuracy, retention limits and access plus verification rights, taking into account the volume and nature of data processed. Power to exempt any state body from (i) any or all parts of the DPDB on grounds of public interest => no criteria laid down to leave room for arbitrariness; and (ii) for research, archiving or statistical purposes, such processing does not result in a decision with respect to the data principal and is carried out in accordance with the criteria specified by DPBI.

Due to the far-reaching powers vested in the Central Government, there is a growing suspicion that the object and purpose of the DPDB as applied to the State may be substantially diluted through exemption notifications.

8. Data Protection Board of India: For the purposes of determining non-compliance with the DPDB, imposing penalties, issuing directions and performing such other functions as may be prescribed by the Central Government, the DPDB considers establishing the DPBI. DPBI aims to digitize its operations by design and will act as an independent regulator. The DPBI will have powers to conduct investigations, summon witnesses, examine evidence, handle complaints and impose fines. Therefore, it is important to have a proper balance in its structure so that it can function independently of the various organs of the state. But DPDB is keeping silent on these matters. It empowers the Central Government to determine the number, composition, procedure for selection of members, terms and conditions of appointment and removal of DPBI. This is a departure from the approach considered in previous bills. Without any insight into how the DPBI will be constituted, there is speculation that the DPBI will not be truly independent in the execution of its functions.

The salient features of the draft Digital Personal Data Protection Bill, 2022 are as under.

• The new bill seeks to establish a Data Protection Board (DPB) with the purpose to adjudicate on the matter of data protection.
• It also seeks to establish Data Protection Officers or independent data auditors by companies of large size with the objective to verify the compliance of the law by the institutions concerned.
• The data principals (whose data it is) were given additional rights with respect to their personal data. The data principals can ask the companies concerned to erase or delete their data.
• This bill laid an additional layer of obligation or duty on the companies with respect to data.
• Companies will not be obligated to keep user data that no longer serves a business purpose.
• Companies should not process personal data that could harm minors (children under 18 years of age).
• The new data protection law came out with the intention to provide an additional layer of security to the personal data of the citizens.
• The new bill also relaxes the norms related to cross-border data flow as this was a matter of concern for big tech companies.
• It also eases compliance requirements for start-ups.
• The bill also enumerates the conditions under which proposed legislation can be breached by the government agencies in case of exigencies like:
• Sovereignty and integrity of India,
• Security of the state,
• Friendly relations with foreign states,
• Maintenance of public order or preventing incitement to any cognisable offence.
• The right to portability that was provided in the previous version has been done away with.
• The ‘deemed consent’ has been introduced to cover non-consent-based grounds for processing data.
• There is recognition of alternate dispute resolution processes like arbitration.
• Hardware certification and algorithmic accountability are also eliminated in the new proposal.
• For the benefit of end users, a sort of deterrent has been provided for data leakages by imposing high penalties in case of a breach.
• Moreover, there is also a provision of consent for data sharing and only when permission is given by the end user, the data can be written.

III. Draft Digital Personal Data Protection Bill Concerns

Some of the concerns raised by experts about the proposed data protection bill are discussed below.

• The draft bill provides a blanket exemption to the security agencies with respect to complying with the provision of the law.
• Exemptions are granted on the basis of loosely defined terms like sovereignty and integrity of India, public order, and security of the state. This can be misused by the authorities.
• The earlier bill had an institution called the Data Protection Authority, it was supposed to be a statutory authority. But, the new bill envisages a board to be appointed by the government. The nature of the Data Protection Board is still not clear. It should be clarified whether it would be a judicial body or an administrative body.
• Relaxing the data localisation norms would lead to the misuse of data by foreign nationals.
• The draft will solve the issue of data security only in the primary stage and lacks provision for advanced and complex cases.
• Another challenge associated is the emergence of the metaverse and its probability to impact every aspect of life.
• A single framework for different sectors like e-commerce platforms, health techs, automobile companies, etc. is also a serious concern.

IV. Conclusion

Data is a new fuel in the modern world. There has been huge competition among Companies to gain hegemony over citizens’ data. This can seriously enable the companies to manipulate The free will of the citizens. Therefore, the time calls for proper protection and processing of the data Based on the prior information given to the user. The new data protection bill has to rise up to this Expectation. Once enacted into law, the DPDB is proposed to be implemented in a phased manner, and it would be appropriate for the government to provide adequate opportunities for organizations to improve existing data protection practices. The DPDB’s fundamental approach is to provide comprehensive principles for data protection, and in the process, MeitY has lifted elements from the data protection laws of jurisdictions such as Australia, Singapore and countries in the European Union. In its current form, the government believes that the proposed legislation provides ample scope for adaptation as the digital ecosystem evolves. While businesses and the startup community expressed optimism over the proposed provisions, critics have raised reservations about the lack of adequate checks and balances on executive powers and exemptions. But the devil is in the details, leaving it to the delegated legislation, ultimately, the true efficacy and effectiveness of the DPDB will have to stand the test of time.

*****

V. References

1. “Justice K.S.Puttaswamy(Retd) vs Union of India on 26 September, 2018” https://indiankanoon.org/doc/127517806/ accessed December 7, 2022

2. In Justice K.S. Puttaswamy (retd.) v. Union of India (2017), the Supreme Court upheld privacy as a fundamental right and highlighted the need for a dedicated privacy and data protection law. Thereafter, Justice Srikrishna Committee prepared a draft Personal Data Protection Bill, 2019, which was referred to a Joint Committee for review. In 2021, Joint Committee completed its review process and proposed the Data Protection Bill, 2021. In an earlier post, we provided our analysis on this bill, and the post can be accessed here – https://www.psalegal.com/indias-new-data-protection-bill-2021-overview-and-analysis-of-jpc-draft/

3. “Justice K.S.Puttaswamy(Retd) vs Union of India on 26 September, 2018” <https://indiankanoon.org/doc/127517806/> accessed December 7, 2022

4. “Kharak Singh vs the State of U. P. & Others on 18 December, 1962” <https://indiankanoon.org/doc/619152/> accessed December 7, 2022

5. Psa AT, “Digital Personal Data Protection Bill, 2022 – Analysis of the Key Features” (PSA Legal CounsellorsNovember 24, 2022) https://www.psalegal.com/digital-personal-data-protection-bill-2022-analysis-of-the-key-feature/ accessed December 6, 2022

6. Naavi, “Right to Erasure and Right to Forget.. Are They Same?” (NaaviNovember 24, 2022) https://www.naavi.org/wp/right-to-erasure-and-right-to-forget-are-they-same/ accessed December 6, 2022

7. “The Digital Personal Data Protection Bill, 2022: Ministry of Electronics and Information Technology, Government of India” (The Digital Personal Data Protection Bill, 2022 | Ministry of Electronics and Information Technology, Government of India) <https://www.meity.gov.in/content/digital-personal-data-protection-bill-2022> accessed December 7, 2022

*****