Government may turn off ‘continuous consent’ for apps in Digital India bill

The government may ask companies dealing in personal and non-personal data to obtain fresh consent from their users every time they change the terms and conditions, update their services and change the way user data is processed, sources in the know of the development told ET.

A clause to this effect may be introduced in the Digital India Bill, the draft of which is to be released soon for public consultation, officials said.

This would do away with the concept of ‘continuous consent’ where apps and services obtain permissions to process data from the users initially when the user signs up for the service and then continue to process the datasets based on the initial consent, a senior government official said.

“The current process is unfair to the user because companies keep changing the way they process data collected from the users when they sign up for the service. A user must be aware at all times how their data is processed,” the official said.

Also read | Digital India Bill draft bill likely to open for public consultation within 15 days

In a draft of the Digital Personal Data Protection (DPDP) Bill, the government has mandated that the personal data of a user, also called data principal, must be processed only for purposes for which the consent has been obtained or the consent is ‘deemed’ to have been obtained.

All such notices mandate that requests for processing of data should be accompanied by or preceded by “an itemised notice” containing the description of the personal data being collected and the ways in which the data can be used. Such notices, according to the draft DPDP Bill, must be in “clear and plain language”.

In the draft of the bill, the government has also proposed that in cases where the personal data of users have been collected before the implementation of the Act, the data fiduciaries or companies should give users an “itemised notice in a clear and plain language containing a description of personal data of the data principal collected by the data fiduciary and the purpose for which such personal data has been processed”.

The government has introduced the DPDP Bill in the ongoing monsoon session of the Parliament for discussion and passing. The bill is likely to be taken up for consideration soon, an official said. This will be the government’s second attempt at getting a privacy bill passed in Parliament.

An earlier version of the privacy bill called the Personal Data Protection Bill was withdrawn last year in August by the Union minister of electronics and information technology Ashwini Vaishnaw.

Following the withdrawal of the older version, the ministry of electronics and information technology had in November released an updated draft of the privacy bill, which was rechristened as the Digital Personal Data Protection (DPDP) Bill.

Earlier this month, the Union Cabinet approved the DPDP Bill, which paved the way for voluntary disclosures of data breaches by companies while also providing an alternate dispute resolution mechanism.

The draft of the bill released in November last year received more than 21,000 stakeholder comments. The IT ministry consulted some 100 organisations, of which 48 were non-government stakeholders, government officials had then said.

On November 16 last year, ET had first reported that the draft of the new data bill, which will not be called the Digital Personal Data Protection Bill, will allow the storage and transfer of data in “trusted” jurisdictions, which the government would define from time to time.