Introduction:

The foundational principles of data consent and its withdrawal are central to the processing of personal data. Ensuring voluntary, well-informed, and affirmative consent, along with the freedom to retract consent, form the bedrock of data privacy. Furthermore, providing clear notifications and multilingual options enhances transparency and accessibility.

The DPDP Bill’s distinct approach of ‘legitimate uses’ underscores permissible data processing without consent, encompassing various essential scenarios. These principles collectively shape a comprehensive framework for safeguarding data subjects’ rights and interests in the digital era. This newsletter will deal shed light on how the DPDP Bill deals with the issue of consent and notice.

Active, Affirmative Consent:

Section 6 of the DPDP Bill, 2023 provides that a Data Fiduciary can process data when the data principal has given consent for a specified purpose unless the data principal has explicitly indicated that she does not consent to its processing. Consent forms the fundamental basis for the processing of personal data and must adhere to principles of being voluntary, specific, well-informed, unconditional, and unambiguous.

Notice:

A notice should be presented to the data subject, accompanying or preceding any request for consent. This notice should inform the data subject about their personal data and the intended purpose of processing, along with guidelines on exercising their rights to revoke consent [as per Section 6(4)], utilize the grievance resolution mechanism (given under Section 13 of the Bill), and lodge a complaint with the designated authority (i.e., the Data Protection Board of India) as per the specified procedure. In cases where the data subject has granted consent for processing their personal data before the legislation’s enactment, a similar notification must be provided at the earliest reasonable opportunity.

It is important to note that as per the Bill, the data subject should have the option to access the notice and consent form in English or any other language indicated in the Constitution of India’s Eighth Schedule (thus including widely spoken languages like Marathi, Hindi, Kannada, Tamil, Telugu, Bengali, Gujarati, etc.). This is given under Section 5 of the Bill.

Legitimate Uses:

The DPDP Bill has replaced the concept of ‘deemed consent,’ which was outlined in the 2022 draft bill for processing personal data under specific exceptional circumstances without the data subject’s consent. This is now termed as ‘legitimate uses’, under Section 7 of the Bill. These exceptions allow a data fiduciary to process personal data without securing explicit consent from the data subject. These encompass processing data for employment-related matters, addressing medical emergencies, fulfilling legal obligations or state-provided services or benefits, and adhering to Court judgments or orders.

Conclusion:

In conclusion, the DPDP Bill’s meticulous approach to consent and notice marks a significant stride in the realm of data protection. By emphasizing active, informed, and affirmative consent, alongside comprehensive notifications and multilingual accessibility, the framework establishes a robust foundation for safeguarding individuals’ data rights. The innovative concept of ‘legitimate uses’ further strikes a balance between privacy and necessity, allowing responsible data processing for vital scenarios. Together, these principles underscore India’s commitment to modernizing data privacy norms and ensuring a secure digital landscape for its citizens.