By Kamesh Shekar
The formation of the Data Protection Board (DPB), a pivotal adjudicatory body under the Digital Personal Data Protection (DPDP) Act, 2023, will be the cornerstone of India’s data governance efforts. The DPB will be essential in determining relationships with other sectoral regulators such as the Reserve Bank of India (RBI) and the Telecom Regulatory Authority of India while adjudicating matters. Nevertheless, establishing a DPB is essential for setting a precedence on matters related to India’s data protection to secure informational privacy of individuals. As forthcoming Digital Personal Data Protection Protection rules will delineate the procedure for appointing members and the chairperson of the DPB, it is essential for the rules to be guided by the best practices followed internationally and by other Indian regulators in order to ensure an effective board is established.
Constitution of selection committee
The selection committee should comprise a combination of the judiciary, executive, and legislative panels to ensure a balanced and effective constitution of the DPB. Besides, having a combination of the three organs of the government would aid in accounting for different perspectives. For instance, as the DPB will be an adjudicatory body, having a judiciary in the selection committee could help find an individual who could interpret and apply the law depending on the specificities of individual cases. Similarly, having legislative members as part of the selection committee would bring accountability to the process of selecting members and a chairperson.
Therefore, it is essential to have a representation of retired/sitting Supreme Court judges, practicing lawyers, etc. Secondly, it should include the opposition party leader (similar to the Right to Information Act), chairperson of the Parliamentary Standing Committee on Information Technology, other relevant standing committee chairpersons, and members elected from both lower and upper houses of Parliament (similar to the structure followed in France). Thirdly, cabinet secretary, secretaries of the Ministry of Electronics and Information Technology, and department of legal affairs, etc. (similar to the Personal Data Protection Bill, 2019); and finally, academic, civil society members, business representatives, and industry experts nominated by the President of India.
Composition of the board
While the DPDP Act, 2023, discusses the qualification of the members and chairperson, the board must be expanded significantly to include full-time as well as part-time members like other regulators in India to carry out its functions. The full-time members must bring in diversity in terms of representation, including expertise on law, technology, cybersecurity expertise, industry, legal enforcement, and on economic, cultural, and sociological issues. Provision for having part-time members will allow the DPB to engage with a diverse range of experts on a short term depending on the needs. Various jurisdictions, including Japan and South Africa, follow the provision for part-time members. The qualifications of part-time members must be kept broad so that the board can extract much from this and include retired parliamentarians, business representatives, industry experts, researchers, and civil society members.
Appointment of officers and employees of DPB
To enhance the capacity of the DPB, we propose that the rules provide a tiered structural design for enforcing data protection and privacy. The proposed tiered approach is a combination of models followed by jurisdictions such as Brazil, Japan, South Africa, and other Indian regulators. A tiered model would clarify structuring the DPB using a bottom-up approach where tasks and responsibilities are mapped and partially calibrated.
Similar to Brazil’s National Council for Personal Data Protection and Privacy, the DPB must have an advisory expert council as part of the tiered structure. This council would aid the central government and the board in delivering their responsibilities. Like the Centre for Advanced Financial Research and Learning, an independent research institution promoted by the RBI, the DPB too should have a research wing that aids the advisory expert council with its functions. The DPB must also have sufficient permanent and temporary office staff to assist functions of the proposed tiered model. To have a qualified staff, the DPB can borrow learnings from the Italian style of competitive public examination to fill positions, where it can also adopt a civil servant recruitment model. Moreover, there should be a consumer dispute redress wing as part of the tiered structure, where individuals can raise their complaints unresolved by data fiduciaries.
The author is the senior programme manager, privacy, data governance and AI, The Dialogue.
Disclaimer: Views expressed are personal and do not reflect the official position or policy of Financial Express Online. Reproducing this content without permission is prohibited.