The Rajya Sabha on Wednesday passed the Digital Personal Data Protection Bill by a voice vote that was held after Opposition MPs staged a walkout as no discussion on the Manipur violence was being held.

The Bill was passed in the Lok Sabha on Monday and bill will become law once it receives the President’s assent.

This was Centre’s second attempt at framing the legislation for data protection, and comes after at least three previous iterations that were considered.

“It would have been good had the opposition discussed the bill today [in the House],” Union Minister for Electronics and Information Technology Ashwini Vaishnaw told the Upper House. “But no opposition leader or member is concerned over the rights of the citizens.”

Although Communist Party of India (Marxist) MP John Brittas and V Sivadasan had moved the motion to send the Bill to the select committee, it was not put to vote due to their absence.

The Bill lays down obligations on private and government entities around collection and processing of citizen’s data.

The Bill also requires data fiduciaries to obtain consent for processing a citizen’s personal data as a matter of routine and grants the individual the right to access, correct, erase, port, and restrict their data. It proposes a penalty of up to Rs 250 crore on entities for misusing or failing to protect digital data of individuals.

However, data privacy activists have raised concerns over some of the provisions of the law. According to Internet Freedom Foundation, data fiduciaries under the law do not have to inform users about the third-parties with whom their data will be shared, the duration for which their data will be stored and if their data will be transferred to other countries.

“In addition to providing wide exemptions to the state, the DPDPB [Digital Personal Data Protection Bill], 2023 also fails to put into place any meaningful safeguards against overbroad surveillance which weakens the right to privacy of Indian citizens,” the Internet Freedom Foundation said.

The Bill also has empowers the Union Government to block access to any information if it receives a direction from the Data Protection Board to restrict such information in the interest of the general public. The appointments to the Data Protection Board will also be made by the Union government.

Also read: Ten instances show how the digital data protection bill will undermine the RTI Act