Comprehension

There are some advantages of the Digital Personal Data Protection Act (DPDPA), 2023. For instance, for the first time, personal data belonging to or identifying children will have to be classified separately, with such data carrying a greater degree of security and privacy. The law also seeks to reduce the rate and impact of data breaches targeting Indian businesses. The Digital Personal Data Protection law, however, goes a step beyond by imposing penalties for cases where data is breached as a result of a lack of implementation of adequate security controls. However, it could be said that the law isn’t balanced, because it provides wide exemptions to the processing of personal data to the government. For instance, data can be processed “in the interest of prevention, detection, investigation or prosecution of any offence … in India.” These kinds of exemptions are dangerous as they stand to legitimise widespread and unwarranted collection of data under the guise that such collection and processing may ultimately be useful for preventing or deterring a crime.
Security agencies will have significant authority to collect and retain any data whatsoever, as is typically the case with exemptions relating to the maintenance of sovereignty, integrity, security of the state, preservation of public order, prevention of offences, and incitement to commit offences. The law also exempts processing of personal data held outside of India. The government is also exempt from being required to delete any data that it possesses, regardless of the purpose it may have been collected for, on the request of an individual, or by way of a prescribed data retention period.
The government is not bound by purpose limitations, allowing data collected for one specified purpose be used for a new, incompatible purpose, which stands in contrast to the regulations imposed on businesses.
[Extracted, with edits and revisions from “Digital Personal Data Protection Law Raises Questions About Consistency with Right to Privacy Ruling” published in The Wire dated 22-08-2023]

Question: 1

Mr. Lal was suffering from a rare disease and the data relating of that was collected by the government. Suppose the DPDPA, 2023 provides exemptions for the government relating to data deemed “necessary for research, archiving or statistical purposes” if the personal data is not to be used to take any decision specific to a data principal and such processing is carried on in accordance with such standards as may be prescribed.
Which of the following is most appropriate?

Updated On: Nov 7, 2024
  • The personal data of Mr. Lal can be preserved by the government till the research on rare disease is complete.
  • The data can only be used for taking any decision regarding Mr. Lal.
  • The personal data of Mr. Lal’s health conditions and his personal data can be preserved by; the private hospital forever and used for research by them without his consent.
  • All of the above
Hide Solution
collegedunia
Verified By Collegedunia

The Correct Option is A

Solution and Explanation

The government can preserve the data for research or statistical purposes, but it must ensure that the data is not used to make decisions specific to Mr. Lal and is handled as per prescribed standards.
The Correct Answer is option (A): The personal data of Mr. Lal can be preserved by the government till the research on rare disease is complete.

Was this answer helpful?
0
0
Question: 2

Suppose the DPDPA, 2023 provided exemption for the processing of personal data for the purpose of ascertaining the financial position of any person who has defaulted in payment of amount due on loan taken from a nationalised bank. Mr. X Commits a default in repayment of EMI of loan taken from a nationalized bank.

Updated On: Nov 7, 2024
  • The bank can demand access to and process the personal data of Mr. X relating to family history of ailments from which Mr. X or his family was suffering
  • The bank can process the personal data of Mr. X viz., the particulars of the family, wife, children, brothers etc.
  • The bank can process the data of Mr. X for the purpose of ascertaining the assets and liabilities of the defaulter.
  • All of the above.
Hide Solution
collegedunia
Verified By Collegedunia

The Correct Option is C

Solution and Explanation

The exemption applies to the processing of data solely to ascertain the financial position of the defaulter, not for personal or irrelevant information such as family health conditions.
The Correct Answer is option (C): The bank can process the data of Mr. X for the purpose of ascertaining the assets and liabilities of the defaulter.

Was this answer helpful?
0
0
Question: 3

Suppose Mr. Y, a citizen of India, is working in an MNC in New Zealand since 2021. The MNC has obtained personal details of the employee for the purpose of recovering the amount of indemnity bond if Mr. Y left the job within three years of joining.

Updated On: Nov 7, 2024
  • Mr. Y can file an application in India for protection of his digital personal data under the DPDPA if he leaves the job in September 2023, and returns to India.
  • Mr. Y, being a citizen of India, can claim protection against the MNC for misuse of his personal data even while serving in New Zealand
  • The DPDPA 2023 is not applicable since the data is held outside India
  • The DPDPA 2023, is not applicable since the data has been obtained before the enactment of DPDPA.
Hide Solution
collegedunia
Verified By Collegedunia

The Correct Option is C

Solution and Explanation

The DPDPA 2023 is applicable only if the data is processed or stored within India. Since the data is held by the MNC in New Zealand, the DPDPA would not apply in this case.
The Correct Answer is option (C): The DPDPA 2023 is not applicable since the data is held outside India

Was this answer helpful?
0
0
Question: 4

If personal data is defined as any data about an individual who is identifiable by or in relation to such data, which of the following shall be classified as the personal data?

Updated On: Nov 7, 2024
  • Name of the Person.
  • Full Residential Address.
  • Aadhar Number.
  • All of the Above.
Hide Solution
collegedunia
Verified By Collegedunia

The Correct Option is D

Solution and Explanation

All the listed data can uniquely identify an individual and thus fall under the category of personal data.
The Correct Answer is option (D): All of the Above.

Was this answer helpful?
0
0
Question: 5

In which of the following cases, the access to personal data shall be granted and the person whose data is accessed and processed cannot claim personal data protection?

Updated On: Nov 7, 2024
  • Mr. Z has committed many robberies and police wants to access his Aadhar details and fingerprint data for the purpose of tracing Mr. Z.
  • It is apprehended that a person identified as Mr. G would spread hatred among various communities which would lead to riots and Police intends to use the mobile number and other personal details of Mr. G for the purpose of preventing such crimes.
  • Both (A) and (B).
  • Neither (A) nor (B).
Hide Solution
collegedunia
Verified By Collegedunia

The Correct Option is C

Solution and Explanation

In cases where personal data is required for law enforcement purposes such as tracing criminals or preventing public disorder, data protection rights may be overridden.
The Correct Answer is option (C): Both (A) and (B).

Was this answer helpful?
0
0
Question: 6

Which of the following is correct?

Updated On: Nov 7, 2024
  • Personal data collected by a health service provider can be sold to an insurance agency by the service provider without the consent of the concerned person.
  • Personal data collected by the government can be used for whatever purpose.
  • Personal data collected by the insurance company can be sold to mobile companies for mobile marketing without the consent of the concerned person.
  • All of the above.
Hide Solution
collegedunia
Verified By Collegedunia

The Correct Option is B

Solution and Explanation

Under the Digital Personal Data Protection Act (DPDPA), 2023, certain exemptions allow the government to use personal data for specific purposes without the need for explicit consent.
The Correct Answer is option (B): Personal data collected by the government can be used for whatever purpose.

Was this answer helpful?
0
0

Top Questions on Current Legal Affairs

Questions Asked in CLAT exam

View More Questions