A. Introduction:
The Hon’ble Supreme Court recognised the right to privacy as a Fundamental Right, and digital privacy as its subset, in 2017 (hereinafter “Puttaswamy I”). Further, the Hon’ble Supreme Court in Puttaswamy I recognised the need for a legislation specifically dealing with data protection. At the time, the Hon’ble Supreme Court refrained from passing directions to enact such a law given that the Central Government had already constituted the Justice B.N Srikrishna Committee to make suggestions to the Central Government on the principles to be considered for data protection.
The idea of having a Digital Protection Authority, to use the nomenclature of the Justice Srikrishna Committee Report, is one that has survived a number of iterations and discussions in various committee reports, joint committee reports and other parts of the legislative process. The history of how and why it is important to have a body to oversee and enforce data protection legislation (by whatever name) is recorded in many other blog posts and news reports, including one by this institution.
As of 05.03.2025 the Ministry of Electronics and Information Technology (“MEITY”) stopped receiving feedback/comments on the Draft Digital Personal Data Protection Rules, 2025 (“Draft Rules”). Therefore, we may expect the Central Government to notify the Draft Rules sometime in the near future. The Draft Rules have generated a lot of discussion and it remains to be seen if the Central Government will change any part of the Draft Rules on account of the feedback it has received so far.
This situation provides us with an opportunity to reflect on what effect the notification of the Draft Rules will have in case they are notified without any changes. In particular, the proposed Data Protection Board of India (“the Board”) requires some scrutiny. The Board is one of the main features of the Digital Personal Data Protection Act, 2023 (“the Act”) and will have an important role to play in the protection and enforcement of the rights of Data Principals once the Draft Rules are notified. S. 28(1) of the Act states that the Board is an independent body which shall, as far as practicable function as a digital office and that the receipt of complaints, allocation, hearing and pronouncement of decisions will be digital by design. Further, under S. 28(7) of the Act the Board has been granted the power of a Civil Court, in fact under S. 28(9) of the Act the Board even has the power to seek police assistance. Nevertheless, there are numerous concerns regarding the Board. In particular, the composition of the Board, its finances, the tenure of its members and the remuneration of its members are concerns that deserve further investigation. In order to conduct this investigation let us consider a small thought experiment (a counterfactual or hypothetical - if the reader prefers).
B. A hypothetical test:
Imagine its January 2027, the Draft Rules were notified on 01.01.2026 and India, almost a full decade after the decision in Puttaswamy I, has in place a legislative and executive framework for the protection of personal data (see S. 2(h) of the Act) - specifically for digital personal data (see S. 2(n) of the Act). On this January morning you learn of a personal data breach (see the definition under S 2(u) of the Act) by a government entity involving your personal data. Some of the data forming the personal data breach includes your name, date of birth, sex, a picture of your face, place of residence.
In this scenario the Act requires a person to file a Complaint before the Board. Such a complaint is to be made under S. 27(1) read with S. 28(2) of the Act. The Act and Rules ostensibly provide considerable protection to Data Fiduciaries in the case of a Personal Data Breach. Further, Rule 7 casts a duty on Data Principals (in this case the Government entity) to inform the Board of inter alia; (i) measures implemented to mitigate the risk caused by the personal data breach, (ii) any findings regarding the person who caused the breach; and (iii) remedial measures taken to prevent recurrence of such breach.
Given that this hypothetical involves a government entity it is possible that the Board might dismiss the Complaint stating that under S. 28(4) of the Act there are insufficient grounds to proceed with an inquiry into your Complaint. The possible grounds for such a dismissal could be that a government entity is considered to be “State” under Article 12 of the Constitution of India or that the Central Government has notified that entity as an instrumentality of State in terms of S. 17(2)(a) of the Act. Therefore, the Board could well hold that the provisions of the Act cited in the Complaint do not apply to processing of personal data or the accidental disclosure thereof where such a Data Fiduciary is “State” or has been legitimately notified by the Central Government as an instrumentality of State in the interests of “sovereignty and integrity of India, security of the State, friendly relations with foreign States, maintenance of public order or preventing incitement to any cognizable offence relating to any of these …”.
Given this scenario, it is pertinent to examine whether or not the Board, as presently constituted, will be able to function as a genuinely independent body. A reading of Section 28(1) indicates that the intention is for the Board to function as an independent body. However, a closer reading of the Act and Draft Rules reveal that in terms of (i) appointments to the Board and (ii) finances of the Board; and (iii) remuneration and terms of members, the Board is not as independent as intended.
An independent regulator, in any sector, is of critical importance. Without genuinely independent regulators the chances of “regulatory capture” are likely to increase. Simply put, “regulatory capture” is a phenomenon where regulatory agencies that are designed to regulate industries for the public interest are ‘captured’ by the industries they are supposed to regulate. This can lead to regulators acting in ways that benefit the industries they are meant to regulate. This is detrimental to that sector of the economy and will lead to reduced consumer choice and freedom. Therefore, given how important an individual’s freedom is in the digital sphere - and the recognised need to protect an individual’s personal data it becomes all the more important for the Board to be genuinely independent.
In order for a regulatory body to be genuinely and functionally independent it must maintain an arm’s length relationship from interest groups - including the Government itself. The lesser the influence the higher the scope for functional autonomy of a regulator like the Board.
C. Appointments to the Board:
Upon a closer reading of the Act and Rules it becomes apparent you realise that the Central Government itself has the power to appoint the Chairperson of the Board and other members of the Board (see S. 19(2) of the Act). And that under Rule 16 of the Rules reveals that the Central Government alone constitutes a Search-cum-selection Committee in order to appoint the Chairperson and the other members of the Board. The Search-Cum-Selection Committee for appointment of the Chairperson and the Members of the board consisted entirely of Secretaries to the Government of India and “experts” appointed by the Central Government.
A reading of the provisions governing selection of the Chairperson and Members of the Board reveals that they are appointed by the Central Government on the basis of Search-Cum-Selection Committees composed of Central Government employees and two other “experts” appointed by the Central Government. The Central Government employees form a majority of the Search-Cum-Selection Committee for the Chairperson and half of the Search-Cum-Selection Committee for the other members of the Board. The Act and Draft Rules are not clear on who will appoint the two “experts” or how they will be appointed to the two Search-Cum-Selection Committees. The only detail regarding their appointment provided by the Act and Draft Rules is that they will have special knowledge or practical experience in a field which may be useful to the Board as members - in the opinion of the Central Government. Thus, even in the selection of these two “experts” discretion remains with the Central Government. The almost complete discretion of the Central Government employees in the appointment of the Board raises serious questions over how independent the Board will be when complaints are filed against the Central or State Governments. This can be contrasted with the procedure for appointment of members of the Competition Commission of India which is done by the Chief Justice of India, two Secretaries of the Government of India and two independent experts.
D. Financial Independence:
News reports indicate that MEITY has allocated Rs. 2 crore for the establishment of the Board. Though the Act and Draft Rules don’t specifically state so, it would appear that this budgetary allocation will come from the Consolidated Fund of India (hereinafter “CFI”). Financial independence is as important a factor for regulatory independence as the nature and fashion of the appointment of Board Members. The Board has been constituted as a Body Corporate with the ability to acquire, hold and dispose of moveable and immovable property (see Section 18(2) of the Act). That would indicate that the Board may have the ability to operate on a self-financing model independent from budgetary allocation via the CFI. For example, in case no funds are allocated from the CFI, the Board may be able to acquire moveable property through charging court/filing fees for Complaints.
However, recent experience with the Securities and Exchange Board of India (hereinafter “SEBI”) shows that even the ability to independently raise and hold funds by statutory sector regulators can be compromised. Notably, the Central Government amended the parent statute for Securities and Exchange Board of India (hereinafter “SEBI”) such that SEBI was obliged to transfer 75% of its surplus funds to the CFI. In light of these developments with other sector regulators it remains to be seen whether members of the Board, who have been appointed by the Central Government, will be able to resist attempts by the Central Government to control or limit the ability of the Board to hold surplus funds generated by its own sources in the future - let alone funds allocated to the Board from the CFI by MEITY. In fact, the manner in which the Central Government amended the salaries, allowances and terms of service of TRAI officials after TRAI issued its for Tariff Order in 1999 is cited as an example of interference in the functional independence of TRAI by the Central Government.
D. Members remuneration and terms:
The third pillar to protect regulatory independence also appears to be compromised when looking at the functioning of the Board. It is noteworthy that the Chairperson and Members only serve a two year term (See S. 20(2) of the Act) and that the Chairperson and Members are not entitled to a pension or gratuity for the services rendered to the Board (see Entry 3 to the Fifth Schedule to the Draft Rules). This means that members of the Board will not be entitled to serve for a period longer than the tenure of the elected parliament. This is contrary to the principle of ‘credible commitment’. Credible commitment to a particular regulatory objective or aim generally arises when the delegation of authority to an agency (such as the Board) is insulated from election cycles and political changes. Further, in terms of S. 20(1) of the Act the salary and other allowances of the Board Members will be prescribed by the Central Government. This might lead some readers to wonder if the Central Government pays the salaries of the Board then will they be prejudicially affected and pre-disposed towards not passing any order against a Government entity? Perhaps, the answer to this apparent conflict is discoverable within the Act itself. Interestingly, Section 21(1)(d) of the Act requires a person to be disqualified from the Board if they have a financial or other interest which is likely to prejudicially affect their functions as a member? It could be argued that, applying the test laid out in Section 21(1)(d), the Board members should not be permitted to hear any Complaint against the State or an instrumentality of the State? It is interesting that Section 20(1) of the Act contains a provision akin to Section 14(2) of the Competition Act, 2002. Both provisions specifically bar the variation of salary, allowances and conditions of service of the Chairperson and Members of their respective regulatory bodies to their disadvantage after their appointment. However, the important difference is that the Chairperson and members of the Competition Commission of India hold their tenure for a period of five years whereas the Chairperson and members of the Board only have a two year tenure, Without having at least a five year tenure the protection and independence granted to the Chairperson and members of the Board under Section 20(1) of the Act is considerably negated. Further, a reading of Rule 20 with the 5th and 6th Schedules to the Rules reveals the inability of the Board to prescribe even the salary and allowances for the officers and employees of the Board. In fact, the Sixth Schedule limits the Board to only appointing, on deputation, officers or employees from the Central or State Government or other autonomous bodies under the overall control of the Central or State Government, a statutory body or a Public Sector Undertaking. In fact Rule 20 states that even the appointment of those officers and employees requires the previous approval of the Central Government. These provisions will only limit the functional independence of the Board.
E. Conclusion:
On a review of the Act and Draft Rules, what emerges is that the Chairperson and Members of the Board are appointed by officers of the Central Government, receive a salary paid by the Central Government, only serve for two years before they have to be reappointed and don't receive a pension if they are not reappointed. Further, even though the Board has the power to raise and hold its own property - at present its primary source of funds is budgetary allocation by MEITY from the CFI. Further, even the officers and employees of the Board must be appointed only with previous approval of the Central Government and have to be recruited on deputation
In light of the above, it may be too much to ask the Board members to decline to hear complaints against the State or an instrumentality of the State. However, if the Board is to function within the spirit of avoiding a conflict of interest it is now time to rethink the composition of the selection-cum-search committees for appointments to the Board together with the Boards financial dependence on the Central Government and its members term constraints - amongst the other issues affecting the independence of the Board. Entry 8 of the Fifth Schedule to the Draft Rules states that “the Chairperson and every other Member shall ensure the absence of conflict of interest in the performance of the functions of her office and shall not have any financial or other such interests as are likely to prejudicially affect the performance of the functions of such office”. The spirit of this entry should be the guiding point for changes to the way in which the Board is appointed, functions and operates.
As the Board is compromised on all three of the traditional legs governing regulatory independence, this author wonders if the inherent conflicts of interest in the constitution and functioning of the Board means that the Government is likely to be a judge in its own cause..
