Recommendations made by a parliamentary committee on India’s Personal Data Protection (PDP) Bill might lead to a higher compliance burden on startups, industry body Internet & Mobile Association of India (IAMAI) said Friday.

The IAMAI in a statement suggested the formation of an expert group to be set up to study the impact of the recommendations of the Joint Parliamentary Committee on start-ups.

The Joint Parliamentary Committee, studying the draft Personal Data Protection Bill, 2019 and headed by MP PP Chaudhary, had submitted its report to the Indian Parliament on Thursday.

According to an IAMAI statement, “Prima facie, it seems that the draft that was put out in 2019 after the widest possible consultations have changed fundamentally, including the title of the bill from Personal Data Protection Bill to Data Protection Bill. Certain other deviations such as the recommendations that social media intermediaries could become publishers in certain circumstances and a few aspects of data localisation norms change the original structure of the bill substantially.”

IAMAI said that the report currently encompasses non-personal data within the personal data protection bill, which is contrary to the recommendations of the expert committee appointed by Ministry of Electronics and IT (Meity) to develop a framework for non-personal data governance.

The parliamentary panel in its final report — drafted after lot of bickering amongst committee members — has said that considering there’s an immediate need to regulate social media intermediaries, these designated intermediaries may be working as publishers of the content in many situations, owing to the fact that “they have the ability to select the receiver of the content and also exercise control over the access to any such content hosted by them”. Therefore, a mechanism must be devised for their regulation.

“The Committee have, therefore, recommended that all social media platforms, which do not act as intermediaries, should be treated as publishers and be held accountable for the content they host. A mechanism may be devised in which social media platforms, which do not act as intermediaries, will be held responsible for the content from unverified accounts on their platforms,” the parliamentary panel has observed.

IAMAI further said that the requirement on the part of the Data Protection Authority (DPA) to consult the federal government before issuing any approvals or decisions on cross-border data flows would create an incredibly slow and cumbersome process for decisions, and would mitigate the autonomy and efficiency of a specialised body such as the DPA.

The industry organisation also raised its concerns on the recommendation of imposing age restrictions of 18 years on certain services that will exclude an important demographic from the digital ecosystem and will contradict most data regimes that create enabling provisions for 13-18 years.

It, however, expressed the belief that the government will continue the transparent and consultative ethos under which the earlier draft bill was developed and urged further deliberations on the report.

Certain provisions in the report such as the new requirement for hardware/device testing need to be discussed with the industry as the outcomes of such a mechanism are not clear given that data fiduciary is already legally accountable for complying with the law, it said.

The bill will impinge upon the IP rights of the companies as part of the new requirements on data portability and algorithmic transparency. These objectives can be achieved without compromising on trade secrets, IAMAI explained.