Parliamentary panel recommends greater accountability of social media platforms

The joint parliamentary committee on Personal Data Protection Bill has recommended that all social media platforms, which do not act as intermediaries to be treated as publishers, and be held responsible for the content from unverified accounts on their platforms.

The 30-member Joint Committee on Personal Data Protection Bill, 2019, headed by BJP MP P P Chaudhary, tabled its report in both the houses on Thursday. The report was tabled two years after it was first introduced in the Lok Sabha.

As per the report, the committee recommended that a mechanism may be devised in which social media platforms, which do not act as intermediaries, will be held responsible for the content from unverified accounts on their platforms.

"Once application for verification is submitted with necessary documents, the social media intermediaries must mandatorily verify the account," the committee said.

It has also suggested that no social media platform be allowed to operate in India unless the parent company handling the technology sets up an office in the country.

The committee noted that the Bill will be implemented in a phased manner to allow sufficient transition time for the stakeholders.

As per the report, the Data Protection Authority (DPA) commence operations within six months, registration of data fiduciaries start within nine months, and the appellate tribunal begin work not later than 12 months of the notification of the Act. Overall, it said, any and all provisions of the Bill be implemented within 24 months.

The committee also recommend that there should only be a single administration and regulatory body to avoid contradiction, confusion, and mismanagement while dealing with privacy and personal data as well as non-personal data.

In case of a data leak, the DPA should be notified within 72 hours of the company becoming aware of the breach. The DPA shall then "take into account the personal data breach and the severity of harm that may be caused" to the persons whose data has been leaked, and accordingly ask the company to report it and "take appropriate remedial measures".

If an entity does not take prompt action in case of a data breach, does not register with DPA, does not undertake impact assessment, conduct a data audit or appoint a data protection officer or DPO, it can be fined a maximum of ₹5 crore or 2% of its global revenue, whichever is higher.

Further, if a company violates the provisions of processing personal data or data of children, or transfers data outside India against the prescribed rules, it shall be fined up to Rs 15 crore or 4 per cent of its total worldwide turnover of the preceding financial year, whichever is higher.