86. Power of Central Government to issue directions
(1) The Central Government may, from time to time, issue to the
Authority such directions as it may think necessary in the interest of
the sovereignty and integrity of India, the security of the State,
friendly relations with foreign States or public order.
(2) Without prejudice to the foregoing provisions of this Act, the
Authority shall, in exercise of its powers or the performance of its
functions under this Act, be bound by such directions on questions of
policy as the Central Government may give in writing to it from time to
time:
Provided that the Authority shall, as far as practicable, be given an opportunity to express its views before any direction is given under this sub-section.
(3) The decision of the Central Government whether a question is one of policy or not shall be final.
87. Members, etc., to be public servants.
The Chairperson, Members, officers and employees of the Authority and
the Appellate Tribunal shall be deemed, when acting or purporting to act
in pursuance of any of the provisions of this Act, to be public servants
within the meaning of section 21 of the Indian Penal Code.
88. Protection of action taken in good faith
No suit, prosecution or other legal proceedings shall lie against the
Authority or its Chairperson, member, employee or officer for anything
which is done in good faith or intended to be done under this Act, or
the rules prescribed, or the regulations specified thereunder.
89. Exemption from tax on income
Notwithstanding anything contained in the Income Tax Act, 1961 or any
other enactment for the time being in force relating to tax on income,
profits or gains, as the case may be, the Authority shall not be liable
to pay income tax or any other tax in respect of its income, profits or
gains derived.
90. Delegation
The Authority may, by general or special order in writing delegate to
any member or officer of the Authority subject to such conditions, if
any, as may be specified in the order, such of its powers and functions
under this Act, except the powers under section 94, as it may deem
necessary.
91. Act to promote framing of policies for digital economy, etc
(1) Nothing in this Act shall prevent the Central Government from
framing of any policy for the digital economy, including measures for
its growth, security, integrity, prevention of misuse, insofar as such
policy do not govern personal data.
(2) The Central Government may, in consultation with the Authority,
direct any data fiduciary or data processor to provide any personal data
anonymised or other non-personal
data to enable better targeting of delivery of services or formulation
of evidence-based policies by the Central Government, in such manner as
may be prescribed.
Explanation.—For the purposes of this sub-section, the expression
"non-personal data" means the data other than personal data.
(3) The Central Government shall disclose annually the directions, made
by it under
sub-section (2), in such form as may be prescribed.
92.
Bar
on
processing
certain
forms
of
biometric
data.
No data fiduciary shall process such biometric data as may be notified by the Central Government, unless such processing is permitted by law.
93. Power to make rules
(1) The Central Government may, by notification, make rules to carry out
the provisions of this Act.
(2) In particular, and without prejudice to the generality of the
foregoing power, such rules may provide for all or any of the following
matters, namely:—
(a) any other categories of sensitive personal data under section 15;
(b) other factors to be taken into consideration under clause (d) of
sub-section (3) of section 16;
(c) the form and manner in which an application may be made to exercise
the right under sub-section (2), and the manner of review of the order
passed by the Adjudicating Officer under sub-section (4) of section 20;
(d) the methods of voluntary identification to identify users of social
media under sub-section (3) and the identifying mark of verification of
a voluntarily verified user under sub-section (4) of section 28;
(e) the manner in which a complaint may be filed under sub-section (4)
of section 32;
(f) the entity or class of entity in a country, or international
organisations to which transfers may be permitted under clause (b) of
sub-section (1) of section 34;
(g) the place of head office of the Authority under sub-section (3) of
section 41; (h) procedure to be followed by the selection committee
under sub-section (3) of section 42;
(i) the salaries and allowances payable to, and other terms and
conditions of service of the Chairperson and the Members of the
Authority under sub-section (2) of
section 43;
(j) the time and place for, and the rules and procedures in regard to,
transaction of business at the meetings of the Authority under
sub-section (1) of section 46;
(k) other functions of the Authority under clause (o) of sub-section (2)
of section 49;
(l) the procedure of issuance of a code of practice under sub-section
(4), the manner in which the Authority may review, modify or revoke a
code of practice under sub-section (7), of section 50;
(m) other matters under clause (e) of sub-section (8) of section 53, in
respect of which the Authority shall have powers;
(n) the number of Adjudicating Officers, manner and terms of their
appointment, their jurisdiction and other requirements under sub-section
(2) of section 62;
(o) the manner in which the Adjudicating Officer shall conduct an
inquiry under sub-section (1) of section 63;
(p) the form and manner of making a complaint under sub-section (2), and
the procedure for hearing of a complaint under sub-section (8) of section
64;
(q) the manner of appointment, term of office, salaries and allowances,
resignation, removal and the other terms and conditions of service of
the Chairperson and any member of the Appellate Tribunal under
sub-section (2) of section 68;
(r) the procedure of filling of vacancies in the Appellate Tribunal
under section 69;
(s) the salaries and allowances and other conditions of service of the
officers and employees of the Appellate Tribunal under sub-section (3)
of section 70;
(t) the form, manner and fee for filing an appeal or application, as the
case may be, with the Appellate Tribunal under sub-section (1) of
section 72;
(u) other matters under clause (i) of sub-section (2) of section 73 in
respect of powers of the Appellate Tribunal;
(v) the form of accounts, other relevant records and annual statement of
accounts under sub-section (1), the intervals at which the accounts of
the Authority shall be audited under sub-section (2) of section 80;
(w) the time in which and the form and manner in which the returns,
statements, and particulars are to be furnished to the Central Government under
sub-section (1), and annual report under sub-section (2) of section 81;
(x) the manner in which the Central Government may issue a direction,
including the specific purposes for which data is sought under
sub-section (2) and the form of disclosure of such directions under
sub-section (3) of section 91; or 30
( y) any other matter which is require to be, or may be, prescribed, or
in respect of which provision is to be made, by rules.
94. Power to make regulations.
(1) The Authority may, by notification, make regulations consistent with
this Act and the rules made there under to carry out the provisions of
this Act.
(2) In particular and without prejudice to the generality of the
foregoing power, such
regulations may provide for all or any of the following matters,
namely:—
(a) information required to be provided by the data fiduciary to the
data principal in its notice under clause (n) of sub-section (1) of
section 7;
(b) manner in which the personal data retained by the data fiduciary
must be deleted under sub-section (4) of section 9;
(c) the safeguards for protecting the rights of data principals under
sub-section (3) of section 14;
(d) the additional safeguards or restrictions under sub-section (2) of section 15;
(e) the manner of obtaining consent of the parent or
guardian of a child under
sub-section (2), the manner of verification of age of a child under
sub-section (3),
application of provision in modified form to data fiduciaries offering
counselling or child protection services under sub-section (6) of
section 16;
(f) the period within which a data fiduciary must acknowledge the
receipt of request under sub-section (1), the fee to be charged under
sub-section (2), the period
within which request is to be complied with under sub-section (3), and
the manner and the period within which a data principal may file a
complaint under sub-section (4) of section 21;
(g) the manner for submission of privacy by design policy under
sub-section (2)
of section 22;
(h) the manner and the technical, operation, financial and other
conditions for registration of the consent manager and its compliance
under sub-section (5) of section 23;
(i) the manner of registration of significant data fiduciaries under
sub-section (2) of section 26;
(j) the circumstances or classes of data fiduciaries or processing
operations where data protection impact assessments shall be mandatory
and instances where data auditor shall be appointed under sub-section
(2), and the manner in which data protection officer shall review the
data protection impact assessment and submit to the Authority under
sub-section (4) of section 27;
(k) the form and manner for maintaining the records, and any other
aspect of processing for which records shall be maintained under
sub-section (1) of section 28;
(l) the other factors to be taken into consideration under clause (g) of
sub-section (2); the form and procedure for conducting audits under
sub-section (3); the manner of registration of auditors under
sub-section (4); criteria on the basis of
which rating in the form of a data trust score may be assigned to a data
fiduciary under
sub-section (6) of section 29;
(m) the qualification and experience of a data protection officer under
sub-section (1) of section 30;
(n) the period within which transfer of personal data shall be notified
to the
Authority under sub-section (3) of section 34;
(o) the provisions of the Act and the class of research, archival or
statistical purposes which may be exempted under section 38;
(p) the remuneration, salary or allowances and other terms and
conditions of service of such officers, employees, consultants and
experts under sub-section (2) of section 48;
(q) the code of practice under sub-section (1) of section 50;
(r) the form and manner for providing information to the Authority by
the data fiduciary under sub-section (3) of section 52;
(s) any other matter which is required to be, or may be specified, or in
respect of
which provision is to be or may be made by regulations.
95. Rules and regulations to be laid before Parliament.
Every rule and regulation made under this Act and notification issued
under sub-section (4) of section 67 shall be laid, as soon as may be
after it is made, before each House of Parliament, while it is in
session, for a total period of thirty days which may be comprised in one
session or in two or more successive sessions, and if, before the expiry
of the session immediately following the session or the successive
sessions aforesaid, both Houses agree in
making any modification in the rule or regulation or notification or
both Houses agree that the rule or regulation or notification should not
be made, the rule or regulation or notification shall thereafter have
effect only in such modified form or be of no effect, as the case may
be; so, however, that any such modification or annulment shall be
without prejudice to the validity of anything previously done under that
rule or regulation or notification.
96. Overriding effect of this Act.
Save as otherwise provided in this Act, the provisions of this Act shall
have effect notwithstanding anything inconsistent therewith any other
law for the time being in force or any instrument having effect by
virtue of any law other than this Act.
97. Power to remove difficulties
(1) If any difficulty arises in giving effect to the provisions of this
Act, the Central Government may, by order, published in the Official
Gazette, make such provisions not inconsistent with the provisions of
this Act as may appear to be necessary or expedient for removing the
difficulty:
Provided that no such order shall be made under this section after the
expiry of five years from the commencement of this Act.
(2) Every order made under this section shall be laid, as soon as may be
after it is made,
before each House of Parliament.
98. Amendment of Act 21 of 2000.
The Information Technology Act, 2000 shall be amended in the manner
specified in the Schedule to this Act.