Data Protection Board- Powers, Functions and Procedures
Section 18: Establishment of Board
18(1).
The Central Government has the authority to establish a statutory body.
The establishment will take effect from a date appointed by the Central Government.
The date of establishment must be notified through an official notification.
The body is to be established specifically for the purposes of this Act.
The body so established shall be called the Data Protection Board of India.
Once established, the Board will function in accordance with the provisions of this Act.
18(2).
The Board is constituted as a body corporate.
It is known by the name Data Protection Board of India.
The Board has perpetual succession and a common seal.
Subject to the provisions of this Act, the Board has the power to acquire property.
The Board may hold property, whether movable or immovable.
The Board has the power to dispose of property, both movable and immovable.
The Board has the power to enter into contracts.
The Board may sue in its own name and may also be sued in its own name.
18(3).
The Board will have a headquarters.
The location of the headquarters will be decided by the Central Government through a notification.
The headquarters will be established at the place so notified by the Central Government.
Section 19: Composition and qualifications for appointment of Chairperson and Members
19(1).
The Board is to be composed of its members.
The Board shall have a Chairperson.
In addition to the Chairperson, the Board shall have other Members.
The number of such other Members will be determined by the Central Government.
Such determination will be made through notification by the Central Government.
19(2).
The appointment of the Board’s leadership is carried out by the Central Government.
This includes the appointment of the Chairperson.
It also includes the appointment of the other Members.
The appointments must be made in the manner prescribed under the law.
The prescribed manner may include procedures, qualifications, or selection processes as laid down in the rules.
19(3).
The Chairperson and other Members must meet certain personal and professional standards.
They must be persons of ability , integrity and must have standing and credibility.
They must have special knowledge or practical experience.
Such knowledge or experience may be in one or more of the following fields:
Data governance.
Administration.
Implementation of laws relating to social protection.
Implementation of laws relating to consumer protection.
Dispute resolution.
Information and communication technology.
Digital economy.
Law.
Regulation.
Techno-regulation.
They may also have expertise in any other field.
Such other field must be one which, in the opinion of the Central Government, is useful to the Board.
Among the Chairperson and Members, at least one person must be an expert in the field of law.
Section 20: Salary allowances payable to and term of office
20(1).
The Chairperson and other Members are entitled to salary and allowances.
They are also governed by other terms and conditions of service.
These salary, allowances, and service conditions shall be prescribed under the law.
Once prescribed and applied at the time of appointment, these conditions are protected.
After appointment, the salary, allowances, or other service conditions cannot be varied.
Any variation after appointment must not be to the disadvantage of the Chairperson or Members.
20(2).
The Chairperson and other Members are appointed for a fixed tenure.
The term of office is two years.
The two-year term applies to both the Chairperson and the other Members.
After completion of the term, they are not automatically removed from consideration.
They are eligible for re-appointment.
Re-appointment may be made in accordance with the prescribed procedure.
Section 21: Disqualification for appointment and continuation as Chairperson and Members of Board
21(1).
Certain conditions make a person ineligible to be appointed as, or to continue as, the Chairperson or a Member.
Disqualification applies both at the stage of appointment and during continuance in office.
A person shall be disqualified if she:
(a).
The individual has been declared insolvent.
Such declaration must be made through a legal or judicial process.
Insolvency means the person is unable to pay her debts as they fall due.
Once adjudged insolvent, the person becomes disqualified from being appointed as, or continuing as, the Chairperson or a Member.
(b).
The individual has been convicted of an offence.
The conviction must be by a competent court.
The offence must involve moral turpitude.
Whether the offence involves moral turpitude or not is determined by the Central Government.
Such determination is based on the opinion of the Central Government.
A person convicted of such an offence is disqualified from being appointed as, or continuing as, the Chairperson or a Member.
(c).
The individual may suffer from a physical condition or a mental condition.
Such condition must result in incapacity.
The incapacity must be such that the individual is unable to perform the functions of a Member.
Once the individual becomes physically or mentally incapable of acting as a Member, she is disqualified from continuing in office.
(d).
The individual may acquire a financial interest or some other form of interest.
Such interest must be of a nature that creates a conflict.
The conflict must be likely to affect the individual’s functions.
The effect must be prejudicial to her duties as a Member.
If such a prejudicial interest exists, the individual becomes disqualified from continuing as a Member.
(e).
The individual may misuse or abuse her official position.
The abuse must be serious in nature.
The abuse must affect the manner in which the office is held.
Such abuse must make her continuance in office harmful.
The harm must be to the public interest.
If after such abuse , the continuance in office is prejudicial to the public interest, the individual stands disqualified.
21(2).
The Chairperson or a Member cannot be removed arbitrarily.
The power of removal lies with the Central Government.
Before removing the Chairperson or a Member, the Central Government must follow due process.
The concerned Chairperson or Member must be given an opportunity of being heard.
This opportunity allows her to present her case or explanation.
Removal can take place only after this requirement is satisfied.
Section 22: Resignation by Members and filling of vacancy
22(1).
The Chairperson or any other Member may choose to resign from her office.
The resignation must be made by giving notice in writing.
Such written notice must be addressed to the Central Government.
The resignation does not take effect immediately upon giving notice.
The resignation becomes effective on the earliest of the following events:
When the Central Government permits her to relinquish office.
Upon the expiry of three months from the date on which the Central Government receives the notice of resignation.
When a duly appointed successor enters upon her office.
Upon the expiry of the term of her office.
Whichever of these events occurs first determines the effective date of resignation.
22(2).
A vacancy may arise in the office of the Chairperson or any other Member.
Such vacancy may be caused by resignation , removal , death or any other reason.
Whenever such a vacancy arises, it must be filled.
The vacancy is to be filled through a fresh appointment.
The fresh appointment must be made in accordance with the provisions of this Act.
22(3).
After ceasing to hold office, a cooling-off period applies.
The cooling-off period lasts for one year from the date on which the Chairperson or a Member leaves office.
During this one-year period, employment cannot be accepted freely.
Acceptance of any employment during this period requires prior approval of the Central Government.
There is also a continuing disclosure obligation.
Any later acceptance of employment must be disclosed to the Central Government.
This disclosure is mandatory where the employment is with a Data Fiduciary.
The obligation applies specifically if proceedings had earlier been initiated by / before the Chairperson / Member against that Data Fiduciary.
The objective is to avoid conflicts of interest after demitting office.
Example:
Suppose A is a Member of the Data Protection Board of India.
During her tenure, proceedings were initiated before the Board against X Ltd which is a Data Fiduciary.
After completing her term, A ceases to hold office.
Within one year of leaving office, X Ltd. offers A a position as a compliance consultant.
A cannot accept this employment unless she obtains prior approval from the Central Government.
Even if the approval is granted and she accepts the job, A must disclose this acceptance of employment to the Central Government.
Section 23: Proceedings of Board
23(1).
The manner in which meetings are held must follow a prescribed procedure.
This includes the procedure for transacting business at such meetings.
Meetings may be conducted through physical means.
Meetings may also be conducted through digital means.
The Board must follow prescribed procedures for all such meetings.
The Board is also required to authenticate its actions.
This authentication applies to the Board’s orders and the Board’s directions.
It further applies to any instruments issued by the Board.
The manner of authentication must be as prescribed under the law.
23(2).
Actions or proceedings of the Board are protected from being challenged on certain technical grounds.
Such acts or proceedings will not be treated as invalid merely because of the following reasons:
(a).
The Board may, at times, have one or more vacant positions.
There may also be defects in how the Board is constituted.
Such vacancy or defect may arise for various administrative reasons.
The mere existence of a vacancy or a defect in the constitution does not invalidate the acts or proceedings of the Board.
The functioning of the Board continues despite such vacancy or defect.
(b).
A person may be acting as the Chairperson or as a Member of the Board.
There may be a defect or irregularity in the process of appointing such person.
Such defect may relate to procedure or technical compliance.
The mere existence of a defect in appointment does not invalidate the acts or proceedings of the Board.
The decisions of the Board remain effective despite such defect.
(c).
There may be some irregularity in the procedure followed by the Board.
Such irregularity may relate to how meetings are conducted or how decisions are taken.
Not every procedural irregularity has legal consequences.
The irregularity must be examined for its impact.
If the irregularity does not affect the merits of the case, it will be ignored.
In such situations, the acts or proceedings of the Board remain valid.
23(3).
A situation may arise where the Chairperson is unable to perform her functions.
Such inability may be due to absence , illness or due to any other cause.
During such period, the Chairperson’s functions must still be carried out.
The responsibility to perform these functions will fall on the senior-most Member.
The senior-most Member will discharge the functions of the Chairperson.
This arrangement continues until the Chairperson resumes her duties.
Section 24: Officers and employees of Board
The Board is empowered to appoint officers and employees.
Such appointments require prior approval of the Central Government.
The Board may appoint only those officers and employees it considers necessary.
The necessity must relate to efficient discharge of the Board’s functions.
The functions must be those assigned under the provisions of this Act.
The appointments are to be made on terms and conditions.
The terms and conditions of appointment and service must be as prescribed under the law.
Section 25: Members and officers to be Public Servants
The following members will be treated as public servants under Section 21 of the Indian Penal Code.
It includes:
Chairperson of the Board.
Members of the Board.
Officers and employees of the Board.
Provided these persons must be acting, or purporting to act, in pursuance of the provisions of this Act.
When so acting, they are deemed to be public servants.
This status attracts the legal duties, protections, and liabilities applicable to public servants under criminal law.
Section 26: Powers of Chairperson
Certain powers are vested in the Chairperson for the functioning of the Board.
These powers include the following:
(a).
The Chairperson has overall supervisory authority over the Board’s administration.
The Chairperson oversees how the Board functions on a day-to-day administrative level.
All administrative matters of the Board fall within this supervision.
The Chairperson can issue directions to make sure that the administrative work is carried out properly.
(b).
The Chairperson has the power to delegate preliminary scrutiny work.
This can be done by authorising an officer of the Board.
The authorised officer may examine communications received by the Board.
Such communications may include intimations , complaints , references , or other correspondence.
(c).
The Chairperson has the power to delegate functions of the Board.
This delegation may relate to any function of the Board.
The Chairperson may authorise an individual Member to perform such functions.
The Chairperson may also authorise a group of Members to perform such functions.
The Chairperson may permit an individual Member or a group of Members to conduct proceedings of the Board.
Proceedings may be allocated among different Members or groups of Members.
Such allocation helps in distributing workload and ensuring efficient disposal of matters.
Despite delegation, the functions remain those of the Board.
Section 27: Powers and function of the Board
27(1).
The Board shall exercise and perform the following powers and functions:
(a). Intimation of Personal Data Breach
An intimation of a personal data breach may be received by the Board.
Such intimation must be one given under Section 8(6).
Upon receipt of this intimation, certain actions may be taken.
Urgent remedial measures may be directed.
Urgent mitigation measures may also be directed.
These measures are aimed at addressing the personal data breach.
The Board may also conduct an inquiry into the personal data breach.
After such inquiry, the Board may impose a penalty.
The penalty must be imposed in accordance with the provisions of this Act.
(b). Initiation of Inquiry by the Board and Consequential Action
An inquiry by the Board may be initiated in different ways.
One such way is through a complaint made by a Data Principal.
The complaint may relate to:
A personal data breach.
A breach by a Data Fiduciary in observing/fulfilling its obligations.
Such obligations may concern the personal data of the Data Principal.
Exercise of the Data Principal’s rights under this Act.
An inquiry may also be initiated on a reference made by the Central Government & State Government.
The Board may also act in compliance with directions issued by a court.
In any of these situations, the Board may inquire into the alleged breach.
After inquiry, the Board may impose a penalty as provided under this Act.
(c). Inquiry Triggered by Complaint Against a Consent Manager
An inquiry by the Board may be triggered by a complaint.
The complaint must be made by a Data Principal.
The complaint must relate to a breach by a Consent Manager.
The breach must concern the Consent Manager’s obligations.
Such obligations must relate to the personal data of the Data Principal.
Upon receipt of such a complaint, the Board may conduct an inquiry.
After completing the inquiry, the Board may impose a penalty.
The penalty must be imposed in accordance with the provisions of this Act.
(d). Inquiry into Breach of Registration Conditions of a Consent Manager
An intimation may be received regarding a breach.
The breach must relate to a condition of registration of a Consent Manager.
Such intimation triggers action by the Board.
Upon receipt of the intimation, the Board may conduct an inquiry into the breach.
The inquiry is to examine whether the conditions of registration have been violated.
After completing the inquiry, the Board may impose a penalty.
The penalty must be imposed in accordance with the provisions of this Act.
(e). Inquiry Initiated on Reference by the Central Government Against an Intermediary
An inquiry by the Board may be initiated through a reference.
The reference must be made by the Central Government.
The reference must relate to a breach by an intermediary.
The breach must concern non-observance of the provisions Section 37(2).
Upon receiving such a reference, the Board may conduct an inquiry.
The inquiry examines whether the intermediary has failed to comply with the specified provision.
After completing the inquiry, the Board may impose a penalty.
The penalty must be imposed in accordance with the provisions of this Act.
27(2).
The Board is empowered to issue directions to ensure effective performance of its functions.
Such directions must relate to the functions assigned to the Board under this Act.
Before issuing any direction, the person concerned must be given an opportunity of being heard.
The Board must also record reasons in writing before issuing the direction.
The reasons must explain why such direction is considered necessary.
Once issued, the direction is binding and the person to whom the direction is issued is required to comply with it.
27(3).
A direction may have been issued earlier by the Board under 27(1) & 27(2).
A person who is affected by such direction may make a representation to the Board.
The Central Government may also make a reference to the Board in relation to such direction.
Upon receiving either a representation or a reference, the Board may reconsider the direction.
The Board has the power to:
Modify the direction.
Suspend the direction.
Withdraw the direction.
Cancel the direction.
While taking any of these actions, the Board may impose conditions.
The conditions are those that the Board considers appropriate.
The modification, suspension, withdrawal, or cancellation will take effect subject to such conditions.
Section 28: Procedure to be followed by the Board
28(1).
The Board is required to function as an independent body.
Its functioning must be free from external influence, as far as practicable.
The Board is also expected to operate as a digital office.
This digital functioning should be built into its design by default.
Complaints are to be received in a digital manner.
Allocation of complaints is to be carried out digitally.
Hearings in respect of complaints are to be conducted digitally.
Pronouncement of decisions is also to be done digitally.
To support this digital functioning, the Board must adopt appropriate techno-legal measures.
Such techno-legal measures must be in accordance with what is prescribed under the law.
28(2).
The Board may receive information in different forms.
Such receipt may be in the form of an intimation , complaint and may further be in the form of a reference.
The Board may also act upon directions referred to Section 27(1).
Upon receipt of any of the above, the Board is empowered to take action.
Any action taken must be in accordance with the provisions of this Act.
The action must also comply with the rules made under this Act.
28(3).
A preliminary assessment must be carried out by the Board.
The purpose of this assessment is to decide whether an inquiry should be initiated.
The Board must examine the material placed before it.
Based on this examination, the Board must determine whether sufficient grounds exist.
Only if sufficient grounds are found will the Board proceed with an inquiry.
28(4).
The Board may reach a conclusion after its preliminary assessment.
The conclusion may be that sufficient grounds to proceed with an inquiry do not exist.
In such a situation, the Board has the discretion to close the proceedings.
The decision to close the proceedings must not be arbitrary.
The Board is required to record its reasons in writing.
Recording reasons ensures transparency and accountability in the decision-making process.
28(5).
The Board may complete its preliminary assessment.
The assessment may reveal that sufficient grounds exist to proceed further.
In such a case, the Board may decide to initiate an inquiry.
The decision to proceed with an inquiry must be supported by reasons.
These reasons must be recorded in writing.
The inquiry may extend to the affairs of any person.
The purpose of the inquiry is to ascertain compliance.
Specifically, the inquiry seeks to determine whether the person is complying with, or has complied with, the provisions of this Act.
28(6).
Once an inquiry is initiated, it must be conducted fairly.
The inquiry must follow the principles of natural justice.
This includes giving the concerned person a fair opportunity to present her case.
The Board must act in a transparent and reasoned manner during the inquiry.
For every significant action taken during the inquiry, the Board must record reasons.
28(7).
For effectively discharging its functions under this Act, the Board is vested with certain powers.
These powers are the same as those exercised by a civil court under the Code of Civil Procedure, 1908.
The powers relate to the following matters:
(a).
The Board has the power to summon any person.
Summoning means requiring the person to appear before the Board.
The Board may also enforce the attendance of such person.
Once the person appears, the Board may examine her.
The examination may be conducted on oath.
Examination on oath means the person is legally bound to speak the truth.
(b).
The Board has the power to receive evidence.
Such evidence may be submitted in the form of an affidavit.
An affidavit is a written statement sworn to be true.
The Board may require discovery of documents.
Discovery involves identifying and disclosing relevant documents.
The Board may also require production of documents.
Production means formally submitting the documents before the Board.
(c).
The Board has the authority to carry out inspections.
Such inspection may relate to data , books , documents or registers.
The inspection may extend to books of account & also covers any other relevant document.
(d).
The powers of the Board are not limited only to those expressly listed.
Additional matters may be included within the Board’s powers.
Such additional matters must be specified by prescription through rules or regulations under the Act.
28(8).
Certain limits are placed on the powers of the Board and its officers.
They are not permitted to prevent access to any premises.
They are also not permitted to take custody of any equipment.
This restriction applies to any item or equipment.
The restriction operates where such action would adversely affect day-to-day functioning.
The protection applies to the day-to-day functioning of a person.
28(9).
The Board may need assistance to effectively carry out its functions under this section.
For this purpose, the Board may request the:
Services of a police officer.
Services of an officer of the Central Government.
Services of an officer of a State Government.
Such officers are required to assist the Board when called upon.
Compliance with the Board’s requisition is mandatory.
It is the duty of every such officer to provide the assistance sought by the Board.
28(10).
An inquiry may be ongoing before the Board.
During the course of such inquiry, the Board may assess the situation.
If the Board considers it necessary, it may take interim action.
Such interim action may be taken by issuing interim orders.
The decision to issue interim orders must not be arbitrary.
The Board is required to record its reasons in writing.
Before issuing any interim order, the person concerned must be given an opportunity of being heard.
28(11).
The inquiry conducted by the Board will eventually reach completion.
After completing the inquiry, the Board must give the person concerned an opportunity of being heard.
Once the hearing is concluded, the Board must take a decision.
The decision must be supported by reasons.
Such reasons must be recorded in writing.
After recording reasons, the Board may choose one of the following courses:
Close the proceedings.
Proceed further in accordance with Section 33.
28(12).
A complaint may be received by the Board.
At any stage after receipt of the complaint, the Board may examine its nature.
The Board may form an opinion about the complaint.
If the Board is of the view that the complaint is false, it may take action.
The Board may also take action if the complaint is frivolous.
In such cases, the Board has the discretion to respond.
The Board may issue a warning to the complainant.
Alternatively, the Board may impose costs on the complainant.
