Cabinet approval to be sought soon By Sarah Hannan The proposed Data Protection Bill has been cleared and is to be presented to Cabinet for approval soon, The Sunday Morning learnt. A parliamentary committee had last week discussed aspects of the Bill which will now be submitted to Cabinet for approval. Former Minister of Digital Infrastructure and Information Technology Ajith P. Perera, who was part of the committee, told The Sunday Morning that the Attorney General’s (AG) Department approved the final draft recently after clarifying some concerns and that the draft bill is now with the Ministry of Defence. He said that the Defence Ministry will present a cabinet paper requesting for the approval to proceed with the bill. With all stakeholders agreeing with the contents of the bill, Perera stated that there should be no further reasons to delay the passing of this bill. Once the Data Protection Bill is enacted, it will allow institutions such as banks, telecom operators, hospitals, and other personal data aggregating and processing entities to collect personal data only for specified purposes and not for any other purpose that is incompatible with the said purposes. However, processing data in public interest, scientific or historical research will not be considered incompatible. Personal data has to be processed in a manner to ensure appropriate security, including protection against accidental loss, destruction, or damage. Under the bill, individuals would have the right to withdraw his or her consent given to controllers and the right to rectify the data without undue delay. In addition to this, the “data subjects”, as the people are referred to, have been given the right to object to the processing of their data. These rights of data subjects can be exercised directly by the individuals with the controllers, who are required to respond within a defined time period and are obliged to give reasons for refusing to meet the request or reasons why the controllers would refrain from further processing said data. The individual has a right to appeal against the decision of the controllers to the Data Protection Authority. Although the original framework had provisions for the mandatory registration of controllers, this requirement has been removed in the latest version. Instead, the Drafting Committee has deliberated and introduced specific and comprehensive transparency and accountability obligations on controllers. The accountability obligations would require controllers to implement internal controls and procedures known as a data protection management programme, in order to demonstrate how it implements the data protection obligations imposed under the act, once the bill is passed. The legislation also prohibits controllers from processing personal data and sending unsolicited messages, unless the respective individuals have given express consent. Provisions have also been included to deal with relationships between controllers and third parties that process personal data on their behalf.