Code: Section 28
(1) The Board shall function as an independent body and shall, as far as practicable,
function as a digital office, with the receipt of complaints and the allocation, hearing and
pronouncement of decisions in respect of the same being digital by design, and adopt such
techno-legal measures as may be prescribed.
(2) The Board may, on receipt of an intimation or complaint or reference or directions
as referred to in sub-section (1) of section 27, take action in accordance with the provisions
of this Act and the rules made thereunder.
(3) The Board shall determine whether there are sufficient grounds to proceed with an
inquiry.
(4) In case the Board determines that there are insufficient grounds, it may, for reasons
to be recorded in writing, close the proceedings.
(5) In case the Board determines that there are sufficient grounds to proceed with
inquiry, it may, for reasons to be recorded in writing, inquire into the affairs of any person for
ascertaining whether such person is complying with or has complied with the provisions of
this Act.
(6) The Board shall conduct such inquiry following the principles of natural justice
and shall record reasons for its actions during the course of such inquiry.
(7) For the purposes of discharging its functions under this Act, the Board shall have
the same powers as are vested in a civil court under the Code of Civil Procedure, 1908, in
respect of matters relating to—
(a) summoning and enforcing the attendance of any person and examining her
on oath;
(b) receiving evidence of affidavit requiring the discovery and production of
documents;
(c) inspecting any data, book, document, register, books of account or any
other document; and
(d) such other matters as may be prescribed.
(8) The Board or its officers shall not prevent access to any premises or take into
custody any equipment or any item that may adversely affect the day-to-day functioning of
a person.
(9) The Board may require the services of any police officer or any officer of the
Central Government or a State Government to assist it for the purposes of this section and
it shall be the duty of every such officer to comply with such requisition.
(10) During the course of the inquiry, if the Board considers it necessary, it may for
reasons to be recorded in writing, issue interim orders after giving the person concerned an
opportunity of being heard.
(11) On completion of the inquiry and after giving the person concerned an opportunity
of being heard, the Board may for reasons to be recorded in writing, either close the
proceedings or proceed in accordance with section 33.
(12) At any stage after receipt of a complaint, if the Board is of the opinion that the
complaint is false or frivolous, it may issue a warning or impose costs on the complainant.
Explanation of Section 28 DPDP
Section 28 of the Digital Personal Data Protection Act outlines the procedures the Board must follow to handle complaints, complaints verification, and subsequent actions in data protection violations. The section emphasizes the digital-first approach to ensure transparency, efficiency, and accessibility in the Board’s operations.
Key Aspects of the Procedure:
-
Digital Office:
The Board is to function primarily through digital means, from receiving complaints to issuing decisions. This ensures a tech-enabled, efficient process for handling personal data protection matters. -
Inquiry Process:
The Board determines if there is a valid reason to proceed with an inquiry into the alleged data protection violation. If the Board finds that there are insufficient grounds for inquiry, it may close the case with documented reasoning. -
Power to Investigate:
If the inquiry is valid, the Board can investigate the activities of any person to ensure compliance with the DPDP Act. -
Principles of Natural Justice:
The Board must uphold fairness by adhering to natural justice principles, ensuring all parties involved are heard and treated fairly. -
Court-Like Powers:
The Board has powers similar to those of a civil court, including summoning witnesses, requesting documents, and inspecting evidence. It can also issue interim orders during an inquiry. -
Action on False Complaints:
The Board can impose a penalty for false or frivolous complaints, discouraging misuse of the complaint mechanism.
Illustration
Example 1: Handling a Data Breach Complaint
A user files a complaint with the Board about a data breach. The Board assesses the complaint and decides that there are sufficient grounds for inquiry. The Board investigates, following a digital process, and holds hearings as per natural justice principles. After the inquiry, the Board may issue penalties or remedial actions against the organization involved.
Example 2: Investigation into Non-Compliance of a Data Fiduciary
The Board receives a referral from the government regarding a data fiduciary’s non-compliance with the DPDP Act. After conducting an inquiry, the Board determines that the fiduciary has violated the provisions and imposes a fine, based on the inquiry’s findings.
Common Questions and Answers on Section 28 DPDP
1. How does the Board handle complaints?
The Board uses a digital-first approach, where complaints are received, processed, and decided upon digitally, ensuring efficiency and transparency.
2. What happens if the Board finds no grounds for an inquiry?
If there are insufficient grounds, the Board will close the proceedings and document the reasons for such a decision.
3. What powers does the Board have during an inquiry?
The Board has powers similar to those of a civil court, including summoning individuals, examining evidence, and inspecting documents.
4. Can the Board impose interim orders?
Yes, the Board can issue interim orders during the inquiry process if it deems necessary and after giving the concerned parties an opportunity to be heard.
5. What happens if a complaint is found to be false or frivolous?
The Board may issue a warning or impose costs on the complainant if the complaint is determined to be false or frivolous.
Conclusion
Section 28 of the Digital Personal Data Protection Act sets out a detailed procedure for how the Data Protection Board should handle inquiries related to personal data protection. By incorporating digital tools and principles of natural justice, the Board ensures a streamlined, fair, and transparent process for addressing data privacy concerns.
For more details on the DPDP Act and to stay updated on the latest developments, visit ApniLaw.
