Personal Data Protection Bill: Sorely needed, but what of ground reality?

tech.hindustantimes.com:

A lot of excitement has been generated in the media about the new Personal Data Protection Bill being presented in the Parliament on Thursday. Some have called it a landmark bill, some have called it a proof of the government's commitment to the protection of the rights of the citizens and so on. However, it has been many years since the landmark Puttaswamy judgment by the Supreme Court declared privacy as an inalienable Fundamental right of all citizens was rendered. It took the government so many years to actually bring a bill to the Parliament after multiple attempts, which, for various reasons, were withdrawn or never considered to be put up for voting. Also, in the current version of the bill, a lot of underspecification leaves a lot of room for maneuvering by the government -- and in some cases the data protection board -- which as per the bill will be constituted by the government.

First of all, the composition of the data protection board is not specified, and it is unclear what the rules of the composition will be. If the board is not very strong, with representation from legal, policy, technology, computer science, law enforcement arena, and if the board is beholden to the government -- then it may not be very effective.

Second, the bill is not too specific about the compliance requirements of the organizations that collect the data of individuals. So, it is not clear on what basis the board will find the organizations liable -- except when a data breach is discovered in the dark web or somewhere on the Internet. Even then an organization may claim that the information did not necessarily leak from their systems, as many other systems may have the same citizen's data.

The third problem may be that the fines are no