The Digital Personal Data Protection Bill, 2022 has been granted approval by the Union Cabinet for presentation during the upcoming monsoon session of the Parliament.However, the Government did not reveal whether it made any changes based on the suggestions by other stakeholders after the draft was released in November 2022. This data protection bill is critical to the data economy of the country and will ensure users' privacy. The bill promises privacy to all Indians and protection to their data and puts obligation on data fiduciary to treat data in a certain way. However, when it comes to children, the stakes are even higher. Stakeholders made many suggestions to the draft and its various sections. One important part of the bill is Section 10 of Chapter 2 which deals with the 'Obligations of Data Fiduciary' when processing personal data of children.
Section(10)(1) The Data Fiduciary shall, before processing any personal data of a child, obtain verifiable parental consent in such manner as may be prescribed. For the purpose of this section, “parental consent” includes the consent of a lawful guardian, where applicable.
According to this section, data fiduciary shall obtain a 'verifiable parental consent' for children under the age of 18 years, which is inconsistent with the current digital ecosystem and also with global standards. In European Union's General Data Protection Regulation (GDPR), the age for which parental consent is required is flexible under 13 to 16 years. Under Children's Online Privacy Protection Act (COPPA), a US law to protect children's privacy makes it mandatory to have parental consent for children under the age of 13 years. The rationale behind this is that in this fast-paced digital world, children undergoing rapid psychological development. Hence, it is necessary to reduce the age limit for which parental consent is required.
The bill needs to adopt a graded approach because the control required for toddlers is different for teenagers, it can not be one size fits all. As children in different age groups need different kinds of protection. It may hinder the autonomous development of child and, more specifically, it can have unwanted consequences for girl child. Girls have less chances to get digital devices than boys and it is very likely that they would not get the parental consent to access certain information which is stigma or taboo in society but they want to explore for instance, as simple as menstruation.
Also, unlike France, India's new data protection bill does not talk about joint consent of parent and child, so that children can also have right over their data with enforcible parents oversight.
Section (10)(2) A Data Fiduciary shall not undertake such processing of personal data that is likely to cause harm to a child, as may be prescribed.
Under this new bill the definition of 'harm' is limited in scope while worldwide the definition of 'harm' is being expanded to make it more comprehensive, for example including psychological harm. In bill, it includes these four types of harms:-
a any bodily harm; or
b distortion or theft of identity; or
c harassment; or
d prevention of lawful gain or causation of significant loss
Earlier draft of bill also included a comprehensive list of types of harm including mental injury, but this draft presents a narrow mindset of policymakers.
The approval of the Digital Personal Data Protection Bill, 2022 by the Union Cabinet is a significant step for data privacy in India. However, the bill's provisions concerning children need further consideration. Requiring parental consent for every individual under the age of 18 disregards global standards and the evolving digital landscape. The definition of harm is limited and fails to include psychological harm. A graded approach is necessary to cater for the needs of children of different age groups. The bill should also include provisions for joint consent of parents and children. Comprehensive protection of children's data and autonomy is crucial to protect children within online space.
