The Joint Committee on the Personal Data Protection Bill, 2019 (“Committee”) released its report on December 16, 2021 (“Committee Report”). The current data protection framework in India provides no specific provisions for the protection of personal data of children. However, the existing Personal Data Protection Bill, 2019 (“PDP Bill”), which defines "child" to mean a person below 18 (eighteen) years of age, devotes a Chapter to the processing of personal data and sensitive personal data of children.
Chapter IV: Section 16 of the PDP Bill imposes additional obligations on data fiduciaries processing the personal data of children and mandates that, data fiduciary should process the personal data of a child in a manner that such processing protects the rights of and is in the best interests of the child. Under Sections 16 (2) and 16 (3) of the PDP Bill, the data fiduciary is obligated to verify the age of the child and obtain consent of his parent or guardian in a manner specified by the regulations formulated by the Data Protection Authority (“DPA”) under Section 94 of the PDP Bill.
Further, Section 16(4) of the PDP Bill provides for the classification of data fiduciary as a ‘guardian fiduciary’, if the former processes large volumes of personal data of children or operates commercial websites or online services that are directed at children. Section 16(5) of the PDP Bill also bars guardian fiduciaries from undertaking any processing of personal data which shall cause significant harm to the child and Section 16(6) of the PDP Bill states that regulations formulated by the DPA will also design a modified bar applicable on data fiduciary offering counselling or child protection services to a child from processing personal data which shall cause significant harm to the child. Section 16(7) of the PDP Bill also exempts guardian fiduciaries providing exclusive counseling or child protection services from obtaining consent of parent or guardian of the child under Section 16(2).
The Committee, after much deliberation on Chapter IV of the PDP Bill, included recommendations 5 and 38 in the Committee Report, in relation to Chapter IV of the PDP Bill. The same are as follows:
i) The data fiduciary is obliged to protect the personal data of children till the data principal child (“DPC”) attains majority. However, Chapter IV does not prescribe any specific procedure to be adopted by the data fiduciary when the DPC attains the age of majority to ensure continuity of their services. Therefore the Committee has recommended that:
ii) The Committee observed that although the title of Chapter IV and Section 16 of the PDP Bill mentions ‘sensitive personal data of children’, there is no other mention of such data anywhere else in the Chapter IV. Therefore, the Committee recommended that the expression ‘sensitive personal data’ be removed from the Chapter IV and Section 16 titles;
iii) The Committee recommended that the phrase, ‘and is in the best interests of, the child’ in Section 16(1) of the PDP Bill be omitted, as the phrase could dilute the purpose of the provision and pave way for manipulation by data fiduciary. The Committee is of the view that Section 16(1) of the PDP Bill reads better in the context of its objective, after such deletion, without giving any leeway of corruption to the data fiduciaries involved.
iv) The Committee is of the view that the classification of data fiduciaries as ‘guardian data fiduciary’ should be done away with by deleting Sections 16(4) and 16(7) of the PDP Bill and the explanation defining ‘guardian data fiduciary’ in its entirety, as these provisions could also pave way for the dilution of the objective of Section 16 of the PDP Bill, which is the protection of children in the processing of personal data.
Please find a copy of the Committee Report, here.
Contributed by Rabia Rahim (Associate).
Argus Knowledge Centre is now on WhatsApp! Send us a message on +91 8433523504 to receive updates from our Knowledge Centre.
11, 1st Floor, Free Press House
215, Nariman Point
Mumbai – 400021
9 – 10 Bahadur Shah Zafar Marg
Delhi – 110002
68 Nandidurga Road
Bengaluru – 560046
3rd Floor, 27B Camac Street
Kolkata – 700016
Ahmedabad – 380054
The rules of the Bar Council of India do not permit advocates to solicit work or advertise in any manner. This website has been created only for informational purposes and is not intended to constitute solicitation, invitation, advertisement or inducement of any sort whatsoever from us or any of our members to solicit any work in any manner. By clicking on 'Agree' below, you acknowledge and confirm the following:
a) there has been no solicitation, invitation, advertisement or inducement of any sort whatsoever from us or any of our members to solicit any work through this website;
b) you are desirous of obtaining further information about us on your own accord and for your use;
c) no information or material provided on this website is to be construed as a legal opinion and use of this website will not create any lawyer-client relationship;
d) while reasonable care has been taken in ensuring the accuracy of the contents of the website, Argus Partners shall not be responsible for the results of any actions taken on the basis of information provided in this website or for any error or omission in the website; and
e) in cases where the user has any legal issues, the user must seek independent legal advice.