Parental consent now mandatory for children’s data use

Central government releases draft of Digital Personal Data Protection Rules, which do not mention any penal action for violations

New Delhi: The government has released the long-awaited draft of Digital Personal Data Protection Rules, which do not mention any penal action for violations.

The draft rules have been issued after Parliament approved the Digital Data Protection Bill 2023 about 14 months back.

---

“Draft of rules proposed to be made by the Central government in exercise of the powers conferred by sub-sections (1) and (2) of section 40 of the Digital Personal Data Protection Act, 2023 (22 of 2023), on or after the date of coming into force of the Act, are hereby published for the information of all persons likely to be affected thereby,” the draft notification said.

The rules have spelt out a mechanism for obtaining explicit consent from individuals and mandate parental consent for children to use their data in any form.

The Digital Personal Data Protection (DPDP) Act 2023 describes entities collecting and using personal data as data fiduciaries. “A Data Fiduciary shall adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child,” the draft rule said.

As per the draft, the data fiduciary will have to carry out due diligence to check that the individual identifying herself as the parent of a child is an adult and identifiable if required in connection with compliance with any law in force in India.

According to the draft rules, data fiduciaries will have to keep it only for the time being for which consent has been provided and delete it thereafter.

E-commerce, social media and gaming platforms will fall under the category of data fiduciaries. The draft rules have laid out provisions related to the consent processing of individuals and independent entities that will manage consents, data fiduciaries and the functioning of authorities under the Digital Data Protection Act 2023.

The draft rules have not mentioned penalties that were approved under the DPDP Act, 2023. The Act has the provision to impose a penalty of up to Rs 250 crore on data fiduciaries in case of personal data breach.

The draft rules, which have been published for public consultations, will be taken into consideration for making the final rule after February 18. The draft is available on the MyGov website for public comments.