Digital Personal Data Protection Bill - Age of Consent for Data Protection

What’s in today’s article?

• Why in News?
• About Digital Person Data Protection Bill, 2022
• Key Features of Digital Person Data Protection Bill, 2022
• News Summary
• What is the Age of Consent for Data Protection in Other Countries?

 

Why in News?

• The Digital Personal Data Protection Bill, 2022 could empower the Central government to lower the age of consent from 18, for accessing Internet services without parental oversight.

 

About Digital Personal Data Protection Bill, 2022

• Personal data is defined as any data about an individual who is identifiable by or in relation to such data.
• Ministry of Electronics and Information Technology has been deliberating on various aspects of digital personal data and its protection, and has formulated a draft Bill, titled ‘The Digital Personal Data Protection Bill, 2022’.
• The purpose of the draft Bill is to provide for the processing of digital personal data in a manner that recognizes both the right of individuals to protect their personal data and the need to process personal data for lawful purposes.
• The Bill frames out the rights and duties of the citizen (Digital Nagrik) on one hand and the obligations to use collected data lawfully of the Data Fiduciary on the other hand.

 

Key Features of Digital Person Data Protection Bill, 2022

• Applicability –
  • The Bill will apply to the processing of digital personal data within India.
  • It will also apply to the processing of personal data outside India, if it is for offering goods or services or profiling individuals in India.
• Consent –
  • Personal data may be processed only for a lawful purpose for which an individual has given consent. 
  • A notice must be given before seeking consent. 
  • Notice should contain details about the personal data to be collected and the purpose of processing.  Consent may be withdrawn at any point in time.
  • For individuals below 18 years of age, consent will be provided by the legal guardian.
• Rights and Duties of Data Principal –
  • An individual, whose data is being processed (data principal), will have the right to
    • (i) obtain information about processing,
    • (ii) seek correction and erasure of personal data,
    • (iii) nominate another person to exercise rights in the event of death or incapacity
• Transfer of personal data outside India –
  • The central government will notify countries where a data fiduciary may transfer personal data. 
  • Transfers will be subject to prescribed terms and conditions.
• Data Protection Board of India –
• The central government will establish the Data Protection Board of India.
• Key functions of the Board include
  • (i) monitoring compliance and imposing penalties,
  • (ii) directing data fiduciaries to take necessary measures in the event of a data breach, and
  • (iii) hearing grievances made by affected persons.

 

News Summary

• The upcoming Digital Personal Data Protection Bill, 2022 could empower the Central government to lower the age of consent from 18, for accessing Internet services without parental oversight.
• The Bill could also exempt certain companies from adhering to additional obligations for protecting kids’ privacy if they can process their data in a “verifiably safe” manner.
• These two changes are major departure from the earlier draft of the Bill in which the age of consent was hardcoded at 18 years – meaning that for processing data of individuals below the age of 18, companies were required to seek their parents’ consent.
• This had been a key ask of the industry, especially social media companies, as a hardcoded age of consent would have meant business disruptions for them on account of setting up new systems for obtaining parental consent for users under 18 years of age.
• The change was made on account of considerations that children can be independent stakeholders on the Internet, and might want to access services without always needing their parents’ consent.
• The Bill is expected to be tabled in Parliament’s Monsoon session.

 

What is the Age of Consent for Data Protection in Other Countries?

• Under the European Union’s General Data Protection Regulation (GDPR), age of consent has been kept at 16, but it allows member states to lower it to as much as 13.
• The United States’ Children’s Online Privacy Protection Act (COPPA) has capped the age of consent at 13, and verifiable parental consent is needed only for those who are younger.
• In China, entities handling personal data of individuals younger than 14 years must obtain their parents’ or other guardians’ consent before processing their data.

 

---

Q1) What is the aim of the Digital India Campaign?

The Union Government launched the Digital India campaign to make government services available to citizens of the country digitally by improving online infrastructure and increasing internet connectivity and usage.

 

Q2) In terms of the Internet, what is the difference between Latency and Network speed?

Latency refers to how quickly your online device can communicate, while speed measures the amount of data it can download or upload at a time.

 

---

Source: Digital Personal Data Protection Bill, 2022  | Indian Express