Digital Data Protection Draft Guidelines Propose Parental Consent For Minors Using Social Media-OxBig News Network

Prime Minister Narendra Modi-led central government has released the long-awaited draft of Digital Personal Data Protection Rules. The draft rules come following an approval of the Digital Data Protection Bill 2023 from Parliament about 14 months back. The rules, however, do not mention any penal action for violations. According to the draft rules of the Digital Personal Data Protection Act, 2023, children below the age of 18 will require parental consent to open social media accounts.

“Draft of rules proposed to be made by the central government in exercise of the powers conferred by sub-sections (1) and (2) of section 40 of the Digital Personal Data Protection Act, 2023 (22 of 2023), on or after the date of coming into force of the Act, are hereby published for the information of all persons likely to be affected thereby,” the draft notification said.

The rules have spelled out a mechanism for obtaining explicit consent from individuals and mandate parental consent for children to use their data in any form. The Digital Personal Data Protection (DPDP) Act 2023 describes entities collecting and using personal data as data fiduciaries.

“A Data Fiduciary shall adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child,” the draft rule said.

According to the draft, the data fiduciary will have to carry out due diligence to check that the individual identifying herself as the parent of a child is an adult and identifiable if required in connection with compliance with any law in force in India.

The draft rules also state that data fiduciaries will have to keep it only for the time being for which consent has been provided and delete it thereafter. E-commerce, social media, and gaming platforms will fall under the category of data fiduciaries.

The draft rules have laid out provisions related to the consent processing of individuals and independent entities that will manage consents, data fiduciaries, and the functioning of authorities under the Digital Data Protection Act 2023.

The draft rules have not mentioned penalties that were approved under the DPDP Act, 2023. The Act has the provision to impose a penalty of up to Rs 250 crore on data fiduciaries in case of a personal data breach. The draft rules, which have been published for public consultations, will be taken into consideration for making the final rule after February 18. The draft is available on the MyGov website for public comments.