The Joint Committee on the Personal Data Protection Bill, 2019 (“Committee”) released its report on December 16, 2021 (“Committee Report”). The current data protection framework in India provides no specific provisions for the protection of personal data of children. However, the existing Personal Data Protection Bill, 2019 (“PDP Bill”), which defines "child" to mean a person below 18 (eighteen) years of age, devotes a Chapter to the processing of personal data and sensitive personal data of children.  

Chapter IV: Section 16 of the PDP Bill imposes additional obligations on data fiduciaries processing the personal data of children and mandates that, data fiduciary should process the personal data of a child in a manner that such processing protects the rights of and is in the best interests of the child. Under Sections 16 (2) and 16 (3) of the PDP Bill, the data fiduciary is obligated to verify the age of the child and obtain consent of his parent or guardian in a manner specified by the regulations formulated by the Data Protection Authority (“DPA”) under Section 94 of the PDP Bill. 

Further, Section 16(4) of the PDP Bill provides for the classification of data fiduciary as a ‘guardian fiduciary’, if the former processes large volumes of personal data of children or operates commercial websites or online services that are directed at children. Section 16(5) of the PDP Bill also bars guardian fiduciaries from undertaking any processing of personal data which shall cause significant harm to the child and Section 16(6) of the PDP Bill states that regulations formulated by the DPA will also design a modified bar applicable on data fiduciary offering counselling or child protection services to a child from processing personal data which shall cause significant harm to the child. Section 16(7) of the PDP Bill also exempts guardian fiduciaries providing exclusive counseling or child protection services from obtaining consent of parent or guardian of the child under Section 16(2).  

The Committee, after much deliberation on Chapter IV of the PDP Bill, included recommendations 5 and 38 in the Committee Report, in relation to Chapter IV of the PDP Bill. The same are as follows: 

i) The data fiduciary is obliged to protect the personal data of children till the data principal child (“DPC”) attains majority. However, Chapter IV does not prescribe any specific procedure to be adopted by the data fiduciary when the DPC attains the age of majority to ensure continuity of their services. Therefore the Committee has recommended that:  

1. Data fiduciaries dealing exclusively with children’s data must register themselves with the DPA;
2. The Indian Majority Act, 1875 will govern the contract that may exist between a data fiduciary or data processor and a DPC, when such child attains the age of 18 (eighteen) years; and,
3. 3 (Three) months before the DPC attains the age of majority, the data fiduciary shall inform the DPC that on the date of their attaining the age of majority, the DPC may either provide a fresh consent to the data fiduciary to avail uninterrupted services provided by the data fiduciary or opt out of such services.
4. The Committee also observes that these requirements for consent need not be incorporated in the PDP Bill, rather, they may be addressed through regulations framed under the DPA after it comes into effect, as these requirements are procedural in nature. 

ii) The Committee observed that although the title of Chapter IV and Section 16 of the PDP Bill mentions ‘sensitive personal data of children’, there is no other mention of such data anywhere else in the Chapter IV. Therefore, the Committee recommended that the expression ‘sensitive personal data’ be removed from the Chapter IV and Section 16 titles; 

iii) The Committee recommended that the phrase, ‘and is in the best interests of, the child’ in Section 16(1) of the PDP Bill be omitted, as the phrase could dilute the purpose of the provision and pave way for manipulation by data fiduciary. The Committee is of the view that Section 16(1) of the PDP Bill reads better in the context of its objective, after such deletion, without giving any leeway of corruption to the data fiduciaries involved.

iv) The Committee is of the view that the classification of data fiduciaries as ‘guardian data fiduciary’ should be done away with by deleting Sections 16(4) and 16(7) of the PDP Bill and the explanation defining ‘guardian data fiduciary’ in its entirety, as these provisions could also pave way for the dilution of the objective of Section 16 of the PDP Bill, which is the protection of children in the processing of personal data. 

Please find a copy of the Committee Report, here.  

Contributed by Rabia Rahim (Associate).

Argus Knowledge Centre is now on WhatsApp! Send us a message on +91 8433523504 to receive updates from our Knowledge Centre.