The Digital Personal Data Protection Rule is likely set to be released by the end of the month.
The DPDP Act mandates verifiable consent of parents/lawful guardian to process personal data of children and persons with disabilities. “Notably, the DPDP Act provides an enablement for the Central Government to exempt classes of data fiduciaries and processing for certain purposes from the requirement of obtaining parental consent and prohibiting behavioral monitoring,” said Shimpy Arman Sharma, Partner, Anand Sharma and Associates.
The nature of rules is likely to be clarificatory, and not introductory. This will clarify the act, and ensure easy compliance. “While the rules are likely to be clarificatory rather than introducing new provisions, they will be crucial in providing guidance on key areas like consent management, data minimization, and the responsibilities of data fiduciaries,” she adds.
Section 9 of the DPDP Act deals with processing of personal data of children. The law mandates Data Fiduciary before processing any personal data of a child or a person with a disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian. “A clarity on the method to process the data of children has also led to the delay in the notification of the rules due to the technical difficulty in establishing a parent-child relationship with the Aadhar in cases of data update,” said Akshat Pande, Managing Partner, Alpha Partners.
Clarity on reasonable practicable
Section 5 of the DPDP Act deals with notice, wherein the Data Fiduciary shall, as soon as it is reasonably practicable, give to the Data Principal a notice informing her in the case of Data Principal giving consent for the processing of her personal data before the date of commencement of the DPDP Act.
Akshat Pande highlighted that the said notice, post consent, is to be provided to the data principal “as soon as is reasonably practicable”. The DPDP Act does not clarify the timeline that may be considered “reasonably practicable”.
“Consent Manager” means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review, and withdraw her consent through an accessible, transparent, and interoperable platform.
They are identified by the DPDP Act as the point of contact, for the data principal, with the DPDP Board.
“However, data fiduciaries will have to implement processes to enable the consent manager to take such actions on behalf of the data principal, and thereby the DPDP Rules are expected to clarify the framework with respect to the consent managers,” he added.
On August 11, 2023, India enacted the Digital Personal Data Protection Act, 2023. “Enacted on August 11, 2023-six years after the Supreme Court recognized the “Right to Privacy” as a fundamental right under Article 21-the Digital Personal Data Protection Act (DPDP) Act marks a pivotal moment in India’s data privacy framework,” said Ashutosh Srivastava, Counsel, SKV Law Offices.
At the core of the DPDP Act lies the principle of citizens’ consent in data collection and processing. How the draft rules integrate these provisions into industries like e-commerce and digital advertising will be crucial. Ashutosh Srivastava, Counsel, SKV Law Offices.
The Union Budget 2024-2025 allocated 22 crore for the establishment and salary expenses of the Data Protection Board (DPB). “Notably, the Union government has allocated INR 2 Crores for establishing the Data Protection Board in the 2024-25 Budget, which has raised questions about its adequacy to ensure effective implementation,” he added.