Government releases draft rules of Draft Digital Personal Data Protection Act
The government has released the draft rules under the Digital Personal Data Protection Act seeking comments from stakeholders. The rules are expected to clarify various aspects of the law, such as data fiduciaries’ notice to individuals, the registration and responsibilities of consent managers, the handling of children's personal data, and more.
On processing of children’s data, draft rules outline the requirements for obtaining verifiable consent from parents or legal guardians before processing the personal data of children or persons with disabilities. Specifically, a Data Fiduciary must implement measures to ensure that the person providing consent for a child’s data processing is the child’s parent or legal guardian, and that the parent or guardian is identifiable. The processing of children's personal data by these entities is permitted, but it is restricted to specific activities like health services, educational activities, safety monitoring, and transportation tracking. These activities must be necessary for the well-being and safety of the child, ensuring that data processing is done within a defined a limited scope. As per the draft rules Consent Manager must be a company incorporated in India with sound financial and operational capacity, having a minimum net worth of Rs. 2 crore, a reputation for fairness and integrity in its management, and a certified interoperable platform enabling Data Principals to manage their consent.
The rules also proposed as the establishment of Data Protection Board as a regulatory body. It will operate as a digital office, with remote hearings and will have powers to investigate breaches, enforce penalties and so on. The rules also need to address challenges posed by emerging technologies like Artificial Intelligence.
