Data protection Bill: Centre to get power to lower age of consent to 14 yrs

The upcoming data protection Bill may permit the Centre to lower the age of consent from 18 to 14 and also exempt certain companies from adhering to additional obligations for protecting kids' privacy if they can process their data in a "verifiably safe" manner, reported The Economic Times (ET).

The change is a major departure from the draft Digital Data Protection Bill, 2022, which was floated in November and fixed the age of consent at 18, requiring companies to obtain the consent of the individual's parents before processing data of those under 18.

On the other hand, the upcoming Bill will take a graded approach to defining the age of consent on a case-by-case basis.

 

This had been a crucial demand made of the sector, particularly social media companies, as a hardcoded age of consent would have meant business disruptions for them due to the need to set up new systems for obtaining parental consent for users under the age of 18 — a key demographic for such services.

However, it is in line with Western countries' data protection laws, where countries like the European Union (EU) and the United States (US) specify a younger age for consent.

The change was made in light of the possibility that children could act as independent Internet users who might want to access services without always obtaining parental permission, said a senior government official to The Indian Express.

Under the data protection Bill that is expected to be tabled in Parliament's Monsoon session, the definition of a child is understood to have been changed to an "individual who has not completed the age of eighteen years or such lower age as the central government may notify". In the 2022 draft, the definition of a child was an "individual who has not completed eighteen years of age".

Certain entities that deal in collecting and processing children's data can also be exempted from seeking parental consent if they can ensure that the "processing of personal data of children is done in a manner that is verifiably safe".

The Centre can grant such exemptions to entities by issuing a notification, and the Women and Child Development Ministry, in collaboration with the IT Ministry, is expected to evaluate a platform's privacy standards for children before granting them exceptions.

Other significant changes to the upcoming Bill include further relaxations of cross-border data flows to international jurisdictions by shifting from a whitelisting approach to a blacklisting mechanism.