Data Protection Bill: Experts warn of risks in verifying IDs for apps

If a child uses 40 apps on the phone and each of these apps has a copy of the child's Aadhar card along with their parents, then it would be a big issue, an industry expert said

Expressing their concerns regarding the Digital Personal Data Protection Bill, social media platforms have said that making the verification of identities of millions of children and their parents could pose a security risk, The Economic Times (ET) has reported.

The parliament passed the Digital Personal Data Protection Bill on Wednesday, August 10. This paves the way for India's first privacy-related legislation. The Bill mandates verifiable parental consent for processing the personal data of children., the report said.

All individuals below 18 years have been defined as children in the Bill, which is above the global threshold. Notably, the age of 13 years is usually followed to allow children on most social media platforms.

 

For users between the ages of 13 and 18 years in India, apps may now have to obtain parental consent. To this end, apps will need to verify the identity of the children and parents.

Speaking on the matter, an industry expert told ET, "If a child uses 40 apps on the phone and each of these apps has a copy of the child's Aadhar card along with their parents', then it would be a big issue."

"Social media intermediaries have been advocating for a self-regulatory or a co-regulatory standard where the details of verifiable parental consent are spelt out. ID documentation of millions of people is an unnecessary security risk that will manifest thanks to the age-gating obligation," the report said, citing the expert.

Experts said that edtech, health tech, and social media platforms like Meta's Facebook and Google's YouTube would be impacted by the provision the most.

What is the Data Protection Bill?

Centre introduced the Digital Data Protection Bill, 2023, in Lok Sabha on August 3. The Bill intends to prevent cross-border data transfers, penalise companies for data breaches, and establish a framework for data protection that can enforce compliance.

What will the Data Protection Bill change?

The Bill lays out requirements for businesses engaged in the management and processing of data. It also talks about individual rights.

Businesses and institutions will be liable to face penalties in the event of non-compliance or failure to follow the established rules. The companies and organisations will be compelled to dispose of any user data that no longer serves the intended business purpose.

The Bill establishes that no company or organisation will be allowed to process personal data that can have "any detrimental effect" on a child's well-being.