DPDP Bill: Restrictions on processing children's data will curtail innovation, say experts

The Digital Personal Data Protection Bill was tabled in the Parliament on August 3

The Digital Personal Data Protection (DPDP) Bill imposing restrictions on the processing of children's data will inhibit innovation for children, experts said. The bill was tabled by the government in the Lok Sabha on August 3.

While defining children as those below the age of 18, the DPDP Bill 2023 says that before processing any personal data of a child or a person with disability who has a lawful guardian, it is required to "obtain verifiable consent of the parent of such child or the lawful guardian". The bill has also put a bar on targeted advertising on children.

However, the 2023 bill has added a caveat that if the government finds that a platform is safely processing data of a child, then they can be certified to take up children's data processing without consent of their parents, or even take up targeted advertising.

"This curtails innovation for children. There are small companies, for example, one that makes platforms where children can learn about digital safety. These entities will have to get bureaucratic approvals for changes in their services," Aparajita Bharti, Founding Partner, Young Leaders for Active Citizenship (YLAC) told Moneycontrol.

"The flipside of obtaining parental consent in a country with low digital literacy, especially in rural areas, will put Indian children at a disadvantage," Bharti added.

Bharti recommended, "Ideally what should have been done, is you open the internet by default to teenagers and put some obligations on the platform to keep them safe them. And if they are not able to meet, blacklist those platforms. Right now, we have closed innovation for children."

Also read: Google, Meta, Apple want children redefined in India's data protection Bill, ample time for implementation

One of the major asks of the industry including Big Tech companies was to lower definition of the age of children from meaning those below the age of 18, to those below the age of 14.

"The bar on monitoring or tracking children may lead to a scenario where data fiduciaries are unable to undertake tracking or beneficial monitoring of children to deter online harm and ensure their online safety...," a Asia Internet Coalition, a body representing Big Tech bodies had earlier said.

Pallavi Sondhi, a senior associate at Ikigai Law, said, "The Bill retains the definition of a child as somebody under 18 years, which is higher than global standards (which range from 13 to 16 years) for age of consent. However, exemptions could be created in case processing is done in a verifiably safe manner.

"The Bill also prohibits processing of personal data that is likely to cause any detrimental effect (termed as harm in the 2022 version) on the well-being of a child. However, it does not define what constitutes such a detrimental effect, which may lead to difficulties in implementation," Sondhi told Moneycontrol.