Verify parents through govt ID: Draft DPDP Rules on avoiding self verification by children

Digital Personal Data Protection Act became a law in August after it was passed in both houses of the Parliament

When taking permission for processing data of children or disabled persons, the onus will be on platforms to ensure that consent is obtained from the child's parents or legal guardians, and the same should be verified with the help of government-mandated IDs, according to an unreleased version of the draft Digital Personal Data Protection (DPDP) rules.

For verifying the age of a parent or any legal guardian, the draft rules state that platforms can use an electronic token mapped to an ID generated by the state governments or the Union government; or use any token that has been generated by any concerned official. Services of digital lockers can also be availed for completing this process, as per the rules.

"A data fiduciary, while obtaining verifiable consent from an individual identifying herself as the parent of a child... shall observe due diligence to confirm that such individual is not a child and to reliably identify such individual providing consent in case her identification is required in the interest of prevention, detection, investigation or prosecution of any offence of any law for the time being in force in India...," said a version of the draft DPDP rules, which is currently being circulated internally among various sectors of industry and governance.

The rules will define the DPDP Act's parameters.

Moneycontrol has seen a copy of the draft. However, the publication could not independently confirm its authenticity. The publication has reached out to the Ministry of Electronics and Information Technology (MeitY) regarding the matter, and the article will be updated when a response is received.

The DPDP Act defines a child as someone below the age of 18 and mandates that parental consent is required to process the data of a child. The law also puts a bar on tracking children, behavioural monitoring or targeted advertising at children.

Earlier during a meeting with industry on December 20, the government is understood to have conveyed that educational institutions and health institutions can be exempted from the age-gating norms that are prescribed for processing children's data under the Act.

These exemptions from restrictions on children's data processing are likely to be included in a schedule that will be released by the ministry as part of the data protection rules, Moneycontrol has learnt.

During the meeting, the government conveyed to the industry that it intends to release the rules soon and, after a brief consultation period, notify it by January 2024.