The Central government has proposed mandatory and verifiable parental consent for children below 18 years of age to open social media accounts. The draft Digital Personal Data Protection Rules issued by the Ministry of Electronics and Information Technology states that data fiduciaries i.e. e-commerce, social media and gaming platforms will ensure that parental consent is obtained before accessing the personal data of children. And consent should also be verified. Not only this, the parents should also be identified through their ID.
Data fiduciaries are entities that are responsible for processing personal data. E-commerce, social media and gaming platforms will fall in this category. The draft states that the data fiduciary will have to take appropriate measures to ensure that parental consent is obtained before processing any personal data of the child. Along with this, it should also be ascertained whether the person who is being described as a parent is himself an adult or not. It can be legally identified.
What will happen now?
If the draft rules are finalized, social media companies cannot allow children to open accounts on their platforms or collect children’s personal data without parental consent. The draft published by the ministry for public consultation will be taken into account for formulating the final rules after February 18. The draft rules have been released 14 months after Parliament approved the Digital Data Protection Bill 2023.
If you wish, you can also read this draft rule and give your opinion or feedback. For this you can give opinion on mygov.in.
According to the draft rules, the fiduciary will have to retain the data only for the period for which consent has been provided and then delete it. The draft rules state that certain data fiduciaries, including healthcare professionals i.e. doctors or hospitals and educational institutions, will be allowed to process personal data of children with certain restrictions. In some cases where a user is not using the e-commerce provider, social media platform or online gaming service for a long period of time, a notice of 48 hours will be given to delete their data.
