white_paper_on_data_protection_in_india_171127_final_v2

an age-limit, below which a parent‘s consent is necessary, in order to protect very
young children from privacy harms. Similarly, a variable age limit can be drawn (not
necessarily 18- which is the generally accepted age of majority in India) below which
parental consent is to be mandatory. Methods for effectively ensuring parental consent
must be considered, either for certain categories of services or through certain processes
that may be onerous for the child to circumvent.
3. In addition, or in the alternative, perhaps distinct provisions could be carved out within
the data protection law, which prohibit the processing of children‘s personal data for
potentially harmful purposes, such as profiling, marketing and tracking. Additionally
separate rules could be established for the manner in which schools and other
educational institutions that collect personal information about children as part of their
regular activities need to collect and process this data. Similarly, regulations should be
prescribed as to the manner in which the government collects and processes data about
children.
2.5 Questions
1. What are your views regarding the protection of a child‘s personal data?
2. Should the data protection law have a provision specifically tailored towards protecting
children‘s personal data?
3. Should the law prescribe a certain age-bar, above which a child is considered to be
capable of providing valid consent? If so, what would the cut-off age be?
4. Should the data protection law follow the South African approach and prohibit the
processing of any personal data relating to a child, as long as she is below the age of 18,
subject to narrow exceptions?
5. Should the data protection law follow the Australian approach, and the data controller
be given the responsibility to determine whether the individual has the capacity to
provide consent, on a case by case basis? Would this requirement be too onerous on the
data controller? Would relying on the data controller to make this judgment sufficiently
protect the child from the harm that could come from improper processing?
6. If a subjective test is used in determining whether a child is capable of providing valid
consent, who would be responsible for conducting this test?
Alternatives:
a. The data protection authority
b. The entity which collects the information
c. This can be obviated by seeking parental consent
90