white_paper_on_data_protection_in_india_171127_final_v2

(i)
Balancing the issue of children lacking the legal competence to provide valid consent to
data processing activities with the fact that children continue to use a large number of
online services
Under the Indian Contract Act, 1872, a person is considered competent to contract as long as
she is no longer a minor (above the age of 18). However, it may not be possible to prevent
children from accessing any online service on this basis. As discussed above, children use
many online services, access websites, and have social media accounts. Prior to using these
services, the child will have to consent to the terms of use and notice of the websites.
Websites attempt to circumvent this issue by seeking the parent‘s consent on behalf of the
child if the child is below the age of 18. However, other countries recognise that relying
solely on parental consent for all children below the age of majority might have a chilling
effect on the child‘s opportunity to freely use the Internet as a medium of self-expression,
growth and education. It also does not take into account that as a child becomes older, she
gains the maturity and capacity to understand the purposes for which her information may be
used, and so should not be solely reliant on a parent‘s consent. The UK developed a test to
gauge the capacity of a child to understand the consequences of what she is agreeing to in the
absence of a parent‘s consent, with respect to medical decisions. 425 Perhaps there is a need to
develop a similar test in order to develop an alternative model for child‘s consent generally
with respect to data processing, though the form that the test will take in India‘s context.
(ii)
Difficulty in determining which websites and entities must comply with the additional
data protection requirements to safeguard children
The intention behind creating a specific protection regime for services which process
children‘s personal data is clear. However, it is difficult to pinpoint the exact type of entity to
which it must apply. If additional data protection safeguards for children are only applicable
to websites catering to children, as it is in the US, then this scope may be too narrow. This is
because children also commonly access websites such as Facebook, which is technically not a
―children‘s website‖. If the intended application is only towards commercial websites, or
websites which support online transactions, as it is in the EU, which also collect information
relating to a child, then this classification may also be flawed as many ‗non-commercial‘
websites collect large amounts of data relating to children and generate revenue by way of
their advertisements, tracking use patterns and so on. Therefore, it may be difficult to draw a
line as to which websites will need to comply with additional child data protection
requirements.
Additionally, specific standards need to be established for other non-website based collection
of data about children. Schools and other educational institutions are getting increasingly
digitised often deploying cloud based services and software as a service modules to manage
their operations. These entities need clear guidance as to the manner in which they need to
manage the information that they are storing with regard to children including regulations on
425 Gilick Competence Test: Gilick v. West Norfolk and Wisbech Area Health Authority and Department of
Health and Social Security [1984] Q.B. 581.
86