The Personal Data Protection Bill, 2019 vs. GDPR: Provisions for the rights of the child and its implications

This post is authored by Puja Nair

The debate on privacy rose to the forefront after the Supreme Court passed a judgement in the case of Justice K.S Puttaswamy (Retd.) v. Union of India, where the Court held that the right to privacy was an intrinsic part of the right to life and personal liberty under Article 21 of the Constitution of India. In arriving at this conclusion, the Court examined a wide range of privacy-related issues and held that the right to privacy included the right to personal autonomy over a wide range of domains in a person’s life.

While the above decision seems obvious in its simplicity, complications arise when one considers that a child or adolescent may not understand the consequences of their individual choices. When taken in the context of online data privacy, it is safe to say that children may be unaware of the exact manner in which any data that they share online is put to use. The report submitted by the committee of experts under the chairmanship of Justice B.N Srikrishna clearly endorses this belief.

Clause 16 of the Indian Personal Data Protection Bill, 2019 (‘PDPB 2019’), which was tabled in parliament on December 11, 2019, deals with the processing of personal and sensitive personal data of children. It states categorically that every data fiduciary shall “process the personal data of a child in a manner that protects the rights of, and is in the best interests of, the child.” It further states that a data fiduciary shall only process the personal data of a child, after verifying their age and obtaining the consent of their parent or guardian, in the manner specified by future regulations.

Based on this provision, the primary question that arises is, who is a child as per the PDPB 2019? According to the provisions of the bill, a child is someone who “has not completed the age of 18 years.” This is distinct from the data protection statutes passed in other jurisdictions. The EU General Data Protection Rules (‘GDPR’) specifies that the age limit on the definition of ‘child’ may be up to the discretion of individual member states and can be anywhere between 13-16 years. The US Children’s Online Privacy Protection Act, 1998 on the other hand, puts the age limit at a firm 13 years. Notwithstanding the above, the PDPB 2019 specifies 18 as the age of majority. This was done to ensure that the provisions of the bill would be in conformity with the prevailing laws of the country.

The adoption of a singular age of majority serves to prevent confusion and conflict between the laws in the country, however, it also serves to underestimate the awareness and advancement of today’s youth. An example of this understanding was espoused by the Madras High Court in the case of Sabari Sabarinathan Sabarivasan v. State Commission for Protection of Child Rights and Ors. This judgment examines existing flaws in the Protection of Children from Sexual Offences (POCSO) Act, 2012 and recommends a change in the definition of the term ‘child,’ so that a consensual relationship between a girl above 16 years of age and a boy between 16 to 21 years of age, would not attract the draconian provisions of the law. The drafters of the PDPB 2019 could have taken a similar view, rather than conforming with the provisions of a statute like the Indian Contract Act or the Indian Majority Act, both of which were enacted in the late-1800’s. Furthermore, a 2019 study conducted among 630 adolescents across 8 schools in the nation’s capital, revealed that 60 per cent of the boys and 40 per cent of the girls, owned their own device while almost half reportedly used two or more devices to access the Internet. The numbers have no doubt increased since then and the COVID-19 crises has further accelerated the adoption of online services for both education and entertainment. This means that mandating a guardian’s consent for anyone below the age of 18 years could very well result in some data fiduciaries inadvertently being on the wrong side of the law.

Another question raised by Clause 16 of the PDPB 2019, is the determination of what constitutes the best interests of the child. The bill does not specify how this is to be determined; however, subclause 5 of Clause 16 categorizes certain types of data processing like behavioural monitoring, tracking, and targeted advertising as harmful for children.

We then come to the requirement for age verification and parental consent. The provisions of the bill do not explore this in detail. It merely states that the process of acquiring such consent and/or verification will be specified in further rules, after taking into account factors like the volume of personal data processed, the proportion of such personal data likely to be that of a child, the potential of harm that may occur to said child as a result of the processing of his/her personal data etc.

Regardless, one issue that may arise when it comes to consent is the question of capacity. Clause 11 of the PDPB 2019 states that among other things, consent must be free and informed. However, parents cannot provide such free and informed consent on behalf of their children, if they do not understand the terms and conditions provided in the policies of these websites. In many instances, we find that children possess a much greater awareness of current technology trends and their implications. Additional issues arise when we consider the concept of free choice. However, the fact of the matter is that if one wants to register with any of the popular online apps and services available, one inevitably has to agree with their terms and conditions, regardless of any reservations one might have. Therefore, the concept of consent being “freely given” is rendered pointless.

GDPR and the European Union

Article 8 of the GDPR states that where there is an offer of “information society service directly to a child” the processing of personal data of said child shall be lawful, where the child is at least 16 years old. If the child is below the age of 16 years, such processing shall be lawful only if consent has been obtained by the “holder of parental responsibility over the child.”Member States can provide for a lower age limit, provided it is not below 13 years of age. The provision further provides that “reasonable efforts” must be made to verify that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.

Article 8 is the principal provision relating to the protection of children’s personal data in the GDPR. There are other provisions that mandate the type of measures that must be taken for the protection of the personal data of a child. For example, when obtaining data from a child, data controllers must ensure that any information on the processing of such data, should be in clear and plain terms for a child to easily understand. The GDPR also provides for the ‘right of erasure’ for children’s personal data. This is particularly relevant in cases where the data subject may have provided their consent as a child, without being fully aware of the risks involved and now seek the erasure of such personal data. Clause 16 of the PDPB, which relates to the processing of personal data of children, closely mirrors Article 8 of the GDPR. To that end, this post will be limited to an examination of Article 8 of the GDPR to examine the potential pitfalls that await in the implementation of Clause 16 of PDPB 2019.

Article 8 applies only to information society services offered directly to a child. Information society services or ISS is any service that is provided at a distance, by electronic means, and at the individual request of a recipient of the services. The definition also includes the requirement that the service be one that is provided in exchange for “remuneration”. However, the majority of online services that teenagers have access to do not directly require remuneration from the users. Common examples of this include popular social media sites like Facebook, Instagram etc. For this reason, the phrase “remuneration” is interpreted broadly by the European Court of Justice (‘ECJ’). The Court has held that “the essential characteristic of remuneration […] lies in the fact that it constitutes consideration for the service in question and is normally agreed upon between the provider and the recipient of the service’’. It is not essential that the recipient of the services provide the consideration. It is only essential for the consideration to have been received by the service provider. Subsequent rulings specified that such services may also include services provided by a non-profit organization, services involving an element of chance, and services that are of a recreational or sporting nature.

Some confusion may arise in situations where the ISS has both online and offline components. In such cases one must determine whether or not the online component is integral to the nature of the service provided. If it is not integral, then such services cannot be categorized as an ISS. While these cases provide some clarity, it is clear that the definition and scope of what constitutes an ISS will continue to evolve with the evolution of technology. This is in direct contrast to the definition of a data fiduciary in the PDPB 2019, which is much more straightforward. The bill defines a data fiduciary as “any person, including the State, a company, any juristic entity or any individual who alone or in conjunction with others determines the purpose and means of processing of personal data.”

Further, much like Clause 16 of the PDPB 2019, the drafting of Article 8 raises questions on what constitutes proper consent and how such consent can be appropriately verified. Some of these questions have been delineated above in the Indian context and are also applicable here. The European Data Protection Board (‘EDPB’) have addressed these issues in its guidelines on consent under issued under the GDPR. The guidelines state that if a data subject consents because they feel they have no real choice, then the consent is not valid. The guidelines also specify certain situations where the existence of an imbalance of power between the data subject and the controller, would render consent invalid. It further provides that consent would not be considered to be “freely given” if the consent was bundled with the acceptance of the terms and conditions of a website. Additionally, when it comes to the issue of capacity, the guidelines provide that for the consent to be informed, the data subject, or the individual having parental responsibility over the data subject, must have knowledge of the controller’s identity, knowledge of the purpose of each of the processing operations for which consent is sought, knowledge of the type of data collected and used, and knowledge of the existence of the right to withdraw consent.

Finally, even if the validity of consent is established, there is no provision to determine whether the person providing such consent is qualified to do so. According to the provisions of Article 8, consent must be given by a holder of parental responsibility. Does this include even individuals who are acting in loco parenti? For example, in the US, schools may act on the parents’ behalf in an educational context, when personal data is collected from the students for the use and benefit of the school. Further, once this consent is obtained, how is it to be verified? The GDPR has merely required that the controller take “reasonable efforts” to verify said consent. This means that in situations where consent was not verifiable, the controller could still rely on the un-verified consent so long as they prove that “reasonable” efforts were made to verify the same. Fortunately, the EDPB Guidelines on consent fills this gap in Article 8 by recommending two types of verification mechanisms for high-risk and low-risk categories respectively. In the low-risk category, verification of parental consent via email was held to be sufficient. In the high-risk category, it was recommended that further proof of consent would need to be acquired. Trusted third-party verification services were also recommended, to minimise the amount of personal data the controller had to process itself.

Conclusion

The examination of the GDPR provisions clearly shows that numerous issues have arisen in the course of its implementation. These issues have been resolved on a case-by-case basis by courts and other authorities. However, these solutions are remedial and not preventative. One preventative approach is the implementation of principles like data protection by design and default as specified in Article 25 of the GDPR. Data protection by design ensures that privacy and data protection issues are considered at the design phase of any system, service or product and then implemented throughout the lifecycle of the same. Data protection by default limits the type of data collected. It requires controllers to collect and process only such data as is necessary to achieve their specific purpose.

Data protection by design is a principle that is already enshrined in Clause 22 of the PDPB, which provides that every data fiduciary shall submit a privacy by design policy to the proposed Data Protection Authority (DPA) for approval and certification. The manner in which this is to be implemented and the standards of protection required for certification would be subject to future regulations. However, by requiring data fiduciaries engaged in the collection and processing of children’s data to adhere to a higher standard of data protection, the DPA could probably ensure the protection of children’s data regardless of any pitfalls in the practical implementation of Clause 16.

The above measure might not effectively solve the issues specified with the implementation of Clause 16. Notwithstanding these drawbacks, the provisions of this Bill might be the very first step in bringing India’s data protection thresholds at par with the rest of the world.

---

Big Brother is Watching : The Right to Privacy for Minors

The 2017 judgement by a 9 judge bench in the case of Justice K.S. Puttaswamy vs. Union of India successfully cemented the Right to Privacy for citizens under Article 21 of the Constitution. The judgement was a turning point in the debate on the right to privacy which has been raised in court time and again starting from the 1964 judgement in the case of Kharak Singh vs. State of UP.

However, this was not the end of the conversation on the right to privacy, the recent decision of the Supreme Court in the case of Amber Tickoo vs Government of NCT of Delhi reignited the debate which surrounds the right to privacy, specifically the right to privacy of minors.

The Amber Tickoo Case

In September 2017, following the murder of a 4-year-old at Ryan International School, Delhi education minister Manish Sisodiya made the decision to install CCTV cameras in every Delhi government school. These cameras would cover not only the hallways and the common areas but also the classrooms. Further, in December of the same year it was decided that the feed from these cameras would be made available online for the parents to access.

 In July 2019, a Delhi government school in Lajpat Nagar became the first school fully equipped with CCTV cameras in all classrooms. According to the government the next step would be to provide the parents access to the live feed through a mobile app which they can access using a password.

These decisions of the Delhi government were challenged before the Supreme Court though a public interest litigation in the Amber Tickoo case. The petitioners argued that the installation of these cameras would result in an infringement of the right to privacy ensured in the Puttaswamy judgement. They also argued that making the live feed of students available online would jeopardize the safety and security of the students.

The Supreme Court dismissed the petition without granting any interim relief, and disposed of the case. Consequently, the implementation of the programme will see almost 1000 schools across Delhi equipped with CCTV camera’s by November.

Right to Privacy in Public Spaces

The Puttaswamy judgement while broadly dealing with the issue of the right to privacy, extended the right to privacy of individuals to the public space.

“If the reason for protecting privacy is the dignity of the individual, the rationale for its existence does not cease merely because the individual has to interact with others in the public arena. The extent to which an individual expects privacy in a public street may be different from that which she expects in the sanctity of the home. Yet if dignity is the underlying feature, the basis of recognising the right to privacy is not denuded in public spaces… Privacy attaches to the person and not to the place where it is associated.”

The court thus acknowledges that acts done by individuals in public spaces are not necessarily public in nature, and that individuals would still be guaranteed the right to privacy in such situations.

However, in this case, the right is not being extended to minors. In his interview, Akshay Marathe, a member of Delhi government’s Dialogue & Development Commission Task force on school education argues that classrooms cannot be considered to be private by ‘any stretch of imagination’. Following the principle laid down in the Puttaswamy judgement, despite classrooms being a public space, children still possess a right to privacy, since the right is attached to their person and not the space, they are in. The installation of CCTV cameras in classrooms would thus ignore these rights and appears to imply that minors do not possess the same right to privacy as adults.

CCTV cameras in Schools

The government has supported its decision to install security cameras inside classrooms for many reasons. The decision was made in response to incidents of violence in schools such as the assault of a 4-year-old girl . However, in addition to assuaging safety concerns, the government also states that having access to the live feeds from these cameras would bring down delinquency and truancy complaints for children. This measure is also meant to bolster the confidence of parents in the quality of education being imparted to the students as they would personally be able to judge the performance of the teachers via the live feed.

This experiment with CCTV cameras in school is not a novel concept. Several other jurisdictions have already implemented similar strategies in schools from equipping teachers with two-way radios, to installing CCTV cameras in schools, even in changing rooms. Almost 90% of secondary schools in the UK are now equipped with security cameras, and this constant surveillance has been criticized by many, including the teachers. Research suggests that pupils in UK are monitored as frequently as inmates in prisons and customers at an airport.

A study conducted on CCTV surveillance of primary school children in Israel also concludes that the cameras lead to a growing fear in the children that they were constantly being recorded everywhere. The study also revealed a tension between the normalisation of school surveillance, but increased resistance to other surveillance among children which could eventually cause behavioural problems in the children outside of school.

In addition to the previous problems faced in the implementation of CCTV systems in schools, the Delhi government also faces increased concerns about the responsibility of the government towards the children, as there are no laws which govern the use of CCTV cameras in schools in India. The question of parental access to feeds is also in question as the present digital infrastructure may not be able to support this venture, and the government has given no answers on how it intends to validate the identity of the parents on the smartphone app.

Rights of Minors

The rights of minors differ in aspect and scope from the rights provided to adult citizens of a state. As a vulnerable group of society, the state has chosen to prioritise security concerns over the right to privacy of children. While the installation of CCTV cameras in Delhi government schools is in the limelight now, this is by no means the only policy of such a nature to be implemented in the country. A bench at the Madras High Court recently directed the Tamil Nadu transport commissioner to issue orders mandating the installation of CCTV cameras and GPS in all school buses. Schools in Gurugram are now also set to follow in the footsteps of the Delhi model where the district education officer has called for all government schools to install CCTV cameras. They also allow schools with a paucity of funds to seek additional grants for the installation of these cameras.

While the installation of the cameras has generated mixed reviews with parents being generally happy with the news and teachers apprehensive about the same, the move has ignored some large concerns relating to the scrutiny of minors. The livestreaming of the classroom feeds is one such issue, due to the enormous scale of the process, it will be impossible to ensure the safety of this feed. The feed can be accessed though a mobile app and a password, which makes it vulnerable to leaks. There has also been no research done to investigate the effect of such constant scrutiny on children and teachers.

To sum up, the right to privacy of children is often considered subjugated to other concerns, this can most accurately be seen in the statement by CM Kejriwal which states that “There will be no privacy breach, children go to school for education, to learn discipline and become good citizens of the country… they do not go there for anything private”. It also fully ignores the question of illegal access to these live-feeds by unauthorized parties arguing that “Hypothetically even if one does get access, he will only see 40 kids studying. Nothing more can be obtained out of it.”

The decision to install CCTV cameras in schools ultimately made to benefit students and bolster the security in schools following recent events. However, the move to live-stream feeds from these classrooms has come under considerable scrutiny, with the Government School Teachers Association protesting the same. Following the refusal of the Supreme Court to intervene on the matter, Delhi schools are set to implement the policy, with other places following suit.