PDP Bill: IAMAI Opposes 18 As The Age Of Consent; Calls For A Risk-Based Approach

The Internet and Mobile Association of India (IAMAI) has opposed the age of consent under the proposed Personal Data Protection, or PDP Bill, 2021. The Bill has proposed the age of consent to be 18 years.

According to the IAMAI, the age requirement will slow down the growth of industries such as edutech and companies providing entertainment products and services for children.

However, the association suggested that the definition of a ‘child’ should be reduced from 18 years, basing the same on global norms, and called for a ‘risk-based approach’ for the age of consent.

The age of consent should depend on the nature of the service being provided, it said.

The organisation, which represents tech companies and has executives from Amazon, Twitter, Microsoft, and multiple Indian startups on its governing council, said that age verification should be based on self-declaration and thus, its veracity should lie with the data principal.

The IAMAI added that the requirement of a ‘data fiduciary’ to verify children’s age should be removed as well to avoid creating any further privacy risks that may arise because of the collection of potentially sensitive information.

According to the Bill, a data fiduciary is an entity or individual who decides the purpose and methods of processing personal data. The processing will be subject to certain limitations— the idea being that personal data can only be processed for specific, clear and lawful purposes.

The association made the suggestions in response to the submissions made by the Joint Parliamentary Committee on the proposed PDP Bill, suggesting changes to the Ministry of Electronics and Information Technology.

What’s The Age Of Consent In Other Countries?

IAMAI noted that other countries have different ways of handling the age of consent debate.

For instance, the EU pegs the age of consent at 16 years, and in the US, the Children’s Online Privacy Protection Act limits the age of consent to 13 years. Further, countries such as France, Austria, and Belgium have the age of consent of 15, 14, and 13 years, respectively.

The association argued that if the age of consent is fixed at 18 years, there will be a significant number of users essentially locked out of services, which will also impact their overall wellbeing. Some observers have also said that this argument is a liberalisation of the PDP Bill which can be contentious.

Parental Consent, Targeted Advertisement – Other Suggestions Made By IAMAI

The IAMAI also lobbied for the parental consent mechanism to not be ‘prescriptive’ as it can result in a ‘chilling effect’ or children simply being discouraged from exercising their legal rights owing to the threat of legal action.

Instead, the association suggested that the guidelines should focus on how to empower the young users and their parents, and engage with ‘transparency and privacy tools’.

The association also suggested removing the requirement for parental consent. It added that even if parental consent makes it to the final Bill, any change requiring parental consent to process data for users under the age of consent (verified or not) should be applied on an ongoing basis.

Interestingly, the Bill proposes a ban on processing children’s data, which is a sensitive issue. It states that data fiduciaries will not profile, track, or monitor the behaviour of children or do direct advertising targeted at children.

The IAMAI contended that the advertising ban assumes that all the advertisements are bad for children, which will deprive them of services related to their education and wellbeing.

This issue has been a matter of debate since the early days of the PDP Bill.

The sixth sitting of the Joint Parliamentary Committee on the Personal Data Protection Bill, held in 2020, saw some key issues being brought to the fore by law firm Luthra and Luthra and the Foundation of Data Protection Professionals in India, who were invited to air their views.

The meeting discussed the crucial issue of children’s privacy rights and how anonymisation can preserve privacy rights, reported Medianama.

Luthra and Luthra and the Foundation of Data Protection Professionals had proposed that a rigid age of consent for children was not a fail-safe way to decide on children’s consent. They proposed creating a graded approach to children’s age of consent depending on the services in question.

At the meeting, Luthra and Luthra argued that the broad definitions in the proposed PDP Bill widened its scope, limiting the freedom of business tasks.

The development was first reported by Business Standard.