The Information Technology Act, 2000, 

The Digital Personal Data Protection Act of India (DPDP), 2023 etc.

Can individuals collect and analyze biometric data without any eligibility criteria? 

The simplified answer to the question is certainly "No". 

Individuals or the general populace cannot collect and analyze biometric data without several eligibility criteria. The explicit response to this inquiry is indeed negative.

However, can we gather and evaluate biometric information of individuals, particularly Indian citizens? 

The brief and definite response is affirmative. But why we are eligible? It is crucial to abide by the guidelines and strict protocols established by the Government of India. Our team is committed to adhering to all the latest regulations and laws concerning this matter, especially “Data Laws” within the purview of the Information Technology Act, 2000. Let us analyze the most recent legislation and regulations associated with this subject.

Significance:

The fingerprint is an exceptionally reliable method for accurately identifying an individual, as each fingerprint possesses its distinct characteristics. This holds even for identical twins, as their fingerprints differ from one another.

However, it is important to understand the disparities between biometric technology and fingerprints. Biometric technology relies on distinctive physical or behavioral attributes that are exclusive to each person and cannot be replicated. On the other hand, fingerprints serve as a means of identifying an individual and are unique to each person. Even in scenarios where a finger may be injured or the entire hand is immobilized, there are still ample fingers available for identification purposes.

Ten fingerprints on all ten fingers are necessary for biometric identification. The Homeland Security Council has determined that the U.S. standard for biometric screening requires ten fingerprint scans to be collected at all U.S. Embassies and Consulates for visa applicants intending to travel to the United States.

In India, the management of biometric data is categorized as sensitive personal data according to the Information Technology Act, 2000 (IT Act). The IT Act governs the collection, disclosure, and sharing of such information. Furthermore, the Act of 2023, known as the Digital Personal Data Protection Act, outlines specific rules and limitations about this sensitive matter. This legislation establishes a comprehensive legal structure that oversees the handling of personal data within India, as well as data processing outside of India that is linked to the provision of goods or services to individuals in India.

Here, two aspects are extremely crucial to consider: (a) General Data Protection (GDP) and (b) Digital Personal Data Protection (DPDP). The Indian Government has taken these issues seriously and has enacted a data protection law to safeguard data privacy. This law will govern the processing of users' data starting on August 9, 2023.

The Digital Personal Data Protection Act of India (DPDP) has finally reached its culmination after years of discussions, delays, and bargaining. It was officially released in the Official Gazette on Friday, August 11, 2023.

The Digital Personal Data Protection Act of India (DPDP) 2023 has imposed restrictions on the collection of Biometric Data, aligning it with the principle of purpose limitation outlined in the GDPR. This necessitates the establishment of clear, well-defined, and lawful objectives for data processing. Any utilization of this data beyond its original intent necessitates explicit consent or legal justification.

To process biometric data, it is imperative to have a lawful basis by the principles of 'lawfulness, fairness, and transparency'. Conducting a Legitimate Interest Assessment (LIA) is necessary as it serves as a lawful basis for the processing.

Article 6 of the General Data Protection Regulation (GDPR) 2023 outlines the legitimate legal grounds for data processing. These valid legal bases, as specified by the regulation, include consent, contract, legal obligation, vital interests, public task, or legitimate interests.

Sensitive personal data, including race, political beliefs, religious beliefs, health information, and sexual orientation, is generally prohibited from processing in India. Despite this prohibition, there are several exceptions to the ban on processing such data.

We will now provide a concise overview of 'The Digital Personal Data Protection Act of India (DPDP), 2023'.

Our Topics:

• (a) Highlights of the Bill;

• (b) Key Features;

• (c) Definition of a child different from other jurisdictions;

• (d) Taking verifiable parental consent may require verification of everyone’s age on digital platforms;

• (e) Lack of clarity on what constitutes detrimental to the well-being of a child;

• (f) Sources;

• (g) Link & Sources.

(a) Highlights of the Bill:

The Bill shall encompass the handling of digital personal data within India, whether acquired through online or offline means and subsequently digitized. Furthermore, it shall extend its jurisdiction to such data processing activities conducted outside India, provided they are intended for the provision of goods or services within India.

Personal data can only be processed for a lawful purpose with the explicit consent of the individual. Consent may not be necessary for specific legitimate uses, such as when the individual voluntarily shares his / her data or when the State processes it for permits, licenses, benefits, and services.

Data fiduciaries have a responsibility to ensure the accuracy, security, and timely deletion of data once its intended purpose has been fulfilled.

The Bill confers specific entitlements upon individuals, encompassing the entitlement to acquire information, pursue rectification and deletion, and seek redress for grievances.

In the interest of specified grounds such as state security, public order, and prevention of offenses, the Bill's provisions may be exempted for government agencies by the central government.

The Bill mandates the establishment of the Data Protection Board of India by the central government, which will be responsible for adjudicating cases of non-compliance with its provisions.

(b) Key Features:

• Applicability:  The Bill's coverage includes the management of digital personal data in India, with the caveat that the data is obtained either online or offline and then digitized. Additionally, it expands its authority to the handling of personal data outside of India, as long as it is related to the provision of goods or services within India. Personal data, as defined, pertains to any information that pertains to an identifiable individual. Processing, as defined, refers to the automated or partially automated operations conducted on digital personal data, encompassing activities such as collection, storage, utilization, and sharing.

• Consent:  Personal data can only be processed for a lawful purpose once the individual's consent has been obtained. Before seeking consent, it is necessary to provide a notice containing comprehensive information regarding the personal data to be collected and the purpose of its processing. The individual has the right to withdraw their consent at any given time. However, certain 'legitimate uses' do not require consent, such as when the data has been voluntarily provided by the individual for a specified purpose, when the government provides a benefit or service, during a medical emergency, or in the context of employment. In the case of individuals below 18 years of age, consent must be obtained from their parent or legal guardian.

• Rights and duties of data principal:  An individual, referred to as the data principal, shall be entitled to the following rights: (i) access information regarding the processing of their personal data; (ii) request the correction or deletion of their personal data; (iii) designate a representative to exercise their rights in the event of their death or incapacity, and (iv) seek redress for any grievances. Data principals are also subject to certain obligations. They are prohibited from (i) lodging false or frivolous complaints; and (ii) providing false information or impersonating another individual in specified circumstances. Failure to comply with these obligations may result in a penalty of up to Rs. 10,000.

• Obligations of data fiduciaries:  The data fiduciary, responsible for determining the purpose and means of processing, must take the necessary steps to ensure the accuracy and completeness of data, establish adequate security measures to prevent data breaches, notify both the Data Protection Board of India and affected individuals in the event of a breach, and delete personal data once the purpose has been fulfilled and retention is no longer required for legal purposes. However, government entities are exempt from the storage limitation and the data principal's right to erasure.

• Transfer of personal data outside India:  The transfer of personal data outside India is permitted under the provisions of the Bill, except in countries restricted by the central government through notification.

• Exemptions:  The Bill specifies certain cases where the rights of the data principal and obligations of data fiduciaries (excluding data security) will not be applicable. These cases include the prevention and investigation of offenses, as well as the enforcement of legal rights or claims. Additionally, the central government has the authority to exempt certain activities from the Bill's application through notification. Such activities may include processing by government entities in the interest of the security of the state and public order, as well as research, archiving, or statistical purposes.

• Data Protection Board of India: The establishment of the Data Protection Board of India by the central government is imminent. The Board's primary responsibilities encompass monitoring compliance and enforcing penalties, instructing data fiduciaries to implement appropriate measures in the event of a data breach, and addressing grievances raised by affected individuals. Board members will serve a two-year term and may be re-appointed. The central government will determine the specifics, including the number of Board members and the selection process. Any appeals against the Board's decisions will be directed to TDSAT.

• Penalties: The Bill's timetable outlines consequences for a range of offenses, including a maximum penalty of Rs 200 crore for failing to meet obligations related to children and Rs 250 crore for neglecting to implement security measures to prevent data breaches. Following an inquiry, the Board will levy the penalties.

(c) Definition of child different from other jurisdictions:

The processing of a child's data is widely acknowledged to require enhanced safeguards. However, variations exist across jurisdictions in defining the age at which a child can provide consent for the processing of personal data. According to the Bill, a child is deemed to be an individual below the age of 18. Conversely, in the United States and the United Kingdom, individuals over the age of 13 are eligible to grant consent for the processing of personal data.[26],[27]  

The age requirement established by the General Data Protection Regulation (GDPR) of the European Union is set at 16 years old, although member countries have the flexibility to potentially decrease it to a minimum of 13 years old. [28]

The Srikrishna Committee (2018) proposed that when establishing the age of consent for minors, specific considerations must be taken into account. These considerations encompass a minimum age of 13 and a maximum age of 18, as well as a unified threshold to guarantee effective execution. [4]

It is worth noting that the duration of 18 years might be deemed excessive when considering the comprehensive independent growth and maturation of a child. [4]

However, to align with the current legal structure, the age of consent must be set at 18 years. [4] 

The Indian Contract Act of 1872 stipulates that individuals must be at least 18 years old to enter into a legally binding contract. [29]

(d) Taking verifiable parental consent may require verification of everyone’s age on digital platforms:

The Bill mandates that all data fiduciaries must acquire verifiable consent from the legal guardian before processing a child's data. To adhere to this requirement, each data fiduciary will be obligated to authenticate the age of every individual who registers for their services. This verification process is essential to ascertaining whether the individual is indeed a child, thereby enabling the data fiduciary to obtain consent from their legal guardian. This measure serves to prevent instances where children provide inaccurate information. Nevertheless, it is important to acknowledge that this approach may potentially diminish anonymity within the digital realm.

(e) Lack of clarity on what constitutes detrimental to the well-being of a child:

The Bill ensures that data fiduciaries are prohibited from engaging in any processing activities that could potentially harm the well-being of a child. However, it is important to note that the Bill does not explicitly define what constitutes a detrimental effect. Furthermore, the Bill does not offer any guidance or criteria for determining such effects. This lack of clarity and guidance raises concerns about how data fiduciaries can effectively safeguard the well-being of children.

(f) Sources:

(a) Report of the Joint Parliamentary Committee on the Personal Data Protection Bill, 2019; (b) The Digital Personal Data Protection Bill, 2023 as introduced in Lok Sabha; (c) The Draft Personal Data Protection Bill, 2018.

(g) Link & Sources:

§  [1]. Justice K.S. Puttaswamy (Retd) vs. Union of India, W.P. (Civil) No 494 of 2012, Supreme Court of India, August 24, 2017.

§  [2]. Report of the Joint Committee on the Personal Data Protection Bill, 2019, December 2021.

§  [3]. The Information Technology Act, 2000. 

§  [4]. ‘A Free and Fair Digital Economy Protecting Privacy, Empowering Indians’, Committee of Experts under the Chairmanship of Justice B.N. Srikrishna, July 2018.  

§  [5]. The Personal Data Protection Bill, 2019, was introduced in Lok Sabha.

§  [6]. The Draft Digital Personal Data Protection Bill, 2022, Ministry of Electronics and Information Technology, November 18, 2022. 

§  [7]. The Digital Personal Data Protection Bill, 2019, was introduced in Lok Sabha.

§  [8]. Rule 419A, The Indian Telegraph Rules, 1951 issued under Section 7 (2) of the Indian Telegraph Act, 1885. 

§  [9]. People’s Union for Civil Liberties (PUCL) vs Union of India, Supreme Court of India, December 18, 1996.

§  [10]. Chapter 3, Data Protection Act, 2018, United Kingdom.

§  [11]. Part 6, 7, and 8, Investigatory Powers Act, 2016, United Kingdom.

§  [12]. Clause 2 (20), Clause 2 (38), Clause 15, The Personal Data Protection Bill, 2019, as introduced in Lok Sabha.

§  [13]. Clause 22, Clause 23, Clause 26, Clause 27, The Personal Data Protection Bill, 2019, as introduced in Lok Sabha.

§  [14]. Clause 64, The Personal Data Protection Bill, 2019, as introduced in Lok Sabha.

§  [15]. Recital 75, Article 82, General Data Protection Regulation of European Union.

§  [16]. Clause 26, The Personal Data Protection Bill, 2018, as released by the Ministry of Electronics and Information Technology.  

§  [17]. Clause 19, The Personal Data Protection Bill, 2019, as introduced in Lok Sabha.  

§  [18]. Article 20, General Data Protection Regulation, European Union.  

§  [19]. Clause 33 and 34, The Personal Data Protection Bill, 2019, as introduced in Lok Sabha. 

§  [20]. Clause 17, The Draft Digital Personal Data Protection Bill, 2022, Ministry of Electronics and Information Technology, November 18, 2022.

§  [21]. Rojer Mathew versus South Indian Bank Ltd & Ors., 2019 (369) ELT3 (S.C.), Supreme Court of India, November 13, 2019.

§  [22]. Section 89, The Electricity Act, 2003. 

§  [23]. Section 10 (1), The Competition Act, 2002.

§  [24]. Section 5 (2), The Telecom Regulatory Authority of India Act, 1997.

§  [25]. Rule 3 (2), The SEBI (Terms and Conditions of Service of Chairman and Members) Rules, 1992.

§  [26]. Children's Online Privacy Protection Rule ("COPPA"), Federal Trade Commission, USA, as accessed on December 6, 2022.

§  [27]. Guide to Data Protection, Information, Information Commissioner's Office, United Kingdom, as accessed on December 6, 2022.

§  [28]. Article 8, General Data Protection Regulation, European Union. 

§  [29]. Section 11, The Indian Contract Act, 1872