2025 年數位個人資料保護規則草案規定了“處理兒童和殘疾人個人資料的可驗證同意”

《數位個人資料保護規則-2025》(DPDPR-2025) 草案規定了“處理兒童和殘疾人個人資料的可驗證同意”，明確了在處理兒童和殘疾人的個人資料之前獲得父母或法定監護人可驗證同意的要求。

The draft Digital Personal Data Protection Rules-2025 (DPDPR-2025) includes provisions for obtaining 'Verifiable Consent for Processing Personal Data of Children and Persons with Disabilities', outlining the requirements for acquiring parental or legal guardian consent before processing the personal data of children or persons with disabilities.

《數位個人資料保護規則-2025》草案 (DPDPR-2025) 包括獲得「處理兒童和殘疾人個人資料的可驗證同意」的規定，概述了在處理兒童個人資料之前獲得父母或法定監護人同意的要求或殘疾人士。

As per the draft rules, a 'Data Fiduciary' is required to implement measures to ensure that the person providing consent for a child's data processing is indeed the child's parent or legal guardian and that they can be properly identified.

根據草案規則，「資料受託人」必須採取措施，確保同意兒童資料處理的人確實是兒童的父母或法定監護人，並且可以正確識別他們的身份。

"To verify that the parent is an adult, the Data Fiduciary must use reliable identity details or a virtual token linked to such details. This verification is essential to ensure that consent is granted by a responsible adult, as defined by relevant laws," the rules state.

「為了驗證父母是否是成年人，資料受託人必須使用可靠的身份詳細資訊或與此類詳細資訊相關聯的虛擬令牌。這種驗證對於確保相關法律所定義的負責任的成年人授予同意至關重要，”規則狀態。

However, the draft rules also provide for exemptions from the obligations in processing the personal data of children. Section 9 of the Act outlines the standards required for processing the personal data of the children. It also laid down specific purposes and conditions for which the data has to be processed.

不過，規則草案也規定了處理兒童個人資料義務的豁免。該法第 9 條概述了處理兒童個人資料所需的標準。它也規定了處理資料的具體目的和條件。

"Specific classes of Data Fiduciaries, such as healthcare professionals, educational institutions, and childcare providers, are exempt from certain provisions related to children's data," the rules state.

規則規定：“特定類別的資料受託人，例如醫療保健專業人員、教育機構和兒童保育提供者，不受與兒童資料相關的某些規定的約束。”

These entities are permitted to process children's personal data, but this is limited to specific activities such as health services, educational activities, safety monitoring, and transportation tracking.

這些實體被允許處理兒童的個人數據，但這僅限於特定活動，例如醫療服務、教育活動、安全監控和交通追蹤。

These activities must be necessary for the well-being and safety of the child, ensuring that data processing is conducted within a defined and limited scope.

這些活動對於兒童的福祉和安全必須是必要的，確保資料處理在規定和有限的範圍內進行。

The Act provides for Part A and Part B, and Part B of the schedule says what are the particular purposes for which the exemptions apply, including processing for legal duties, issuing subsidies or benefits to children, "creating user accounts for communication, or ensuring that a child does not access harmful information. In these cases, processing is restricted to what is necessary to perform the function, service, or duty, with a strong emphasis on protecting the child’s best interests."

該法案規定了 A 部分和 B 部分，附表的 B 部分說明了豁免適用的特定目的，包括處理法律義務、向兒童發放補貼或福利、「創建用於通信的用戶帳戶，或確保在這些情況下，處理僅限於履行職能、服務或職責所必需的信息，並重點保護兒童的最大利益。

The provision also recognises that certain activities, such as verifying the age of a data subject to confirm they are not a child, fall under this exemption, as long as the processing remains limited to what is necessary.

該條款還承認，某些活動（例如驗證資料主體的年齡以確認他們不是兒童）屬於此豁免範圍，只要處理仍然僅限於必要的範圍。

These exemptions aim to strike a balance between safeguarding children's personal data and allowing essential activities for their health, education, and safety.

這些豁免旨在在保護兒童的個人資料和允許兒童健康、教育和安全的基本活動之間取得平衡。