2023 年数字个人数据保护规则草案已通知，要求家长同意处理儿童数据

电子信息部周五（1月3日）向社会公开征求《2023年数字个人数据保护法》规则草案。

The Ministry of Electronics and Information Technology on Friday notified the draft rules under the Digital Personal Data Protection Act 2023 for public comments.

电子和信息技术部周五通报了《2023年数字个人数据保护法》规则草案，征求公众意见。

The draft rules, among others, propose to mandate parental consent for data-fiduciaries to process the personal data of children. Data-fiduciaries include social media intermediaries, e-commerce companies, gaming platforms etc.

除其他外，该规则草案建议强制数据受托人征得父母同意才能处理儿童的个人数据。数据受托人包括社交媒体中介机构、电子商务公司、游戏平台等。

The rules state :

规则规定：

"A Data Fiduciary shall adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child and shall observe due diligence, for checking that the individual identifying herself as the parent is an adult who is identifiable if required in connection with compliance with any law for the time being in force in India, by reference to—

“数据受托人应采取适当的技术和组织措施，确保在处理儿童的任何个人数据之前获得父母的可验证同意，并应进行尽职调查，以检查自称父母的个人是否为成年人如果需要遵守印度目前有效的任何法律，可以通过参考以下内容来识别谁：

(a) reliable details of identity and age available with the Data Fiduciary; or

(a) 数据受托人提供的可靠的身份和年龄详细信息；或者

(b) voluntarily provided details of identity and age or a virtual token mapped to the same, which is issued by an entity entrusted by law or the Central Government or a State Government with the maintenance of such details or a person appointed or permitted by such entity for such issuance, and includes such details or token verified and made available by a Digital Locker service provider."

(b) 自愿提供身份和年龄的详细信息或与其映射的虚拟代币，该虚拟代币由法律或中央政府或州政府委托维护此类详细信息的实体或由其指定或允许的人员发行此类发行的实体，并包括由数字储物柜服务提供商验证和提供的此类详细信息或令牌。”

The rules give out the following illustrations:

规则给出了以下说明：

C is a child, P is her parent, and DF is a Data Fiduciary. A user account of C is sought to be created on the online platform of DF, by processing the personal data of C.

C 是孩子，P 是她的父母，DF 是数据受托人。通过处理 C 的个人数据，寻求在 DF 的在线平台上创建 C 的用户帐户。

Case 1: C informs DF that she is a child. DF shall enable C's parent to identify herself through its website, app or other appropriate means. P identifies herself as the parent and informs DF that she is a registered user on DF's platform and has previously made available her identity and age details to DF. Before processing C's personal data for the creation of her user account, DF shall check to confirm that it holds reliable identity and age details of P.

案例1：C告诉DF她是个孩子。 DF 应让 C 的家长通过其网站、应用程序或其他适当方式识别自己的身份。 P 表明自己是家长，并告知 DF，她是 DF 平台上的注册用户，并且之前已向 DF 提供了她的身份和年龄详细信息。在处理 C 的个人数据以创建其用户帐户之前，DF 应检查以确认其持有 P 的可靠身份和年龄详细信息。

Case 2: C informs DF that she is a child. DF shall enable C's parent to identify herself through its website, app or other appropriate means. P identifies herself as the parent and informs DF that she herself is not a registered user on DF's platform. Before processing C's personal data for the creation of her user account, DF shall, by reference to identity and age details issued by an entity entrusted by law or the Government with maintenance of the said details or to a virtual token mapped to the same, check that P is an identifiable adult. P may voluntarily make such details available using the services of a Digital Locker service provider.

案例2：C告诉DF她是个孩子。 DF 应让 C 的家长通过其网站、应用程序或其他适当方式识别自己的身份。 P 表明自己是家长，并告知 DF，她本人不是 DF 平台的注册用户。在处理 C 的个人数据以创建其用户帐户之前，DF 应参考法律或政府委托维护上述详细信息的实体发布的身份和年龄详细信息或映射到该详细信息的虚拟代币，检查P 是可识别的成年人。 P 可以使用数字储物柜服务提供商的服务自愿提供此类详细信息。

Case 3: P identifies herself as C's parent and informs DF that she is a registered user on DF's platform and has previously made available her identity and age details to DF. Before processing C's personal data for the creation of her user account, DF shall check to confirm that it holds reliable identity and age details of P.

案例3：P自称是C的家长，并告知DF，她是DF平台的注册用户，并且之前已向DF提供了她的身份和年龄详细信息。在处理 C 的个人数据以创建其用户帐户之前，DF 应检查以确认其持有 P 的可靠身份和年龄详细信息。

Case 4: P identifies herself as C's parent and informs DF that she herself is not a registered user on DF's platform. Before processing C's personal data for the creation of her user account, DF shall, by reference to identity and age details issued by an entity entrusted by law or the Government with maintenance of the said details or to a virtual token mapped to the same, check that P is an identifiable adult. P may voluntarily make such details available using the services of a Digital Locker service provider.

案例4：P自称是C的家长，并告知DF，她本人不是DF平台的注册用户。在处理 C 的个人数据以创建其用户帐户之前，DF 应参考法律或政府委托维护上述详细信息的实体发布的身份和年龄详细信息或映射到该详细信息的虚拟代币，检查P 是可识别的成年人。 P 可以使用数字储物柜服务提供商的服务自愿提供此类详细信息。

A Data Fiduciary, while obtaining verifiable consent from an individual identifying herself as the lawful guardian of a person with disability, shall observe due diligence to verify that such guardian is appointed by a court of law, a designated authority or a local level committee, under the law applicable to guardianship.

数据受托人在获得自称为残疾人合法监护人的个人的可验证同意时，应进行尽职调查，以核实该监护人是由法院、指定机构或地方委员会根据以下规定指定的：适用于监护权的法律。

However, the mandate on parental consent are not applicable to data fiduciaries, who are health professionals, mental health professionals, or engaged by educational institutions.

然而，父母同意的强制规定不适用于数据受托人，他们是健康专业人员、心理健康专业人员或由教育机构聘用的。

The rules also specify the contents of the notice to be given by data fiduciaries to obtain the informed consent of users(data principals) to process their personal data.

该规则还规定了数据受托人为获得用户（数据主体）处理其个人数据的知情同意而发出的通知的内容。

The notice should give, in clear and plain language, a fair account of the details necessary to enable the Data Principal to give specific and informed consent for the processing of her personal data, which shall include, at the minimum,—

该通知应以清晰、通俗易懂的语言公平地说明必要的细节，使数据主体能够就其个人数据的处理给予具体和知情的同意，其中至少应包括：

(i) an itemised description of such personal data; and

(i) 此类个人数据的详细描述；和

(ii) the specified purpose of, and an itemised description of the goods or services to be provided or uses to be enabled by, such processing.

(ii) 此类处理的具体目的以及将提供的商品或服务或将启用的用途的详细描述。

A communication link to withdraw consent should also be given.

还应提供撤回同意的通信链接。

Every Data Fiduciary shall prominently publish on its website or app, and mention in every response to a communication for the exercise of the rights of a Data Principal under the Act, the business contact information of the Data Protection Officer, if applicable, or a person who is able to answer on behalf of the Data Fiduciary the questions of the Data Principal about the processing of

每个数据受托人均应在其网站或应用程序的显着位置发布数据保护官（如果适用）或个人的业务联系信息，并在对根据该法案行使数据委托人权利的通信的每次回复中提及谁能够代表数据受托人回答数据委托人有关处理数据的问题