Know Consent in Digital Personal Data Protection Act 2023.

Understanding THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023

One of the key elements of Data Privacy is "consent". What is consent and why is it required?

"YOUR DATA IS YOUR RIGHT AND YOU MUST KNOW IT"

We know that personal data of an individual provides certain details and it was being sold in secondary market. We usually got calls from various credit card companies, banking companies, other institutions who have knowledge of all our details, including but not limited to, birth date, pan card, Father's name and address. This is a serious concern and it required to be regulated so that transfer of data can be processed in the manner provided by Law.

The THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023 has detailed provisions for who can process the data, till what time and for what purpose. For constituting this, "consent" is one of the essential requirements of this Act.

Definitions:

?Consent Manager: who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform;

Data Fiduciary: One who determines the purpose and means of processing of data

Data Principal: The person or individual who data is being processed

Data Processor: ?person who processes personal data on behalf of a Data Fiduciary

Personal data: means any data about an individual who is identifiable by or in relation to such data

Provisions of the Act with "consent" requirement:

Section 5 of the Act provides that if any request is made to Data Principal it shall be accompanied or preceded by a notice given by Data Fiduciary informing:

1. The personal data and purpose for which it is processed

2. Manner he/she can exercise his rights

3. Manner he/she can complain to the Board

For example : If you open a bank account using mobile app or website for HDFC bank. To do E-KYC under law Y in a live, video-based customer identification process, HDFC bank shall accompany or precede the request for the personal data with a notice from you describing the what personal data will be required and for what purpose.

These rights are also allowed for any data processed before the commencement of this Act.

What is Consent?

Section 6 of the Act provides that when you give consent, it must be free, specific, informed and unconditional without ambiguity and shall specify an agreement to the processing of her personal data for the specified person.

You also have rights to withdraw your consent.

For example: If you login to shopping app like Amazon and you provide consent for making available shopping services and if amazon asks you to provide access to contact list and you provide consent for both. Since contact list is not necessary for Amazon, consent shall be limited to making shopping services.

A new role is added in DPDP Act called "CONSENT MANAGERS":

A consent manager will review, manage and withdraw your consent to Data Fiduciary, he is accountable to you for your data.Every Consent Manager shall be registered with the Board in such manner and subject to such technical, operational, financial and other conditions as may be prescribed.

Hence Consent is one of the most important element in Data Protection and it is important for you to understand how to provide consent, when to provide consent and how much of consent is required for certain data, data is your right and it is your duty to provide limited data as required for processing and if any data which is not required withdraw consent through consent managers.