Introduction

With the Ministry of Electronics and Information Technology (MeitY) set to conclude public consultations on the draft Rules for the Digital Personal Data Protection (DPDP) Act, 2023 by March 5, disability rights activists are raising concerns over a specific provision in the law. This provision, they argue, undermines the decision-making autonomy of Persons with Disabilities (PwDs) by making it mandatory for legal guardians to provide consent on their behalf for data processing. Experts claim that this move infantilizes PwDs and stems from a misunderstanding of how guardianship works under Indian laws.

What Does the Controversial Provision State?

The primary concern centers around Section 9(1) of the DPDP Act, which states:

• “The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian, obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.”
• By grouping PwDs with children, the provision assumes that PwDs, even as adults, lack the capacity to provide independent consent when they have a legal guardian. The government has sought to address this concern in the draft Rules by limiting the disabilities covered under this provision. However, activists argue that significant challenges remain in its implementation.

Data Fiduciary

• Any entity (such as a company, government agency, or online platform) that processes personal data of individuals for specific purposes.

Data Principal

• The individual whose personal data is being collected, stored, and processed. In the case of persons with disabilities (PwDs), the term also includes their lawful guardian.

Section 9(1) of DPDP Act

• A provision in the DPDP Act requiring data fiduciaries to obtain verifiable consent from a lawful guardian before processing the personal data of a PwD who has a guardian.

Lawful Guardian

• A person legally appointed to oversee the well-being and decision-making of another individual (such as a child or a PwD). Guardianship can be full (complete control) or limited (support in specific legal decisions).

Limited Guardianship

• A form of guardianship under the Rights of Persons with Disabilities (RPWD) Act, 2016, where the PwD retains decision-making power but receives support from the guardian in specific legal matters.

Full Guardianship

• A more restrictive form of guardianship under the National Trust (NT) Act, 1999, where the guardian has complete control over all decisions on behalf of the PwD.

United Nations Convention on the Rights of Persons with Disabilities (UNCRPD)

• An international treaty that recognizes the rights and dignity of persons with disabilities and promotes their full participation in society, including decision-making rights.

Intersectionality of Gender and Disability

• The concept that PwDs face additional challenges based on overlapping identities, such as gender. For example, a woman with disabilities may struggle to purchase essential items like sanitary napkins if she requires guardian consent online.

Inaccessible Digital Platforms

• Online services, websites, or apps that do not support screen readers, voice commands, or other assistive technologies, making it difficult for PwDs to use them independently.

What Do the Draft Rules Say?

The DPDP Act was introduced to regulate the processing of digital personal data while balancing the right to privacy and the need for lawful data processing. The Act defines:

• Data Fiduciaries: Entities that process personal data.
• Data Principals: Individuals whose data is being collected.

Notably, Section 2(j)(ii) expands the definition of data principal for PwDs to include their “lawful guardian.”

The draft Rules, notified by MeitY on January 3, 2025, further elaborate on this requirement through Rule 10, which governs the implementation of Section 9(1).

• Rule 10(2) mandates that before processing data, a data fiduciary must verify that a guardian has been legally appointed by a court, designated authority, or a local-level committee under applicable guardianship laws.
• The Rule also defines PwDs subject to the consent clause as those who:
• Have long-term physical, mental, intellectual, or sensory impairments that hinder full and effective participation in society despite support.
• Have conditions such as autism, cerebral palsy, intellectual disability, or severe multiple disabilities.

While the Rules provide detailed illustrations on how consent should be obtained for children, there are no such illustrations for PwDs. This omission raises concerns about the practical application of the law for persons with different types of disabilities and levels of legal capacity.

Understanding Guardianship for PwDs

In India, guardianship for PwDs is governed by two primary laws:

1. The National Trust for the Welfare of Persons with Autism, Cerebral Palsy, Mental Retardation, and Multiple Disabilities Act, 1999 (NT Act).
2. The Rights of Persons with Disabilities Act, 2016 (RPWD Act).

The two laws differ in how they define guardianship:

NT Act (1999):

• Applies to individuals with autism, cerebral palsy, intellectual disabilities, or multiple disabilities.
• Provides for full guardianship, meaning the guardian takes complete control over all decisions.
• Criticized for violating the principles of the United Nations Convention on the Rights of Persons with Disabilities (UNCRPD) by assuming a lack of decision-making capacity.

RPWD Act (2016):

• Applies to people with long-term impairments affecting full participation in society.
• Provides for limited guardianship, meaning the PwD retains decision-making rights, with the guardian only providing support.
• Aligns with UNCRPD principles by recognizing PwDs’ right to make decisions with assistance.

These differences highlight the complexities of guardianship and why a one-size-fits-all approach in the DPDP Act could be problematic.

Where Does the Conflict Arise?

A survey by PACTA and Saksham Disability among 91 PwDs found that 27.4% had legal guardians. Most of them were under the limited guardianship model of the RPWD Act, but in practice, their guardians exercised full control over their affairs.

The Saksham-PACTA report highlighted several concerns:

The DPDP Act assumes that the mere existence of a legal guardian implies that the PwD cannot make digital decisions.

It does not differentiate between limited and full guardianship, creating ambiguities in how consent should be obtained.

It does not consider intersectional factors, such as gender and disability.

Example: A woman with a disability may not be able to buy sanitary napkins online without her guardian’s consent.

Even with the government’s effort to limit the disabilities covered under Section 9(1), the revised definition still includes “physical impairments”, which do not require legal guardians under any law. This adds to the confusion.

Key Concerns Being Raised

Legal Ambiguities:

• What are the legal obligations of a guardian under DPDP Act?
• Can a guardian refuse consent for certain platforms?
• Would a guardian be legally responsible for all actions taken under the PwD’s data?

Privacy and Data Collection:

• To comply with Section 9(1), platforms must ask whether a user has a disability and if they have a guardian.
• If a person does not have a guardian, the platform still collects disability data without needing it.

Potential for Exploitation:

• If a guardian is legally responsible for a PwD’s data, they may act in their own interest, rather than the PwD’s.

Digital Accessibility Issues:

• A 2023 Vidhi Centre for Legal Policy study found that popular apps like Paytm, Swiggy, Zomato, and Flipkart have low accessibility scores.

The primary barrier for PwDs online is still lack of accessible digital platforms, not consent issues.

The Way Forward

• Disability rights activists, led by figures like Nipun Malhotra of the Nipman Foundation, are pushing for amendments to Section 9(1). Instead of presuming incapacity, they argue that the law should:
• Clearly differentiate between full and limited guardianship.
• Allow PwDs to provide direct consent where they are capable.
• Ensure digital platforms become more accessible rather than imposing restrictive consent rules.

Conclusion

While the DPDP Act, 2023, is a landmark step in personal data protection, its implementation for PwDs remains problematic. By assuming that legal guardianship equates to incapacity, the law risks violating PwDs’ digital rights and reinforcing outdated notions of dependence.

The government must engage with disability rights organizations and revise the rules to ensure that the digital world is inclusive, accessible, and respects the autonomy of PwDs.