Draft Data Protection Bill may create new challenges for OTT platforms

The Digital Personal Data Protection Bill, 2022, which is likely to be tabled in the parliament in July-August next year, may create new obstacles for the video streaming platforms or OTT services, with regard to specific requirements that pertain to processing of children’s personal data.

The Draft Bill says there should be no tracking or behavioural monitoring of children or advertising targeted at them. This, media experts say, will be hard to comply with in terms of how to take parental consent, see that it is not the child masquerading as an adult, and could also lead to inappropriate programming directed at them in a counter-productive way.

Further, platforms will have to factor in costs related to IT and security, compliance and manpower and educate customers on the safety of their data. Smaller players especially will need to establish robust governance framework.

“The risk, in this case, where there shall be no tracking or monitoring of child behaviour, is that children may be exposed to all kinds of content and could end up watching programming or advertising not even meant for them, making the whole process counter-productive,” said Supratim partner at legal firm Khaitan & Co.

For the purpose of processing any personal data of a child, platforms need to obtain verifiable “parental consent” which includes the consent of lawful guardian. “However, it is entirely possible that the child is logging in himself or herself to watch programming as per their liking,” said Gowree Gokhale, partner at Nishith Desai Associates who leads the IP, technology, media and entertainment law practice at the firm.

But, given that a lot of platforms simply require mobile numbers to log in, it may be difficult to track user behaviour, and whether it is a child logging in, said Akshay Bardapurkar, founder of OTT platform Planet Marathi. Services such as Netflix, Amazon Prime Video and Disney+ Hotstar did not respond to Mint’s queries on possible implications of compliance with the Draft Bill. Further ambiguity arises from the fact that while there is a financial penalty attached to non-compliance with the provisions, it doesn’t come with criminal liability, said Vinay Butani, partner at Economic Laws Practice.

To be fair, the draft bill has also simplified the data protection framework as compared to previous iterations upto a certain extent and those OTT platforms who are following global practices, may not find it particularly challenging, but is likely to increase the compliance requirements for most businesses, agreed Shahana Chatterji, partner, Shardul Amarchand Mangaldas & Co.

“OTT platforms may be able to meet their obligations without having to significantly alter their internal data protection practices. In particular, OTT platforms which operate across jurisdictions are likely to already have in place strong internal data protection practices that meet global standards, including appropriate notice and consent-related mechanisms,” Chatterji said.

However, some of the key provisions envisage that enterprises will have to create internal processes and a structured framework to ensure compliance. Basic requirements include, for example, giving a notice to the users on the type of personal data intended to be collected and the purpose of processing such data.

“One of the ways most OTT platforms may do this, is by releasing revised T&C (terms and conditions) that the users may need to accept. Smaller players need to establish robust governance framework. They will have to consider initial investments to build these processes, IT infrastructure and application costs and monitoring as well as redressal response mechanism,” said Chandrashekhar Mantha, partner, Deloitte India.