Section 6 Consent
6. (1) The consent given by the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for the specified purpose and be limited to such personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data as is necessary for such specified purpose.
Illustration
X, an individual, downloads Y, a telemedicine app. Y requests the consent of X for (i) the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for making available telemedicine services, and (ii) accessing her mobile phone contact list, and X signifies her consent to both. Since phone contact list is not necessary for making available telemedicine services, her consent shall be limited to the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for making available telemedicine services.
(2) Any part of consent referred in sub-section (1) which constitutes an infringement of the provisions of this Act or the rules made thereunder or any other law for the time being in force shall be invalid to the extent of such infringement.
Illustration
X, an individual, buys an insurance policy using the mobile app or website of Y, an insurer. SheDefined in section 2(y): she in relation to an individual includes the reference to such individual irrespective of gender gives to Y her consent for (i) the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data by Y for the purpose of issuing the policy, and (ii) waiving her right to file a complaint to the DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Protection BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 of India. Part (ii) of the consent, relating to waiver of her right to file a complaint, shall be invalid.
(3) Every request for consent under the provisions of this Act or the rules made thereunder shall be presented to the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf in a clear and plain language, giving her the option to access such request in English or any language specified in the Eighth Schedule to the Constitution and providing the contact details of a Data Protection OfficerDefined in section 2(l): Data Protection Officer means an individual appointed by the Significant Data Fiduciary under clause (a) of sub section (2) of section 10, where applicable, or of any other personDefined in section 2(s): person includes (i) an individual; (ii) a Hindu undivided family; (iii) a company; (iv) a firm; (v) an association of persons or a body of individuals, whether incorporated or not; (vi) the State; and (vii) every artificial juristic person, not falling within any of the preceding sub clauses authorised by the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data to respond to any communication from the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf for the purpose of exercise of her rights under the provisions of this Act.
(4) Where consent given by the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf is the basis of processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data, such Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf shall have the right to withdraw her consent at any time, with the ease of doing so being comparable to the ease with which such consent was given.
(5) The consequences of the withdrawal referred to in sub-section (4) shall be borne by the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf, and such withdrawal shall not affect the legality of processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data based on consent before its withdrawal.
Illustration
X, an individual, is the user of an online shopping app or website operated by Y, an e-commerce service provider. X consents to the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data by Y for the purpose of fulfilling her supply order and places an order for supply of a good while making payment for the same. If X withdraws her consent, Y may stop enabling X to use the app or website for placing orders, but may not stop the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... for supply of the goods already ordered and paid for by X.
(6) If a Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf withdraws her consent to the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data under sub-section (5), the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall, within a reasonable time, cease and cause its DataDefined in section 2(h): data means a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation or processing by human beings or by automated means Processors to cease processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of such Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf unless such processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... without her consent is required or authorised under the provisions of this Act Consent. or the rules made thereunder or any other law for the time being in force in India
Illustration
X, a telecom service provider, enters into a contract with Y, a Data ProcessorDefined in section 2(k): Data Processor means any person who processes personal data on behalf of a Data Fiduciary, for emailing telephone bills to the customers of X. Z, a customer of X, who had earlier given her consent to X for the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of her personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data for emailing of bills, downloads the mobile app of X and opts to receive bills only on the app. X shall itself cease, and shall cause Y to cease, the processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of the personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data of Z for emailing bills.
(7) The Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf may give, manage, review or withdraw her consent to the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data through a Consent ManagerDefined in section 2(g): Consent Manager means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform.
(8) The Consent ManagerDefined in section 2(g): Consent Manager means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform shall be accountable to the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf and shall act on her behalf in such manner and subject to such obligations as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
(9) Every Consent ManagerDefined in section 2(g): Consent Manager means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform shall be registered with the BoardDefined in section 2(c): Board means the Data Protection Board of India established by the Central Government under section 18 in such manner and subject to such technical, operational, financial and other conditions as may be prescribedDefined in section 2(v): prescribed means prescribed by rules made under this Act.
(10) Where a consent given by the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf is the basis of processingDefined in section 2(x): processing in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure... of personal dataDefined in section 2(t): personal data means any data about an individual who is identifiable by or in relation to such data and a question arises in this regard in a proceedingDefined in section 2(w): proceeding means any action taken by the Board under the provisions of this Act, the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data shall be obliged to prove that a notice was given by her to the Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf and consent was given by such Data PrincipalDefined in section 2(j): Data Principal means the individual to whom the personal data relates and where such individual is (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf to the Data FiduciaryDefined in section 2(i): Data Fiduciary means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data in accordance with the provisions of this Act and the rules made thereunder.