Handling of child data in compliance with Data Protection Bill

[rahul101001000]

Does the spec need to address handling of child data, compliant with Clause 16 / Chapter VI in the data protection bill http://164.100.47.4/BillsTexts/LSBillTexts/Asintroduced/373_2019_LS_Eng.pdf

[pramodkvarma]

This will have to be done at workflow level, not at spec level. Once we get to a good shape on default consent flow reference implementation, we can enhance that for nominee/guardian consent instead of main account holder.

[rahul101001000]

Yes agree it can be done using the right workflow. Question in my mind is should this be part of the spec/guidelines?

If we had to put out a checklist that allows an implementer know whether they are spec compliant or not, would child data compliance be part of the registry spec checklist? In other words, can one be registry spec compliant without implementing a guardian consent workflow?

Same question goes for security, fraud handling, audit trail request guidelines.

[pramodkvarma]

Maybe part of recommended principles of registry architecture. Of course, within Sunbird RC implementation, we will eventually need to address this.