90 • • • about the identity of the person if the characteristics of that person were stored in its database. The purpose and effect of legislation were necessary in determining the constitutionality of legislation. The respondents had demonstrated that the purpose of the impugned legislation was to setup an identification system and to the extent that it was necessary, it was constitutional. On whether NIIMS violated the rights of the Child, the court held that the reasons for registration of children in NIIMS were reasonable and laudable. They included national security concerns such as the need to combat terrorism, to enable the state to fulfil its obligations towards children under article 53 of the Constitution and to deal with the inadequacies presented by the birth certificate as an identifier for children in light of the fact that it only had a serial number and did not have children’s biometric data and was therefore not suitable as a means to combat child trafficking and child labour. The impugned amendments did not provide criminal sanctions for parents who were mandatorily required to register children. They only required the registration of children. Biometric data collected under NIIMS would apply to children as much as it would apply to adults. There was need for particular conditions that would apply to a child’s consent to the processing of data including provisions relating to the appropriate age for giving consent and informing the child in an appropriate manner of the implications of such consent. Where a child was incapable of giving consent, provision should be made for a person with parental responsibility over the child to give consent. Additionally, provision should be made for the status of the data given by the child upon attaining the age of majority and rights to that data also need to be addressed by legislation. No special protection was provided with respect to the biometric data collected from children under the impugned amendments, and there was clearly a risk of violation to children’s right as a result of that inadequacy. The Data Protection Act provided for the processing of personal data relating to a child. However, even the provisions of the Data Protection Act had gaps. There were no provisions relating to rights arising with respect to the data upon attaining the age of majority and the Act did not define who a child was. The impugned amendments did not include regulations on how data relation to children would be collected, processed and stored in NIIMS. Therefore, the legislative framework on the protection of children’s biometric data collected in NIIMS was inadequate and it needed to be provided for specifically. On whether NIIMS complied with data protection laws, the court held that the protection of personal data depended largely on a legal, regulatory and institutional framework that provided for adequate safeguards, including effective oversight mechanisms. NIIMS entailed a situation wherein vast amounts of personal data was accessible to the state and data subjects had limited insight into and control over how information about them and their lives was used. There were a number of areas in the Data Protection Act that required operationalization by way of regulations and they included circumstances when the data commissioner could exempt the operation of the Act, and could issue data sharing codes on the exchange of personal data between CITIZENSHIP AND NATIONALITY RIGHTS CASE DIGEST