Vol.16 Issue 1 (2020)
Protecting Privacy in India: The roles of consent and fairness in data protection
Mark J Taylor and Jeannie Marie Paterson
The Indian Personal Data Protection Bill 2019 provides a unique approach to balancing the elements of individual consent and fairness-based limitations that are used in data protection regimes in other parts of the world. Drawing on the fundamental values and interests recognised in KS Puttaswamy v. Union of India (2017) and the report of the Committee of Experts, the Bill requires consent of the data subject to data processing, and puts in place standards that consent must meet to be more than a forced formality. Its novelty lies in also proposing substantive obligations of fair and reasonable data processing, and by making organisations responsible, as statutory ‘data fiduciaries’, for complying with obligations protecting the interests of the data subject. The requirement that processing be fair, also written into European data protection law, is an opportunity to put data controllers under an obligation to protect the interests of data subjects. Data processing ought not to have a negative impact upon an individual’s interests, values and freedoms disproportionate to their positive gains. If robustly interpreted and applied, this could be an effective protection against the shortcomings of consent as a safeguard for protecting individual interests. European data protection law has yet to fully embrace this opportunity. If it did, then there would be less pressure to ensure a data subject’s consent meets ideal standards of ‘free and informed’, which is increasingly unrealistic in a modern information society.
Considering the merits of these different approaches, with different degrees of relative emphasis upon individual consent and objective tests of fairness, prompts reflection upon the proper function of privacy and data protection legislation within society. Is it purely to enable individual expressions of informational self-determination — irrespective of whether the deal done is a good one? Or does data protection law also have a role in expressing community expectations by promoting norms and standards of fair dealing that are conducive to individual well-being and to civil society as a whole?
Associate Professor in Health Law and Regulation, Melbourne Law School, University
of Melbourne, Australia. ** Professor, Melbourne Law School, University of Melbourne, Australia.