white_paper_on_data_protection_in_india_171127_final_v2

CHAPTER 3: NOTICE
3.1 Introduction
The role of consent in data protection law has been discussed in detail in Part III, Chapter 1 of
the White Paper. Consent is operationalised through the mechanism of ―notice and choice‖.
The underlying philosophy is that consent through notice puts the individual in charge of the
collection and subsequent use of her personal information. 443 The notice is a presentation of
terms of the agreement by the data controller, whereas the choice is an action by the
individual signifying the acceptance of the terms (such as when an individual clicks the ―I
agree‖ button on a website). Notice purports to respect the basic autonomy of the individual
by arming her with relevant information and placing the ultimate decision of whether or not
her personal information is to be used or not, in her hands. 444
Notice and choice are popular data protection measures as they are more flexible, inexpensive
to implement, and easier to enforce. 445 For instance, where the services offered by a data
controller are very diverse; a regulator may not be able to analyse in-depth, the likelihood of
harms it may cause to an individual. However, where the data controller‘s data policies are
available through a notice, it performs the function of informing the individual, who can then
determine for herself whether or not signing-up for the service is an acceptable trade-off for
her personal information.
In India, several organisations have proactively taken privacy initiatives by adopting several
global best practices in the matter of obtaining consent through privacy notices, even without
a legal requirement to do so. However, when the concept of a privacy notice itself is in
question, such steps will have to be reassessed. Particularly, in a country as vast as India, with
large sections to the citizenry being unable to comprehend the contents of such notices, it
would, at the very least, be necessary to take further steps to improve existing practices in this
regard.
3.2 Issues
The concepts of notice and choice were first introduced at a time when computerised
databases were just beginning to be used widely. There were only a few ways in which
organisations could collect and use individual‘s information. Data use and transfers had not
become as ubiquitous as they are now. Therefore, although the use of the notice and choice
443 Ryan M. Calo, ‗Against Notice Skepticism in Privacy (and Elsewhere)‘, 87(3) Notre Dame Law Review
1027, 1049 (2012), available at: http://scholarship.law.nd.edu/cgi/viewcontent.cgi?article=1020&context=ndlr,
(last accessed 21 October 2017).
444 Ryan M. Calo, ‗Against Notice Skepticism in Privacy (and Elsewhere)‘, 87(3) Notre Dame Law Review
1027, 1049 (2012), available at: http://scholarship.law.nd.edu/cgi/viewcontent.cgi?article=1020&context=ndlr,
(last accessed 21 October 2017).
445 Ryan M. Calo, ‗Against Notice Skepticism in Privacy (and Elsewhere)‘, 87(3) Notre Dame Law Review
1027, 1048 (2012), available at: http://scholarship.law.nd.edu/cgi/viewcontent.cgi?article=1020&context=ndlr,
(last accessed 21 October 2017).
92