white_paper_on_data_protection_in_india_171127_final_v2

mechanism still continues to play a critical role in data protection, several issues have arisen
over the years. These include:
(i)
Notice complexity and difficulty in comprehension
The notice and choice mechanism is often criticised for leaving users uniformed (or
misinformed) as people rarely see, read or understand privacy policies. 446 In several instances,
data controllers serve privacy notices in order to demonstrate their compliance with existing
data protection laws and serve as an indemnity against liability, rather than to genuinely
inform users about their data practices. In such circumstances, the notice often takes the shape
of very detailed and complicated documents, replete with legal jargon that is difficult for
ordinary users to understand. 447 Therefore, understanding such notices presents certain
cognitive problems that act as a hurdle to privacy-self management.
At the first instance, individuals may not even bother to read privacy notices. 448 When
individuals do manage to read the privacy notices, they are often so complicated, that
individuals may not be able to understand what is written in them. If individuals do manage to
read and understand privacy notices, they may lack sufficient specialised knowledge relating
to the manner in which their personal data will actually be used, which prevents them from
making an informed choice. And finally, even if they do succeed in doing all the above, the
individuals may lack the ability to adequately assess the consequences of agreeing to certain
uses and disclosures of their personal information. 449 This leads to the problem of skewed
decision making. 450
(ii)
Lack of Meaningful Choice
Most privacy notices inform individuals about the data practices of the data controller;
however, they do not offer much in the way of a real choice to the users. Using a website or a
mobile application is interpreted as having provided consent to the data controller‘s data
practices. This is also the case in the context of data collected and processed by the
government where, more often than not no notice is provided. If individuals wish to avail the
services being offered, they do not have much choice beyond accepting the terms of the
notice in its entirety. Some mobile applications and website developers do attempt to break
446 Daniel Solove, ‗Privacy Self-management and the Consent Dilemma‘, 126 Harvard Law Review 1880, 1885,
(2013).
447 Florian Schaub et al., ‗A Design Space for Effective Privacy Notices‘, USENIX Association, Symposium of
Usable Privacy and Security (2015), available at:
https://www.usenix.org/system/files/conference/soups2015/soups15-<strong>paper</strong>-schaub.pdf, (last accessed 22 October
2017).
448 Fred H, Cate, ‗Failure of Fair Information Principles‘, in ‗Consumer Protection in the Age of Information
Economy‘, 343, 361-62, (Jane K. Winn ed., Routledge, 2006) citing Helen Nissenbaum, ‗Privacy in Context-
Technology, Policy and the Integrity of Social Life‘ (Stanford University Press, 2010). (discussing a study that
only about 20% people read privacy notices ―most of the time‖).
449 Daniel Solove, ‗Privacy Self-management and the Consent Dilemma‘, 126 Harvard Law Review 1880, 1886,
(2013).
450 Daniel Solove, ‗Privacy Self-management and the Consent Dilemma‘, 126 Harvard Law Review 1880, 1887,
(2013).
93