white_paper_on_data_protection_in_india_171127_final_v2

down consent by providing individuals to opt-out of certain data use practices (such as
receiving marketing communications or not permitting a particular use of their information),
however, this is still relatively uncommon. Consent notices are usually an all-or-nothing
package with no modulations ordinarily permitted.
(iii) Notice Fatigue
Some critics of the notice and choice mechanism claim that this system is impractical. There
are too many notices to keep track of, considering that an ordinary user visits hundreds of
websites in one day. 451 Expecting an individual to read all of these notices is likely to be an
extremely time consuming exercise. An individual may be able to manage their privacy quite
well if only a few entities are involved. However, this is usually not the case, and keeping
track of all the notices encountered by an individual contributes to the individual‘s burden. 452
Additionally, as discussed in the section on consent, even if an individual is able to make a
rational decision about sharing a particular piece of information at one time, she may not be
able to predict how this information will be combined with other pieces of information in the
future. This is an especially relevant problem with the advent of data mining and predictive
analytics. 453
(iv) Problems in Notice Design
Some scholars believe that the reason for the failure of an effective notice is due to problems
in its design. Long and text-heavy notices may not be the most efficient means of conveying
relevant information to individuals. In many instances, the notice is not designed keeping the
intended audience in mind, which may be a regulator, or the consumer. Notices, which are
designed keeping the regulator in mind, may prove difficult for an ordinary user to navigate.
Collection and use of an individual‘s information is no longer limited to websites and mobile
applications. A host of ―smart devices‖, such as fitness trackers, video game systems and
speakers collect user‘s information on a continuous basis. Ordinarily, the privacy notices of
such devices are decoupled from the device itself and are posted on the data controller‘s
websites. This may not be the most effective way of informing the user of the devices data
collection and use policies. Keeping the above in mind, there may be a need to develop better
notice design or to question whether the use of notices is in fact the correct solution to the
problem.
451 See generally: Aleecia M. McDonald and Lorrie Cranor, ‗The Cost of Reading Privacy Policies‘, 4(3) I/S: A
Journal of Law and Policy for the Information Society 544 (2008), available at:
http://lorrie.cranor.org/pubs/readingPolicyCost-authorDraft.pdf, (last accessed 22 October 2017).
452 Joel R. Reidenberg et al., ‗Privacy Harms and the Effectiveness of the Notice and Choice Framework‘, 11(2)
Journal of Law and Policy for the Information Society, 486, 492 (2015), available at:
https://kb.osu.edu/dspace/bitstream/handle/1811/75473/ISJLP_V11N2_485.pdf?sequence=1, (last accessed 22
October 2017).
453 Daniel Solove, ‗Privacy Self-management and the Consent Dilemma‘, 126 Harvard Law Review 1880, 1886,
(2013).
94