white_paper_on_data_protection_in_india_171127_final_v2

3.3 International Practices
Despite certain flaws, the mechanism of notice and choice continue to be widely used across
many jurisdictions. These jurisdictions have attempted to address some of these flaws through
the practices described below:
European Union
The EU GDPR does not use the term ―notice‖ per se. 454 It provides that a data controller must
demonstrate that the data subject has consented to the processing of her information. 455 This
is done by ensuring that a ―request for consent‖ (which could be understood to mean a
notice), is presented in a manner clearly distinguishable from other matters in a concise,
intelligible and easily accessible form- using clear and plain language. 456 These provisions are
intended to ensure that the notice conveys necessary information in an easily comprehensible
manner, which is clear to the data subject. The EU GDPR‘s notice requirements are
prescriptive in nature, and contain details regarding the types of information, which must be
provided to the data subject, including the identity of the data controller, purpose of
processing, intended recipients of the data, among others. It attempts to make choice more
meaningful by indicating when delivery of the notice will be most effective, and additional
safeguards, which are to be followed when the information is not collected directly from the
data subject. 457
United Kingdom
UK DPA, provides that personal data must be processed fairly and lawfully. 458 The ICO has
issued some guidelines as to what this means. Being transparent and providing accessible
information to individuals about how their data will be used is critical. Transparency through
a privacy notice is an important part of fair processing. The ICO recognises that individuals‘
expectations of privacy have changed and very often using a single notice to convey the
necessary information will not be an effective approach to convey necessary information. It
has provided samples of what a good privacy notice and a bad privacy notice would look
like. 459 It recognises that use of innovative techniques, such as multi-layered notices are
helpful in conveying relevant information to users in a clear and accessible manner. Where
individuals have a choice, with respect to deciding whether their information can be used, the
privacy notice should give individuals the opportunity to exercise that choice. 460
454 Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons
with regard to the processing of personal data and on the free movement of such data.
455 Article 7(1), EU GDPR.
456 Article 7(2), EU GDPR.
457 Articles 12, 13 and 14, EU GDPR.
458 Schedule I, Part I, Paragraph 1, UK DPA.
459
ICO, ‗Good and Bad Examples of Privacy Notices‘, available at: https://ico.org.uk/media/fororganisations/documents/1625136/good-and-bad-examples-of-privacy-notices.pdf,
(last accessed 23 October
2017).
460 ICO, ‗Privacy Notices, Transparency and Control‘, available at: https://ico.org.uk/for-organisations/guide-todata-protection/privacy-notices-transparency-and-control/,
(last accessed 23 October 2017).
95