white_paper_on_data_protection_in_india_171127_final_v2

South Africa
The POPI Act provides very detailed prescriptions as to what information must included in
the notice at the time of collection of personal data from the individual. It mandates that the
data controller must take all steps which are reasonably practicable to ensure that all
necessary information is provided to the individual, including the type of information being
collected, the purpose for which information is being collected, to whom the information will
be disclosed, and so on. 461
Canada
PIPEDA provides that purposes for which personal information is collected must be
identified by the collecting organisation at or before the time the information is collected. It
goes on to say that the identified purposes should be specified either orally or in writing, at
the time that the information is collected. 462 The Privacy Commissioner has issued certain
guidelines for online consent, which require that organisations must be fully transparent about
their privacy practices and disclose what information they are collecting, what it will be used
for and with whom it will be shared. 463 The guidelines attempt to address difficulties relating
to notice readability, comprehension and access, by providing that it must contain clear
explanations, language at an appropriate reader level, informing users in advance if an
organisation intends to change its data use, etc.
Australia
The APPs, which form part of the Privacy Act suggest that all entities must have a ―clearly
expressed and up to date‖ privacy policy regarding how personal information is managed by
the entity. The policy should also specify what types of information the entity collects and
holds, the purposes for which it is collected, and how this information will be used and
disclosed. The privacy policy must also be available free of charge and in whatever form as
may be considered appropriate. 464 Further, the APPs also require that any entity, which
collects personal information about an individual, must take reasonable steps to notify the
information about the information collected as soon as possible, and to ensure that the
individual is aware that such information is being collected. 465
United States
The privacy laws in the US are sector-specific. Several of these laws mandate the form and
substance of what information a privacy notice must contain. For instance, in order to ensure
easy accessibility of the notice, laws such as California Online Privacy Protection Act, 2003
461 Section 18, POPI Act.
462 Principle 2, Paragraph 4.2.3, PIPEDA.
463 Office of the Privacy Commissioner of Canada, ‗Guidelines for Online Consent‘(May 2014), available at:
https://www.priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/gl_oc_201405/, (last accessed
23 October 2017).
464 Paragraphs 1.3, 1.4 and 1.5, APP 1, Privacy Act.
465 Paragraph 5.1 and 5.2, APP 5, Privacy Act.
96