white_paper_on_data_protection_in_india_171127_final_v2

(CALOPPA) 466 and the GLB Act require that websites and financial institution post ―clear
and conspicuous‖ privacy notices. In order to ensure their visibility, and to draw user
attention, the hyperlinks to the notices must be in a contrasting colour and font. To ensure that
users understand the organisations‘ data use practices, these legislations make it mandatory
for the notice to contain certain types of information, such as the identity of the data
controller, the categories of personal information collected, whether this information will be
shared with third parties, and so on. The GLB Act goes one step further, through its Privacy
Rule, provides samples of model notices, which organisations can rely while creating their
own notices. The Privacy Rule further specifies the language, which must be used while
preparing a notice, and warns against the use of unnecessarily complicated legal jargon.
From the above, it is clear that despite its flaws, notice and choice continue to play a central
role in many data protection laws. Some jurisdictions have attempted to address issues
relating to notice complexity and incomprehensibility by requiring that unnecessarily
complicated language not be used. The data protection laws of some jurisdictions also
prescribe requirements regarding the form and substance of a notice. Despite these measures,
countries are still struggling with issues relating to flaws in notice design and notice fatigue.
Codes of practice and guidelines issued by a data protection authority provide some clarity on
how notice can be made more effective.
3.4 Provisional Views
1. Mandatory notice is a popular form of privacy self-management, which plays a role in
most data protection laws. Notice is important as it operationalises consent.
2. The law may contain requirements regarding the form and substance of the notice.
3. The data protection authority could play an important role by issuing guidelines and
codes of practice that could provide guidance to organisations on the best way to design
notices, so that it conveys relevant information in the most effective manner to
individuals. This may include giving advice on how to redesign notices, making them
multi-layered and context specific, informing them of the importance that timing plays
while providing notices, etc. This may be further bolstered by sectoral regulators as
well.
4. Privacy Impact Assessment or other enforcement tools may take into account the
effectiveness of notices issued by organisations.
5. In order to address issues relating to notice fatigue, assigning every organisation may be
assigned a ―data trust score‖ (similar to a credit score), based on their data use policy.
466 California Online Privacy Protection Act, Education Foundation: Consumer Federation of California,
available at: https://consumercal.org/about-cfc/cfc-education-foundation/california-online-privacy-protectionact-caloppa-3/,
(last accessed 26 October 2017).
97