white_paper_on_data_protection_in_india_171127_final_v2

6. Similarly, having a ‗consent dashboard‘ could help individuals easily view which
organisations have been provided with consent to process personal information and how
that information has been used.
3.5 Questions
1. Should the law rely on the notice and choice mechanism for operationalising consent?
2. How can notices be made more comprehensible to individuals? Should government
data controllers be obliged to post notices as to the manner in which they process
personal data?
3. Should the effectiveness of notice be evaluated by incorporating mechanisms such as
privacy impact assessments into the law?
4. Should the data protection law contain prescriptive provisions as to what information a
privacy notice must contain and what it should look like?
Alternatives:
a. No form based requirement pertaining to a privacy notice should be prescribed by
law.
b. Form based requirements may be prescribed by sectoral regulators or by the data
protection authority in consultation with sectoral regulators.
5. How can data controllers be incentivized to develop effective notices?
Alternatives:
a. Assigning a ‗data trust score‘.
b. Providing limited safe harbor from enforcement if certain conditions are met.
If a ‗data trust score‘ is assigned, then who should be the body responsible for providing
the score?
6. Would a consent dashboard be a feasible solution in order to allow individuals to easily
gauge which data controllers have obtained their consent and where their personal data
resides? Who would regulate the consent dashboard? Would it be maintained by a third
party, or by a government entity?
7. Are there any other alternatives for making notice more effective, other than the ones
considered above?
98