white_paper_on_data_protection_in_india_171127_final_v2

Therefore, there may be a need to designate certain ―lawful‖ grounds under which data can be
processed, even in the absence of consent.
(ii)
Lack of clarity with respect to certain grounds of processing, such as ―public interest‖,
―vital interest‖ and ―legitimate interest‖.
Certain grounds of lawful processing, such as consent and performance of contract may be
intuitively considered necessary for data processing. However, other grounds such as ―public
interest‖, ―vital interest‖ and ―legitimate interest‖, as lawful grounds of processing may not
provide sufficient clarity as to what the intended scope of these grounds are. These grounds
originated in the EU, and the Working Party opinion give some clarity as to how these
grounds should be interpreted. 470 However, in the absence of interpretative guidelines, it may
not be possible to import these grounds to the Indian context without some modification.
Whether these six grounds of processing, as provided under the EU GDPR, are sufficient, or
whether there is a need to include other grounds of processing, more suitable to the India‘s
specific data processing activities may also need to be examined.
4.3 International Practices
European Union
The EU GDPR 471 provides that personal data may be lawfully processed based on the data
subject‘s consent, or on the basis of five other grounds. These five grounds are: (i)
performance of a contract with the data subject; (ii) compliance with a legal obligation
imposed on the controller; (iii) protection of vital interests of the data subject; (iv)
performance of a task carried out in the public interest; and (v) legitimate interests pursued by
the controller, subject to an additional balancing test against the data subject‘s rights and
interests. 472 A EU Working Party opinion clarifies that there does not appear to be any legal
distinction among these grounds, and there is no indication that these grounds must be applied
in any particular order, or that any one ground is more important than the other. 473
Each of the five additional grounds of processing is described in detail below:
(i)
Performance of Contract
470 Article 29 Data Protection Working Party, ‗Opinion 06/2014 on the notion of legitimate interests of the data
controller under Article 7 of Directive 95/46/EC‘, European Commission (9 April 2014), available at
http://ec.europa.eu/justice/data-protection/article-29/documentation/opinionrecommendation/files/2014/wp217_en.pdf,
(last accessed 28 October 2017).
471 Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons
with regard to the processing of personal data and on the free movement of such data.
472 Article 7(a)-(f), EU GDPR.
473 Article 29 Data Protection Working Party, ‗Opinion 06/2014 on the notion of legitimate interests of the data
controller under Article 7 of Directive 95/46/EC‘, European Commission (9 April 2014), available at
http://ec.europa.eu/justice/data-protection/article-29/documentation/opinionrecommendation/files/2014/wp217_en.pdf,
(last accessed 28 October 2017).
100