white_paper_on_data_protection_in_india_171127_final_v2

CHAPTER 6: PROCESSING OF SENSITIVE PERSONAL DATA
6.1 Introduction
Data protection law deals with the protection of personal data of an individual. Personal data
is understood as information relating to an identified or identifiable natural person. An
identified person is one who can be identified directly or indirectly, with reference to one or
more factors, which are specific to her physical, physiological, mental, economic, cultural or
social identity. 508 Some of these identifying factors play an important role in forming an
integral part of the individual‘s personality and being. They refer to certain characteristics
that define one‘s essence as a human being and contribute to the individual‘s dignity,
integrity, personal autonomy and independence. 509 These may include aspects such as
individual‘s religious beliefs and sexuality.
It may be intuitively understood that an individual would consider it important to protect
information relating to such core aspects of her being from being used or disclosed in a
manner likely to cause harm to her. In order to prevent harm, it may be necessary to
categorise the types of information, which form an integral part of an individual‘s identity.
The harms arise, of course, because information of the individual becomes available to others
through a wide range of activities, collectively termed ―data processing‖. 510 The aspect of
informational privacy, which allows the individual to determine the manner and purpose their
personal information should be used, becomes particularly important with respect to these
types of information. For instance, in some circumstances, disclosure of such information, is
more likely to lead to discrimination, ridicule and reputational harm, especially where one‘s
beliefs and choices form part of the minority view in society. This in turn would cause greater
harm to the person in the form of loss of dignity and personhood. 511 Disclosure of certain
types of inflammatory and sensitive information, even where the information is true, could
result in the stereotyping and pre-judging of persons, which may affect their ability to fully
develop their personality. 512
In order to guard against such harms, some jurisdictions recognise the necessity for certain
pre-identified categories within the scope of personal data to grant individuals extra
protection against misuse of these types of information, by prohibiting the collection, use and
disclosure of this information without the explicit consent of the individual, or only for
508 Article 4(1), EU GDPR.
509 Edward J. Bloustein, ‗Privacy as an Aspect of Human Dignity- An Answer to Dean Prosser‘, 36 New York
University Law Review 962 (1964).
510 Data Processing can be understood as ―any operation or set of operations which is performed upon personal
data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or
alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available,
alignment or combination, blocking, erasure or destruction‖, Article 4(2), EU GDPR.
511 Edward J. Bloustein, ‗Privacy as an Aspect of Human Dignity- An Answer to Dean Prosser‘, 36 New York
University Law Review 962 (1964).
512 Robert C Post, ‗Three Concepts of Privacy‘ 89 Texas Law Review 2087 (2001), citing Jeffrey Rosen, ‗The
Unwanted Gaze: The Destruction of Privacy in America‘ (2000).
111