white_paper_on_data_protection_in_india_171127_final_v2

specific purposes and under special conditions. 513 Such types of data are termed ―sensitive‖,
and may include religious beliefs, physical or mental health, sexual orientation, biometric and
genetic data, racial or ethnic origin and health information.
6.2 Issues
(i)
Definition of ―sensitive data‖ as per the Sensitive Personal Data Rules
The SPDI Rules, framed under Section 43A of the IT Act place certain obligations on
individuals holding data in electronic form. The SPDI Rules seek to introduce internationally
accepted privacy principles, such as collection limitation, purpose specification, use limitation
and consent in the handling of ―sensitive personal information‖. 514 However, it may not be
possible to rely entirely on this definition from the perspective of possibility of abuse and
misuse. 515 Information relating to caste and religious beliefs of an individual would also need
to be examined, as they are especially relevant to the Indian context. There are other issues
relating to the scope of the SPDI Rules as they only applied to ―body corporates‖ and not to
other private and government entities, which may process sensitive personal data.
(ii)
Need to further examine the rationale behind certain categories of personal data
As discussed, certain types of information have been identified as sensitive because there is a
greater likelihood of harm caused to the individual if there is unauthorised collection, use and
disclosure of this information. In order to understand the rationale behind identifying certain
categories of information as sensitive, there may be a need to assess the harms, which are
likely to arise. In understanding harms, two categories are evident: intrinsic harms- for
instance, the harms caused by the disclosure of health information may be intrinsic, as a user
may not want her health information to be widely shared. Other harms are instrumental- e.g.
Sharing medical records could lead to discrimination, utilisation of this information by
pharmaceutical companies to send unwanted marketing information to these individuals etc.
On the other hand, payment instrument details are sensitive not necessarily because any
intrinsic harm is caused by disclosure of say, a credit card number, but rather because damage
513 Article 29 Data Protection Working Party, ‗Advice <strong>paper</strong> on special categories of data (―sensitive data‖)‘,
European Commission (4 April 2011), available at: http://ec.europa.eu/justice/data-protection/article-
29/documentation/otherdocument/files/2011/2011_04_20_letter_artwp_mme_le_bail_directive_9546ec_annex1_en.pdf,
(last accessed
29 October 2017).
514 Rule 3, SPDI Rules defines ‗sensitive personal data or information‘ to include: password; financial
information such as bank account or credit card or debit card or other payment instrument details; physical,
physiological and mental health condition; sexual orientation; medical records and history; biometric
information; any detail relating to the above provided to the organisation for providing service; and any of the
information received under the above by the organisation for processing, stored or processed under lawful
contract or otherwise.
515 Bhairav Acharya, ‗Comments on the Information Technology (Reasonable Security Practices and Procedures
and Sensitive Personal Data or Information) Rules, 2011‘, The Center for Internet & Society (CIS) (31 March
2013), available at: https://cis-india.org/internet-governance/blog/comments-on-the-it-reasonable-securitypractices-and-procedures-and-sensitive-personal-data-or-information-rules-2011,
(last accessed 29 October
2017).
112