white_paper_on_data_protection_in_india_171127_final_v2

PIPEDA does not specifically deal with sensitive information. It provides that the form of
consent sought by organisations may vary depending on the circumstances of use and the type
of information. An organisation would have to seek express consent, when the information is
likely to be considered sensitive. For instance, medical records and income records are almost
always considered to be sensitive. Any information could be considered sensitive based on
the context in which it is used. 526 For instance, collecting names of individuals for magazine
subscriptions will not be problematic. However, releasing a list of names of individuals who
subscribe to a special-interest magazine may be problematic, as it could lead to identification
and discrimination against those individuals. This method of handling sensitive information
could be problematic as it shifts the burden on the organisation to determine whether a
particular use would cause harm, and this analysis would vary on a case-to-case basis.
United States
Although there is no broad definition of what constitutes ―sensitive data‖ in the US, several
sector-specific laws and guidelines implement safeguards where it may be considered
necessary. For instance the FTC‘s Behavioural Advertising Principles 527 suggest that website
operators should obtain the express affirmative consent of the consumer before using
sensitive consumer data, which may include financial data, data relating to children, health
information, and precise geographic information. 528 The Fair Credit Reporting Act limits how
consumer reports and credit card account numbers can be used and disclosed, although it does
not term them as ―sensitive‖. 529 HIPAA regulates medical information and how it may be
collected and disclosed. 530 The Security Standards for the Protection of Electronic Health
Information (HIPAA Security Rule) provides standards for protecting medical data. For
instance, there are specific rules, which regulate the disclosure of psychotherapy notes, even
for the purpose of medical treatment. 531
Therefore, largely the approach of most jurisdictions is to identify and carve out categories
and types of information, which are considered sensitive. These categories of information are
then protected by certain safeguards, which limit their collection, use and disclosure, in order
to mitigate harm to the individual.
6.4 Provisional Views
526 Schedule 1, Section 4.3.4, Principle 3- Consent, PIPEDA.
527 FTC , ‗FTC Staff Report: Self-Regulatory Principles for Online Behavioural Advertising‘ (February 2009),
available at: https://www.ftc.gov/sites/default/files/documents/reports/federal-trade-commission-staff-reportself-regulatory-principles-online-behavioral-advertising/p085400behavadreport.pdf,
(last accessed 30 October
2017).
528 FTC , ‗FTC Staff Revises Online Behavioural Advertising Principles‘ (12 February 2009), available at:
https://www.ftc.gov/news-events/press-releases/2009/02/ftc-staff-revises-online-behavioral-advertisingprinciples,
(last accessed 30 October 2017).
529 15 USC Section 1681.
530 42 USC Section 1301.
531 HIPAA Privacy Rule.
115