white_paper_on_data_protection_in_india_171127_final_v2

may continue to retain data for long periods of time on vague grounds such as ―improving
user experience‖ etc. On the other hand, an approach like section 67-C of the IT Act may not
be feasible either. Section 67-C requires intermediaries to preserve and retain information
only for such duration as prescribed by the Central Government. Different categories of
personal data may be required to be preserved for different periods of time. For instance,
under the IMC Code, medical information can be preserved for three years from the date of
commencement of treatment. 535 The Government will be burdened with the task of
prescribing different retention guidelines for different categories of data, and may not end up
performing this task satisfactorily. Similarly, the principle of data quality requires reasonable
steps to be taken to ensure accuracy of data. Here again, imprecision may result in
implementation challenges.
Further, for an organisation that holds large volumes of data across different formats,
adhering to an obligation to ensure accuracy of data may prove to be challenging. This may
have the unintended consequence of shifting the onus on to the individual to ensure her data
is accurate, which is not ideal, given the limited awareness and exercise of individual
participation rights. This also holds for the storage limitation principle, which will require
organisations to regularly review data in their possession and methodically cleanse their
databases 536 thus increasing the compliance burden.
(ii)
Modern technology and processing
As mentioned earlier, modern technology and big data analytics have revolutionised how data
is collected and used. Thus, the potential use of data may not be determinable at the time of
collection. 537 In this light, principles such as data retention may not be implementable since
one cannot store data for a specific time period since new purposes may be discovered post
collection of such data thereby requiring the organisation to hold onto the data indefinitely. In
this context the focus may need to shift to data security as well as alternative obligations such
as ensuring anonymization of data which in most circumstances should adequately achieve
the objectives of big data analytics that do not, by definition, require personal data.
7.3 International Practices
(i)
Storage Limitation
European Union
The EU GDPR does not allow personal data to be stored in a form that permits the
identification of individuals for a period longer than required unless such data is processed
535 Regulation 1.3, IMC Code.
536 Karin Tien et al., ‗The data protection principles under the General Data Protection Regulation‘, Taylor
Wessing (November 2016), accessed at: https://united-kingdom.taylorwessing.com/globaldatahub/article-thedata-protection-principles-under-the-gdpr.html,
(last accessed 5 November 2017).
537 Jordi Soria-Comas and Josep Domingo-Ferrer, ‗Big Data Privacy: Challenges to Privacy Principles and
Models‘, 1(1) Data Science and Engineering (March 2016), available at:
https://link.springer.com/article/10.1007/s41019-015-0001-x (last accessed 31 October 2017).
118