white_paper_on_data_protection_in_india_171127_final_v2

data protection laws across jurisdictions also shows that there are three rights which form the
core of individual participation. 562 They are as follows:
a. The right to seek confirmation about whether one‘s personal data is being processed.
b. The right to access one‘s personal data, including details such as 563 : The purpose of
processing; the categories of data being processed; the period of storage; the rights visa-vis
the organisation; the right to lodge a complaint; the source from where the data
was collected, if it is not the individual; in case of automated decision making, the logic
involved behind such decision and its consequences.
c. The right to challenge the accuracy of one‘s personal data, and to have it amended.
Thus, the right of an individual to gain access to their personal data has historically been a
core requirement of data protection laws. This right allows an individual to determine if data
held about them is correct and is being handled lawfully. It also opens the door to exercise of
further rights, such as getting inaccurate data corrected. 564
8.2 Issues
(i)
Costly implementation
The implementation of individual participation rights are costly for data controllers. Some
data protection laws 565 permit data controllers to impose a fee for responding to individual
requests. However, these fees are negligible. It has been estimated that the cost for responding
to individual requests varies anywhere between GBP 50-100 per request (though some
stakeholders from the financial sector have estimated the cost to range between GBP 550-650
per request) in the UK. 566 Under the EU GDPR individual participation rights are exercisable
free of cost. There is concern that the abolition of fees will lead to an increase in frivolous and
561 OECD, ‗OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data‘ (2013),
available
at:
http://www.oecd.org/sti/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofpersonaldata.ht
m (last accessed 31 October 2017). The relevant individual participation rights contained herein include:
(a) to obtain from a data controller, or otherwise, confirmation of whether or not the data controller has data
relating to him;
(b) to have communicated to him, data relating to him within a reasonable time; at a charge, if any, that is not
excessive; in a reasonable manner; and in a form that is readily intelligible to him;
(c) to be given reasons if a request made under subparagraphs(a) and (b) is denied, and to be able to
challenge such denial; and
(d) to challenge data relating to him and, if the challenge is successful to have the data erased, rectified,
completed or amended.
562 Sally Annereau, ‗An Introduction to Subject Access Rights‘, Taylor Wessing (November 2013), available at:
https://united-kingdom.taylorwessing.com/globaldatahub/article_intro_sar.html, (last accessed 22 October
2017).
563 Illustrative list from Section 7, UK DPA.
564 Sally Annereau, ‗An Introduction to Subject Access Rights‘, Taylor Wessing (November 2013), available at:
https://united-kingdom.taylorwessing.com/globaldatahub/article_intro_sar.html, (last accessed 22 October
2017).
565 The UK DPA and The Dutch Personal Data Protection Act.
566 Ministry of Justice, UK, ‗Impact Assessment of Proposal for an EU Data Protection Regulation‘ (22
November 2012), available at: https://consult.justice.gov.uk/digital-communications/data-protection-proposalscfe/results/eu-data-protection-reg-impact-assessment.pdf
, (last accessed 21 October 2017).
123