white_paper_on_data_protection_in_india_171127_final_v2

vexatious requests thus putting a strain on resources. 567 The increased compliance cost may
prove to be particularly difficult for small and medium organisations to bear.
(ii)
Technical Challenges
Another challenge facing the implementation of individual participation rights pertains to data
controllers holding large volumes of data in unstructured formats such as emails. Data
controllers not only hold large volumes of electronic data but they also hold them in a number
of different formats and often a mixture of different types of data. 568 For instance, an
organisation may have a billion emails which may contain information on a number of
different topics and individuals. 569 As a consequence, extracting information about a specific
individual from such a large and complex mass of data is challenging. Similarly government
bodies may hold vast stores of data that relate to a variety of inter-related functions. The same
may be true for some organisations which derive personal information from non personal data
trails. In such situations, responding to a broad individual access request for ―all‖ personal
data pertaining to an individual can be extremely difficult. 570
(iii) Logic behind automated decisions
The right to access in most EU jurisdictions includes the right to access the logic behind
automated decisions. Automated decision making has come under tremendous scrutiny since
it involves algorithm based decisions without any human intervention. A research <strong>paper</strong> by
Alan Turing Institute and the University of Oxford argues that meaningful implementation of
this particular right is not feasible since the information required to be communicated to the
individual who exercises this right is likely to be heavily limited by factors such as trade
secrets and interests of the processing organisations. 571 As a result, a person turned down for a
credit card might only be told that the algorithm took their credit history, age and postcode
into account, while not specifying why their application was rejected, i.e. the logic behind
automated processing. 572
567 Kingston Smith Consulting, ‗The Right to be Forgotten and the problems with Unstructured Data‘ (20 May
2014), available at: https://www.kingstonsmith.co.uk/wp-content/uploads/2016/04/SubjectAccessRequests.pdf
(last accessed 22 October 2017).
568 Kingston Smith Consulting, ‗The Right to be Forgotten and the problems with Unstructured Data‘ (20 May
2014), available at: https://www.kingstonsmith.co.uk/wp-content/uploads/2016/04/SubjectAccessRequests.pdf
(last accessed 22 October 2017).
569 Kingston Smith Consulting, ‗The Right to be Forgotten and the problems with Unstructured Data‘ (20 May
2014), available at: https://www.kingstonsmith.co.uk/wp-content/uploads/2016/04/SubjectAccessRequests.pdf
(last accessed 22 October 2017).
570 Kingston Smith Consulting, ‗The Right to be Forgotten and the problems with Unstructured Data‘ (20 May
2014), available at: https://www.kingstonsmith.co.uk/wp-content/uploads/2016/04/SubjectAccessRequests.pdf
(last accessed 22 October 2017).
571 Sandra Wachter et al., ‗Why a Right to Explanation of Automated Decision-Making Does Not Exist in the
General Data Protection Regulation‘, 7(2) International Data Privacy Law 76 (1 May 2017), available at:
https://academic.oup.com/idpl/article/7/2/76/3860948 (last accessed 18 November 2017).
572 Ian Sample, ‗AI watchdog needed to regulate automated decision-making say experts‘, The Guardian, (27
January 2017) available at: https://www.theguardian.com/technology/2017/jan/27/ai-artificial-intelligencewatchdog-needed-to-prevent-discriminatory-automated-decisions,
(last accessed 22 October 2017).
124