white_paper_on_data_protection_in_india_171127_final_v2

subject in relation to the data controller. 577 Further, an individual has the right to access her
personal data which includes the right to confirm whether her personal data is being
processed or not, and in the event that it is, information concerning the purpose of processing,
the categories of personal data being processed, the recipients of such personal data, the
period of storage of personal data, meaningful information about the logic behind automated
decisions amongst others. 578 Additionally, an individual has the right to seek rectification of
her data, subject to certain grounds and exceptions. 579
United Kingdom
Under the UK DPA an individual has the right to access personal data which includes the
right to be informed about whether one‘s personal data is being processed, and in the event it
is, the description of such personal data, the purpose of processing and the recipients to whom
such data may be disclosed. 580 Also, where processing was based on automatic means for the
purpose of taking evaluative decisions about the individual which may significantly affect
her, then the logic behind such decision must be made available. 581 Further, in the event that
her personal data is inaccurate, an individual has the right to approach the appropriate court
for an order which directs the data controller to rectify, block, erase or destroy those data. 582
However, these rights are subject to exceptions.
Canada
The principle of individual access is contained in Schedule 1 583 of PIPEDA. The principle of
individual access allows an individual, upon request, to be informed of the existence, use and
disclosure of her personal information. 584 Further, an individual can challenge the accuracy
and completeness of her information and have it amended. 585 However, there can be
exceptions to individual access. These exceptions have to be limited and specific and can
include situations such as the disclosure of such information is prohibitively costly, amongst
others. 586
Australia
Under the Privacy Act, an individual has the right to access personal information held by an
organisation. However, such right is not absolute and is subject to exceptions. If the
organisation is a government body then disclosure can be refused under the Freedom of
577 Article 13, EU GDPR.
578 Article 15, EU GDPR.
579 Article 16, EU GDPR.
580 Section 7, UK DPA.
581 Section 7(1)(d), UK DPA.
582 Section 14, UK DPA.
583 Schedule 1 of the PIPEDA houses the ―National Standard of Canada Entitled Model Code for Protection of
Personal Information‘.
584 4.9, Principle 9, Schedule 1, PIPEDA.
585 4.9, Principle 9, Schedule 1, PIPEDA.
586 4.9, Principle 9, Schedule 1, PIPEDA.
126