white_paper_on_data_protection_in_india_171127_final_v2

Information Act, 1982 or other appropriate laws/enactments. 587 If the organisation is a private
body then access can be refused on certain grounds, such as: belief that access would pose a
serious threat to the life, health or safety of any individual, or to public health or public safety
or that such access would have an unreasonable impact on the privacy of other, amongst
others. 588 Further in the event that the personal information held by the organisation is
inaccurate, not up-to-date, incomplete, irrelevant or misleading, then the individual has the
right to make a request to such entity to correct her personal data. 589
South Africa
Under the POPI Act an individual has the right to confirm if information about her is being
held by an organisation, and obtain a record of the information as well as identities of third
parties who have access to such information. 590 Access to information can be refused on
multiple grounds which are housed in another Act namely the Promotion of Access to
Information Act, 2000. Further the grounds for refusal of access are different for private and
public bodies. 591 Further, an individual can get an organisation to correct or delete data that is
inaccurate, irrelevant, excessive, out of date, incomplete, misleading or is obtained unlawfully
corrected/deleted. 592 This also includes the right to get data which the organisation is no
longer authorised to retain destroyed/deleted. 593
8.4 Provisional Views
1. The right to seek confirmation, access and rectify personal data allow an individual
control over data once such data has been collected by another entity. These rights may
be suitably incorporated. However these rights are harder to enforce in the context of
personal information that has been derived from the habits and observed behaviour of
the individual and other such inferred insights. This information is nevertheless
personal and an individual should be made aware of the fact that the data controller has
this sort of information.
2. Given that responding to individual participation rights can be costly for organisations,
and comes with its set of technical challenges, a reasonable fee may be imposed on
individuals when exercising these rights. This will also discourage frivolous and
vexatious requests. The fees may be determined via sector specific subsidiary
legislation or regulations. An illustration of this is the CIC Act under which the charge
for accessing a copy of a person‘s credit information report by a specified user is laid
down by the RBI via regulations.
587 Principle 12.2, Part 5 of Schedule 1, Privacy Act.
588 Principle 12.3, Part 5 of Schedule 1, Privacy Act.
589 Principle 13.1, Part 5 of Schedule 1, Privacy Act.
590 Section 23, POPI Act.
591 Section 23(4)(a), POPI Act.
592 Section 24(1)(a), POPI Act.
593 Section 24(1)(b), POPI Act.
127