white_paper_on_data_protection_in_india_171127_final_v2

existing technology in order to be able to provide data subjects with their personal data in a
machine readable format. 612 The feasibility of these rights will have to be carefully measured
in light of the above concerns.
(ii)
Inchoate nature of rights
A lack of understanding about the provisions of the EU GDPR continues to persist across
business. For instance, the contours of the right to data portability continues to remain vague.
Under the right to data portability, the data must be provided by an individual to the
organisation. The scope of the term ―provided by‖ is still unsettled. The Article 29 Working
Party Opinion accords a broad interpretation to ―provided by‖ as including 613 :
a. Data provided actively and knowingly by the individual; and
b. Observed data which is provided by the individual by the virtue of the use of service or
device.
However, the European Commission has expressed concerns over this broad interpretation
since it goes beyond intended legislative scope, 614 thus heightening the confusion around this
right. The same concern is present in relation to the right to not to be subject solely to
automated decision-taking, its contours and exceptions.
Finally, since the new individual participation rights introduced by the EU GDPR have not
been implemented in any jurisdiction, there is no precedent available for India when it comes
to translating these principles into concrete statutory provisions. That said, the principle of
placing the individual in control of her data is at the core of India‘s digital philosophy and the
fact that there is no prior experience elsewhere in the world should not come in the way of
preparing a sui generis legislative framework to reflect this principle.
(iii) Unsuitability for India
Rights such as the right to object to processing can only be exercised when the ground for
processing is in exercise of official authority or in public interest, or legitimate interest of the
organisation. These two grounds of processing are particularly unique to the EU, and thus
be forgotten‘, The Guardian (10 July 2014), available at:
https://www.theguardian.com/commentisfree/2014/jul/10/right-to-be-forgotten-european-ruling-google-debate,
(last accessed 24 October 2017).
612 Ministry of Justice, UK, ‗Impact Assessment of Proposal for an EU Data Protection Regulation‘ (22
November 2012), available at: https://consult.justice.gov.uk/digital-communications/data-protection-proposalscfe/results/eu-data-protection-reg-impact-assessment.pdf
, (last accessed 21 October 2017).
613 Article 29 Data Protection Working Party, ‗Guidelines on the Right to Data Portability‘, European
Commission (13 December 2016), available at:
http://ec.europa.eu/information_society/newsroom/image/document/2016-51/wp242_en_40852.pdf, (last
accessed 24 October 2017).
614 William RM Long and Thomas Fearon, ‗WP29 Adopts Final GDPR Guidelines on Data Portability‘, Sidley
Austin LLP (12 May 2017), available at: https://www.lexology.com/library/detail.aspx?g=0c8b6a0a-97eb-42aeb69c-17e971182f36,
(last accessed 21 November 2017).
132