white_paper_on_data_protection_in_india_171127_final_v2

such a right may be unsuitable in the Indian context unless similar grounds for processing are
deemed suitable for India (see Part III, Chapter 4 of this White Paper).
(iv) Overlap with sector-specific regulations
Data protection laws of several jurisdictions have special provisions for ‗direct marketing‘
which at times, supplement special laws for dealing with spam or telemarketers. For instance,
in the EU, the Privacy and Electronic Communication Directive 2002 deals with questions of
unsolicited communication. Similarly, in Australia in addition to provisions on direct
marketing in the Privacy Act, 615 there exists sector specific laws such as the Spam Act, 2003
and the Do Not Call Register Act, 2006. In Canada on the other hand, there is no specific
provision on direct marketing in the PIPEDA and it can be presumed that direct marketing
takes place on the ground of consent and consequently an individual can withdraw consent.
Canada however has an Anti-Spam Legislation 2014 that prohibits businesses from sending
―commercial electronic messages‖ to an individual without her consent. 616 In India, the TRAI
Regulations deals with unsolicited commercial communications. However, it is limited to
messages and other communication through phones, and would not cover an email
application or advertisements appearing on browsers. In light of this, a call needs to be taken
about whether direct marketing should be treated as a discrete privacy principle in India or
addressed via sector specific regulations.
(v)
Automated Decision Making
Provisions regarding automated decision making are missing vital safeguards. For instance,
an individual can only object to automated decisions which are processed solely by automated
means and which have ―legal or other significant effects‖. Such requirements significantly
limit the scope of the right since any human involvement in a decision-making process could
mean it is not ‗automated decision-making‘. 617 Similarly, issues could arise vis-a-vis the
terms like ―legal or significant effects‖ since their scope continues to be unsettled. 618 That
said, it should be kept in mind that such provisions must keep pace with technological
developments.
9.3 International Practices
The above discussed rights are particularly unique to the EU. Thus, they are reflected only in
EU jurisdictions or jurisdictions broadly following the EU model such as South Africa.
Further, the right to restrict processing, the right to data portability and the right to be
615 Principle 7, Schedule 1, Privacy Act.
616 Section 6, The Electronic Commerce Protection Act.
617 Sandra Wachter et al., ‗Why a Right to Explanation of Automated Decision-Making Does Not Exist in the
General Data Protection Regulation‘, 7(2) International Data Privacy Law 76 (1 May 2017), available at:
https://academic.oup.com/idpl/article/7/2/76/3860948 (last accessed 18 November 2017).
618 Sandra Wachter et al., ‗Why a Right to Explanation of Automated Decision-Making Does Not Exist in the
General Data Protection Regulation‘, 7(2) International Data Privacy Law 76 (1 May 2017), available at:
https://academic.oup.com/idpl/article/7/2/76/3860948 (last accessed 18 November 2017).
133