white_paper_on_data_protection_in_india_171127_final_v2

forgotten have not translated into law. Only specific examples of best practices that require
particular consideration in addition to the EU GDPR are dealt with below.
United Kingdom
Under the UK DPA the right to object to processing exists where such processing was in
pursuance of public interest or legitimate interest (distilled to suit the UK context) and in
cases where such processing has caused or is likely to cause substantial damage or substantial
distress to individuals, which is not warranted. 619 The Information Commissioner has set out
in guidance, notes on what damage or distress could mean: substantial damage would be
financial loss or physical harm; and substantial distress would be a level of upset, or
emotional or mental pain, that goes beyond annoyance or irritation, strong dislike, or a feeling
that the processing is morally abhorrent. 620 The UK DPA also incorporates the right to object
to processing for direct marketing similar to as already described. 621
The right in relation to automated decision making arises if two conditions are satisfied: first,
the personal data must be processed using solely automated means, and second, such
processing must significantly affect the concerned individual. Further, there are three rights
guaranteed to an individual: first, the right to prevent automated decisions from taking place,
second, the right to be informed when automated decisions are taken about the individual, and
third, the right to object to an automated decision and ask for such decision to be reconsidered
or taken on a different basis. Finally, certain decisions are exempt from the exercise of such
right. If a decision is authorised or required by legislation, or is taken in preparation for, or in
relation to, a contract with the individual concerned, and is to grant a request to the
individual, or steps have been taken to safeguard the legitimate interests of the individual, it is
exempted. 622
Netherlands
The Dutch Personal Data Protection Act guarantees an absolute right to object to processing,
if the ground for such processing is public interest or legitimate interest. 623 Further unlike the
UK, the individual does not have to demonstrate that such processing has resulted in or is
likely to result in substantial damage or distress. The right to object to processing for direct
marketing in the Netherlands not only extends to commercial information but also to
canvassing for charitable purposes. 624
Finally, the Dutch Personal Data Protection Act goes one step ahead of the UK and prohibits
any evaluative decision which produces legal effects or significantly affects an individual,
619 Section 10, UK DPA.
620 ICO, ‗Preventing processing likely to cause damage or distress‘ available at: https://ico.org.uk/fororganisations/guide-to-data-protection/principle-6-rights/damage-or-distress,
(last accessed 5 November 2017).
621 Section 11, UK DPA.
622 Section 12, UK DPA.
623 Article 40, The Dutch Personal Data Protection Act.
624 Article 41, The Dutch Personal Data Protection Act.
134