white_paper_on_data_protection_in_india_171127_final_v2

from being taken solely on the basis of automated processing of data. 625 The exemptions are
similar to those under the UK DPA.
South Africa
The POPI Act guarantees the right to object to processing, on reasonable grounds, if the basis
of processing was: protection of legitimate interest of the individual, proper performance of
public law duty by a public body, or, pursuit of legitimate interest of the organisation. 626 The
exception to the right is that such processing was permitted by legislation. 627
Under the POPI Act processing for direct marketing is permissible only if the individual has
consented to the same. Further, the individual has a right to opt-out of such processing. 628
Finally, the right in relation to automated processing is similar to that guaranteed under the
Dutch Personal Data Protection Act. 629
9.4 Provisional Views
1. It is important to include concepts of data portability into Indian privacy jurisprudence
in order to ensure that the data subject is placed in a central position and has full power
over her own personal data.Accordingly, every individual should have the right to
demand that all personal data about that individual that is in the control of the data
controller be made available to her in a universally machine readable format or ported
to another service provide with the specific consent of that individual. All data must
therefore be held in an interoperable format.
2. A general right to object to processing may not prove to be suitable for India. This is
because, as explained in the section on other grounds of processing in this note, public
interest and legitimate interest may not be imported as grounds for processing in a data
protection law for India.
3. Automated decisions have proven to have detrimental consequences in many cases.
This right is also found across most EU data protection regimes. However, given the
concerns raised about automated decisions and their pervasiveness in the digital
economy, a practically enforceable and effective right may be carved out.
4. Processing of personal data for direct marketing purposes may be recognised as a
discrete privacy principle in a data protection law for India. This is because despite
there being independent legislations regulating direct marketing, direct marketing is
medium and technology-agnostic and consequently needs to be governed by general
rules.
625 Article 42, The Dutch Personal Data Protection Act.
626 Section 11(3)(a), POPI Act.
627 Section 11(3)(a), POPI Act.
628 Section 69, POPI Act
629 Section 71, POPI Act.
135