white_paper_on_data_protection_in_india_171127_final_v2

have been taken or that the data subject consented to such use may not, by itself, be sufficient
to disclaim liability.
The operation of this principle would mean that the processing of personal data by a data
controller for its business needs commences and continues only in a manner which is in
accord with the data protection principles. This approach, to some extent, shifts the burden
away from the individual from having to constantly monitor whether his or her data is being
processed as per law and ensures greater accountability for data controllers.
2.2 Issues
(i)
Harm and Liability
The principle of accountability bears a close link to the liability to be cast on the data
controller. In order to determine the contours of such liability, it may be important to establish
what constitutes harm. For instance, if as a result of the manner in which the data is
processed, the reputation of the individual is impaired so as to result in a loss in reputation or
social standing of the individual, this could could have serious repercussions for the
individual. Similarly, as a consequence of processing the data, the individual suffers any
direct or indirect financial loss this could be easily identified as a harm that the data controller
should be held accountable for. If the data controller uses the personal data about the
individual in order to limit the choice available to the individual whether in terms of the
information that she can access or any products or services that she is allowed to avail of, this
too could be a harmful restriction of the options available to the individual. However, this
kind of harm is of a qualitatively different nature as compared to the first two examples,
constituting a denial of access or fair treatment, rather than material loss.
From amongst these, the data protection law could identify categories of material and nonmaterial
harm. If such harm is occasioned, it could trigger liability only on proof of failure to
to take appropriate measures. Alternatively, if the nature of processing is inherently risky, the
data controllers could become strictly liable, subject to the exceptions that the harm was
caused by an act of God or the data subject herself contributed to the harm. A third alternative
is for data controllers, or a certain class of data controllers to compulsorily take out insurance
to cover certain types of harms caused to data subjects due to processing activities, even in a
situation where the data controller has taken all reasonable measures according to law and
established practices and standards.
(ii)
Joint Controllers and Remoteness of Liability
Modern data processing is complex and often involves multiple service providers who
process the individual‘s data simultaneously or sequentially. Primary data collected directly
from the individual is often made available through application programming interfaces
(APIs) that can be accessed by various secondary data controllers who either process this data
themselves or make the data available for further processing down the line. If any harm
149