white_paper_on_data_protection_in_india_171127_final_v2

esults from this chain of processing it will be difficult to adequately allocate responsibility.
While the principle of joint and several liability may be applied, it could be unfair to data
controllers who have genuinely taken all care and diligence to safeguard the individual from
harm. On the other hand, having such a stringent norm could be what is required to ensure
that the data controllers take adequate efforts to ensure that anyone down the chain who is
given access to the data takes care to ensure that it does not result in any harm. This may be
effectuated by data controllers taking indemnities against harm being caused to the data
subject owing to any processing in this chain. This is consonant with the baseline principle
that harm suffered by an individual should not remain unredressed.
(iii) Audit
Harms that result from improper processing of data are not always immediately evident. For
instance, in many cases, the bias inherent in the decision making algorithms is not
immediately discernible. It is only after a large number of people suffer from improper
processing that we come to realise the harm that is being caused. This could well be too late
and in order to appropriately protect the individual the law must suggest proactive measures
that detect these harms early enough. Thus, in addition to requiring that personal data
processing beyond certain scales must be commenced only after having in place a policy or
prescribed organisational procedure, there could be provisions for audits (both internal and
external). This would be critical in implementing the second limb of accountability, i.e.
maintaining the burden of proof of compliance on the data controller. A requirement of audit
would mean that the data controller must maintain records of measures and processes which
could provide proof of compliance of data protection principles.
(iv) Security Safeguard Obligations
Appropriate technical and organisational measures to ensure security of personal data are
central to the principle of accountability. These measures should be in-tune with the cyber
threats of today. At the same time, these security obligations should keep in mind the costs of
implementation of such measures which have to be kept operational constantly as security
and privacy breach protection require constant assessment and reporting.
The EU GDPR provides general security obligations that the data controller and the processer
must follow. These are summarised below:
a. Obligation to assess the risks and implement security measures to mitigate those risks.
b. These risks are of varying likelihood and severity for the rights of individuals, in
particular from accidental or unlawful destruction, loss, alteration, unauthorized
disclosure of, or access to personal data transmitted, stored or otherwise processed.
c. Obligation to train staff having access to personal data on the steps to follow in case of
a data breach (adopt an incident response plan).
150