white_paper_on_data_protection_in_india_171127_final_v2

may take once personal information in their possession is no longer required. 702 However, this
guide is not legally binding in nature.
Canada
Accountability in relation to privacy is the acceptance of responsibility for personal
information protection. An organisation which is accountable to individuals must have in
place appropriate policies and procedures that promote good privacy practices. 703 The model
code for protection of personal information contained in Schedule 1 of PIPEDA sets out that
an organisation is responsible for any personal information that is under its control. The
organisation must also designate certain individuals who must be accountable for the
organisation‘s compliance with the data protection obligations as set out under PIPEDA. 704
PIPEDA also provides that an organisation is not only responsible for any personal
information that is under its control, but is also responsible for any information transferred to
a third party for processing. In such situations, an organisation must ensure that the third party
also provides a comparable level of protection while processing personal information. This is
usually ensured by contractual means. 705
Additionally, organisations must implement policies and practices to protect personal
information; establish procedures to receive and respond to complaints; train its staff about its
data protection policies and practices. 706 PIPEDA provides that personal information must be
protected by security safeguards appropriate to the sensitivity of the information. Security
safeguards are intended to protect personal information against loss, theft, unauthorised
access, disclosure, copying, use or modification. 707 The nature of safeguards, which an
organisation is expected to implement, will be in accordance with the nature and sensitivity of
the personal information in its possession. 708 Therefore, it follows that information of a more
sensitive nature will be safeguarded by a higher level of protection. PIPEDA also
prescriptively suggests some methods of protection that may be incorporated by an
organisation. For instance, an organisation could utilise physical, organisational and
technological measures to protect information in its possession. 709 Organisations must ensure
that adequate care must be taken while disposing or destroying personal information, in order
to prevent unauthorised parties from gaining access to the information. 710 The Office of the
Privacy Commissioner has issued a guidance document to provide organisations assistance
702 OAIC, ‗Guide to Securing Personal Information: ‗Reasonable steps‘ to protect personal information‘
(January 2015), available at: https://www.oaic.gov.au/resources/agencies-and-organisations/guides/guide-tosecuring-personal-information.pdf,
(last accessed 20 November 2017).
703 Office of the Privacy Commissioner of Canada, ‗Getting Accountability Right with a Privacy Management
Program‘, available at: https://www.priv.gc.ca/media/2102/gl_acc_201204_e.pdf, (last accessed 20 November
2017).
704 Principle 1 of Schedule 1, PIPEDA.
705 Clause 4.1.3, Principle 1 of Schedule 1, PIPEDA.
706 Clause 4.1.4, Principle 1 of Schedule 1, PIPEDA.
707 Clause 4.7.1, Principle 1 of Schedule 1, PIPEDA.
708 Clause 4.7.2, Principle 1 of Schedule 1, PIPEDA.
709 Clause 4.7.3, Principle 1 of Schedule 1, PIPEDA.
710 Clause 4.7.5, Principle 1 of Schedule 1, PIPEDA.
154