white_paper_on_data_protection_in_india_171127_final_v2

with developing certain baseline accountability principles which would help develop a
comprehensive privacy management program. 711
As is clear from the above, jurisdictions across the world have implemented the principle of
accountability in varied forms. At their core, however, these practices require data controllers
to adopt processes and procedures which are consistent with data protection principles. In the
Indian context, as mentioned above, it may be worth exploring whether a statutory
requirement to adopt such measures can be linked to liability in cases of clearly defined
harms.
2.4 Provisional Views
Accountability, as a principle of data protection, has existed for some time and has found
mention in various privacy laws around the world. It is imperative that the data protection law
reflects the principle of accountability. Accountability should not only be enforced for breach
of data protection obligations through the adoption and implementation of standards by data
controllers, but also in certain well defined circumstances, it could be extended to hold data
controllers liable for the harms that they cause to individuals without further proof of
violation of any other obligation. The data protection law should appropriately identify such
harms for which the data controller should be held liable in this manner.
2.5 Questions
1. What are your views on the use of the principle of accountability as stated above for
data protection?
2. What are the organisational measures that should be adopted and implemented in order
to demonstrate accountability? Who will determine the standards which such measures
have to meet?
3. Should the lack of organisational measures be linked to liability for harm resulting from
processing of personal data?
4. Should all data controllers who were involved in the processing that ultimately caused
harm to the individual be accountable jointly and severally or should they be allowed
mechanisms of indemnity and contractual affixation of liability inter se?
5. Should there be strict liability on the data controller, either generally, or in any specific
categories of processing, when well-defined harms are caused as a result of data
processing?
711 Office of the Privacy Commissioner of Canada, ‗Getting Accountability Right with a Privacy Management
Program‘, available at: https://www.priv.gc.ca/media/2102/gl_acc_201204_e.pdf, (last accessed 20 November
2017).
155