white_paper_on_data_protection_in_india_171127_final_v2

ENFORCEMENT TOOLS
2.6 Introduction
A number of regulatory tools and mechanisms may be simultaneously utilized to
achieve different enforcement objectives. Some of these may be based on a coregulatory
model whereas others may be based on a ‗command and control‘ approach.
These are discussed below.
A. CODES OF PRACTICE
2.7 Issues
A code of practice or conduct is considered an important element in establishing a workable
co-regulatory data protection scheme. As has been discussed in Part IV, Chapter 1 of the
White Paper, a co-regulatory framework is one that integrates elements of self-regulation with
elements of governmental regulation. Codes of conduct originate in ordinary industry
practices where associations engage in standard-setting for better service provision or
manufacturing. They thus naturally form part of some self-regulatory systems in the form of
voluntary codes with no force of law.
However, in a co-regulatory system, a code of conduct or practice is integrated into the
broader regulatory scheme through recognition of different types in the general statute. While
adoption of a code remains voluntary and its formulation still involves industry participation,
co-regulation may involve encouraging their creation or allowing compliance with them to
serve as evidence of compliance with the data protection statute. Issuance of such codes by a
regulator or other forms of legal recognition allows for such standard-setting practices to be
formalised and anchored to statutory processes. This would also improve the transparency of
the processes by which such codes are formulated while codes themselves create transparency
regarding how information is being processed in practice. 712
Codes of conduct suffer from some issues when conceived of as purely self-regulatory. 713
However, when such codes are viewed as part of a co-regulatory framework, their true
potential can be exploited. The manner in which co-regulation can introduce government
oversight and other elements of accountability is illustrated in international practices below.
712 OAIC, ‗Guidelines for developing codes – issued under Part IIIB of the Privacy Act 1988‘ (September 2013),
2, available at: https://www.oaic.gov.au/resources/agencies-and-organisations/advisory-guidelines/guidelinesfor-developing-codes.pdf,
(last accessed 28 October 2017).
713 Margot Priest, ‗The Privatization of Regulation: Five Models of Self-Regulation‘, 29(2) Ottawa Law Review
233, 242 (1998) (Codes of conduct only create accountability towards each other and not to the government;
they engage in purely consensual rule-making; there is no real adjudication of violations or dispute resolution;
there are very limited sanctions for violation apart from trade association dismissal; there is only limited
coverage of the code across the industry due to its voluntary nature; and there is only rarely any involvement of
the public or stakeholders external to the industry, no matter how large their stake).
157