white_paper_on_data_protection_in_india_171127_final_v2

2.8 International Practices
European Union
Under the EU GDPR, codes of conduct are recognised as compliance-signalling or
demonstrating tools in a number of provisions. 714 Further provisions deal with the codes
themselves stipulating that they can be formulated for subject matters like: 715
a. fair and transparent processing;
b. the legitimate interests pursued by controllers in specific contexts;
c. the collection of personal data;
d. the exercise of the rights of data subjects;
e. technical and organizational measures, measures introducing data protection by design
and by default, and safeguards for the security of processing;
f. the notification of personal data breaches to supervisory authorities and the
communication of such personal data breaches to data subjects; or
g. the transfer of personal data to third countries or international organisations.
After drafts of these codes of conduct are prepared by representative bodies and submitted to
it, the supervisory authority must provide an opinion on the same and where it finds the code
in compliance with the EU GDPR, it must approve, register and publish the same. 716
United Kingdom
Section 51(3) of UK DPA states that at the direction of the Secretary of State or the discretion
of the Information Commissioner, the Information Commissioner may himself prepare and
disseminate codes of practice ―for guidance as to good practice‖ after carrying out
consultations. As per Section 51(4) of the UK DPA, the Information Commissioner is also
required to encourage the preparation of such codes by trade associations. When such a draft
code is submitted, the Information Commissioner must consider the draft and carry out
consultations after which he may ―notify the trade association whether in his opinion the code
promotes the following of good practice.‖ 717
Canada
Section 24(c) of PIPEDA requires the Privacy Commissioner to encourage organizations to
develop detailed policies and practices, including organizational codes of practice, towards
compliance with processing obligations. 718
714 Articles 24(3), 28(5), 32(3), and 35(8), EU GDPR.
715 Article 40, EU GDPR.
716 Article 40, GDPR.
717 Section 52(3), UK DPA further requires the Information Commissioner to lay before each House of
Parliament any code of practice prepared on the direction of the Secretary of State but does not place this
requirement for codes prepared by trade associations under Section 51(4).
718 Codes may be developed for compliance with Sections 5 to 10, PIPEDA which deal with general obligations
on the protection of personal information.
158