white_paper_on_data_protection_in_india_171127_final_v2

Australia
The Privacy Act makes extensive use of privacy codes as part of its overall framework
through what are called APPs codes and Credit Reporting codes. These are envisaged to be
developed by an entity, a group of entities, or a representative body or association of such
entities. Under Part III B of the Privacy Act, the OAIC can approve and register enforceable
codes developed by entities on their own initiative or on the request of the OAIC. These can
be developed by the OAIC directly as well. These codes are envisaged to apply over and
above the Privacy Act‘s provisions and detail how the Privacy Act‘s relevant provisions are
to be complied with as well as who is bound by the code. 719 Entities bound by codes are
required by law not to breach them 720 and such breach is deemed ―an interference with the
privacy of an individual‖. 721
South Africa
Chapter 7 of the POPI Act lays down detailed provisions for codes of conduct, including for
their issuance, notification, commencement, complaint mechanism, amendment, revocation,
registration, review and compliance. A failure in compliance with an applicable code is
deemed to be a breach of lawful processing conditions. 722 The Information Regulator issues
such codes on its own initiative or on application by a representative body. 723
2.9 Provisional Views
1. It may be important to incorporate and make provision for codes of practice within a
data protection framework.
2. Such codes of conduct or practices may be issued by a data protection authority after
appropriate consultations with the industry and individuals.
3. A data protection law may set out the various matters on which codes may be issued,
which may include matters such as the best practices for privacy policies, data quality
obligations or more core obligations on processing.
2.10 Questions
1. What are your views on this?
719 OAIC, ‗Guidelines for developing codes – issued under Part IIIB of the Privacy Act 1988‘ (September 2013),
2, available at: https://www.oaic.gov.au/resources/agencies-and-organisations/advisory-guidelines/guidelinesfor-developing-codes.pdf,
(last accessed 28 October 2017).
720 Sections 26A and 26L, Privacy Act.
721 Section 13, Privacy Act; the Privacy Act further includes a number of detailed provisions regarding the form
of any such code, how it is to be prepared and registered, and how it is to be monitored and governed. These
include complaint and investigation provisions as well as provisions for reviewing, varying and removing codes.
722 Section 68, POPI Act.
723 Sections 60 and 61, POPI Act.
159