white_paper_on_data_protection_in_india_171127_final_v2

In light of these developments, the biggest challenge in regulating emerging technologies
such as Big Data, artificial intelligence and the Internet of Things, lies in the fact that they
may operate outside the framework of traditional privacy principles. These principles, as they
were originally envisaged, were designed to protect a single static data set. 55 Thus, it was
possible to limit the collection of data to satisfy a particular purpose. However, this limited
activity may no longer hold true with respect to current data processing activities. For
instance, given that Big Data involves the processing of large data sets, usually the source of
such data may not be directly from the individual, and consent may not be as relevant.
Further, data may be generated as a by-product of a transaction or obtained by a service
provider in return for a free service (such as free email accounts, social networks etc.) or
obtained as a consequence of accessing a service (such as use of GPS navigation), and it may
not be possible to specify the purpose for which personal data is collected at the time of
collection. 56
The advent of such technologies has also expanded the very definition of personal data. For
instance, analysing meta-data such as a set of predictive or aggregated findings, or by
combining previously discrete sets of data, Big Data has radically expanded the range of
personally identifiable data. 57 Data which is viewed as non-personal information can now be
combined with other data sets to create personally identifiable information. An example of
this is how anonymised Netflix data on ranking of films could be easily combined with other
data sets such as timestamps with public information from the Internet Movie Database
(IMDb) to de-anonymise the original data set and reveal personal movie choices. 58 Similarly,
Big Data relies on accumulation of large volumes of data to extract knowledge from them,
making it difficult to apply the principle of data minimisation. 59 Additionally, technologies
such as the Internet of Things relies on continuous collection of personal information from
the users of ―smart devices‖, which may then be interpreted to provide unique services. 60
Therefore, in such instances as well, it may be difficult to adhere to the traditional privacy
principles of consent, collection and use limitation. Given the dynamic pace of development
September 2014), available at: http://ec.europa.eu/justice/data-protection/article-29/documentation/opinionrecommendation/files/2014/wp223_en.pdf,
(last accessed 3 November 2017).
55 Jordi Soria-Comas and Josep Domingo-Ferrer, ‗Big Data Privacy: Challenges to Privacy Principles and
Models‘, 1(1) Data Science and Engineering (March 2016), available at:
https://link.springer.com/article/10.1007/s41019-015-0001-x (last accessed 31 October 2017).
56 Kate Crawford and Jason Schultz, ‗Big Data And Due Process: Towards A Framework To Redress Predictive
Privacy Harms‘, 55(1) Boston College Law Review 93 (2014).
57 Kate Crawford and Jason Schultz, ‗Big Data And Due Process: Towards A Framework To Redress Predictive
Privacy Harms‘, 55(1) Boston College Law Review 93 (2014).
58 Bruce Schneier, ‗Why ‗anonymous‘ data sometimes isn‘t‘, Wired (12 December 2017), available at:
https://www.wired.com/2007/12/why-anonymous-data-sometimes-isnt/ (last accessed 1 November 2017).
59 Jordi Soria-Comas and Josep Domingo-Ferrer, ‗Big Data Privacy: Challenges to Privacy Principles and
Models‘, 1(1) Data Science and Engineering (March 2016), available at:
https://link.springer.com/article/10.1007/s41019-015-0001-x (last accessed 31 October 2017).
60 Article 29 Data Protection Working Party Opinion, ‗Opinion 8/2014 on the on Recent Developments on the
Internet of Things‘, European Commission (16 September 2014), available at: http://ec.europa.eu/justice/dataprotection/article-29/documentation/opinion-recommendation/files/2014/wp223_en.pdf,
(last accessed 3
November 2017).
9