white_paper_on_data_protection_in_india_171127_final_v2

notices‘ 827 and ‗information notices‘ in order to determine whether the data controller has
complied with the provisions of the UK DPA. 828 Where a data controller fails to comply with
any of the notices, then it may be considered as an offence under the UK DPA. 829 The
Information Commissioner may impose a monetary penalty upon the data controller for
contravention of data protection principles. 830 A data controller on whom any type of notice
under the UK DPA has been served by the Information Commissioner, has the right to file an
appeal with the First-tier Tribunal. 831
Australia
Under the Privacy Act, in case of a breach of the privacy principles, an individual can file a
complaint with the OAIC. 832 Where it is not feasible to conciliate between the parties, the
OAIC may undertake an investigation and upon finding of a substantiated complaint, can
direct the respondent to not repeat such a conduct or perform a reasonable act to redress the
loss suffered by the individual. 833 On an application by the OAIC, if the prescribed court is
satisfied that the respondent has contravened the provisions of the Privacy Act, it may order
the respondent to pay a penalty. 834 The OAIC may also undertake the above on the basis of a
suo moto action. 835 Moreover, an application for review of an order made by the OAIC lies
with the Administrative Appeals Tribunal. 836
Canada
In Canada, under the PIPEDA, the Privacy Commissioner may take cognizance of a
complaint filed by an individual or on its own. 837 Upon filing of a complaint, the Privacy
Commissioner may conduct an investigation. 838 Upon completion of investigation, the
Privacy Commissioner is required to prepare a report consisting of its findings and
recommendations. 839 On receiving the report, the individual may apply to the court for a
hearing in respect of the matter in relation to which the complaint was made or that is referred
to in the Privacy Commissioner‘s report. 840 The court may direct the organization to correct
its practices and award damages to the complainant. 841
827 Sections 41A, 41B, 41C and 42, UK DPA.
828 Section 43, UK DPA.
829 Section 47, UK DPA.
830 Sections 55A-55E, UK DPA.
831 Section 48, UK DPA read with ICO, ―Information Commissioner‘s guidance about the issue of monetary
penalties prepared and issued under section 55C(1) of the Data Protection Act 1998‖, 3 (December 2015),
available at: https://ico.org.uk/media/for-organisations/documents/1043720/ico-guidance-on-monetarypenalties.pdf,
(last accessed 20 October 2017).
832 Section 36, Privacy Act.
833 Section 52, Privacy Act.
834 Section 80W, Privacy Act.
835 Section 52(1A) read with Section 40(2), Privacy Act.
836 Section 96, Privacy Act.
837 Section 11, PIPEDA.
838 Section 12, PIPEDA.
839 Section 13, PIPEDA.
840 Section 14, PIPEDA.
841 Section 16, PIPEDA.
187