white_paper_on_data_protection_in_india_171127_final_v2

sector, size, financial and other resources of a data controller as the purpose of a monetary
penalty is not to impose undue financial hardship on an otherwise responsible entity. 856
Australia
As per the Privacy Act, the OAIC may apply to the prescribed court for an order that an entity
which has infringed any provisions of the Privacy Act shall be liable to pay a pecuniary
penalty. 857 If the court is satisfied that the entity has contravened certain provisions of the
Privacy Act, then it may order the entity to pay a pecuniary penalty as it determines. 858
South Africa
Under the POPI Act 859 , an administrative fine not exceeding R10 million may be imposed on
the defaulting organization. Moreover, while determining an appropriate fine, the Information
Regulator may consider the following factors:
(i)
(ii)
nature of personal information involved;
duration and extent of contravention;
(iii) number of data subjects affected or potentially affected by such contravention;
(iv) likelihood of substantial distress or damage, including injury to feelings or anxiety
suffered by data subjects;
(v)
whether the responsible party could have prevented the contravention from occurring;
and
(vi) failure to carry out risk assessment or a failure to operate good policies, procedures and
practices to protect personal information.
4.3 Provisional Views
1. Based on a review of the extant Indian legal and regulatory framework as well as the
international best practices set out above, the following models for calculation of civil
penalties may be possible:
856 ICO, ―Information Commissioner‘s guidance about the issue of monetary penalties prepared and issued under
section 55C(1) of the Data Protection Act 1998‖, 3 (December 2015), available at: https://ico.org.uk/media/fororganisations/documents/1043720/ico-guidance-on-monetary-penalties.pdf,
(last accessed 20 October 2017).
857 Section 80W, Part VIB, Privacy Act.
858 From a reading of Section 80W(5), Privacy Act, it appears that the pecuniary penalty is capped at five times
the amount stipulated for violation of a specific provision under the Privacy Act, in case of a body corporate and
otherwise, it is the amount of pecuniary penalty contemplated for violation of a specific provision under the
Privacy Act.
859 Section 109, POPI Act.
193