white_paper_on_data_protection_in_india_171127_final_v2

United Kingdom
As per the guidance 872 issued by the ICO, if an individual suffers damage where a data
controller has breached the provisions of the UK DPA, the individual is entitled to claim
compensation from the data controller. If an individual claims a certain amount as
compensation, she will be required to demonstrate how the data controller‘s failure to comply
with the UK DPA has resulted in her incurring that amount of damage or loss. This right can
only be enforced through the courts. Moreover, a claim for compensation may be defended on
the basis that the data controller took reasonable care in the circumstances to avoid breach.
However, there are no guidelines on the level of compensation to be payable in this regard.
Australia
Under the Privacy Act, if the OAIC, upon investigation makes a finding of substantiated
complaint that the organization has engaged in conduct that amounts to an interference with
privacy, then the OAIC may, inter alia, declare that the complainant is entitled to a specified
amount by way of compensation for any loss or damage suffered by reason of the act or
practice which forms the subject matter of the complaint. 873 Further, any loss or damage as
referred above includes injury to the feelings of the individual and humiliation suffered by the
individual. 874 However, a determination made by the OAIC above is not binding or
conclusive between the parties to the determination and separate proceedings are required to
be initiated by the individual or the OAIC to enforce the latter‘s determination. 875
Canada
Under PIPEDA, the court (to which the complainant has applied for hearing in respect of any
matter in respect of which complaint was made to the Privacy Commissioner) may, inter alia,
award damages to the complainant including damages for any humiliation that the
complainant has suffered. 876
South Africa
Under the POPI Act, a data subject or on the request of the data subject, the Information
Regulator may institute a civil action for damages in a court having jurisdiction against the
responsible organization for breach of the provisions of the POPI Act, whether or not there
was intent or negligence on the part of the responsible party. The court may award payment
which is just and equitable, including payment of damages as compensation for patrimonial
872 ICO, ‗Compensation‘ available at https://ico.org.uk/for-organisations/guide-to-data-protection/principle-6-
rights/compensation/ (last accessed 20 October 2017).
873 Section 52, Privacy Act.
874 Section 52(1AB), Privacy Act.
875 Section 52(IB), Privacy Act.
876 Section 16(c), PIPEDA.
199