white_paper_on_data_protection_in_india_171127_final_v2

2.2 Horizontality of Application (Public versus Private Sector)
There is a large amount of personal data being processed by public and private entities alike.
Further, an important dimension of the right to privacy is civil rights and surveillance, which
involves the State. 203 Data protection laws in jurisdictions such as the EU apply to the
Government, as well as private entities as far as their processing activities are concerned. The
(Australian) Privacy Act contains thirteen Australian Privacy Principles (APPs) which apply
to some private entities and most Australian and Norfolk Island government entities. In
Canada, however, two separate laws apply to public and private entities. The Privacy Act
1983 (Canada Privacy Act) applies to the federal government institutions, and the PIPEDA
applies to businesses.
There is a need to ensure that an individual‘s informational privacy is protected through a
comprehensive data protection law which applies across the board. Additionally, the law may
be devised to provide grounds for processing, and certain reasonable exemptions for data
collected, used, disclosed, retained or stored by public entities. However, it is doubtful
whether public entities can be completely excluded from the purview of the data protection
law.
The Supreme Court has recognised that legitimate state interest must be protected through
exemptions that may be carved out in a data protection law. 204 However, limited exemptions
may be considered for well-defined categories of departments in Government or the public
sector and similarly for entities in the private sector. In the former category, law enforcement
agencies and intelligence agencies may have to be exempted from some of the rigours of the
law. This is dealt with later in this White Paper. Second, the law may exempt entities such as
charitable institutions or small business enterprises from all or some of the obligations under
the law. 205 These exemptions will also have to be carefully designed.
2.3 Retrospective Application
A data protection law will apply ordinarily to data collected, used, stored, disclosed, retained
etc. after the legislation enters into force. However, it may also apply to data that has been
collected, used, stored, disclosed, retained etc. before the law was enacted. The data
protection law will impose significant obligations for all entities involved in the collection,
use, disclosure, retention and storage of personal data. To ensure effective implementation,
the law should contain a transitory provision to ensure that all obligations are reasonable, and
are complied with in the given time-frame. The provision for retrospective application may
also be considered for certain reasonable obligations such as ensuring the integrity and
confidentiality of information that is already in control of the processor. However, certain
203 Joseph A. Cannataci, ‗Report of the Special Rapporteur on the right to privacy‘, Human Rights Council,
A/HRC/31/64 (2016).
204 Justice K.S. Puttaswamy (Retd.) v. Union of India & Ors. (2017) 10 SCALE 1.
205 See for instance Section 6 D, Canada Privacy Act
31