white_paper_on_data_protection_in_india_171127_final_v2

CHAPTER 3: WHAT IS PERSONAL DATA?
3.1. Introduction
The definition of personal information or personal data is the critical element which
determines the zone of informational privacy guaranteed by a data protection legislation. As
noted by the Supreme Court in Puttaswamy, it is not merely intimate matters over which one
has a reasonable expectation of privacy that fall within this zone. Rather, the object of data
protection regimes is to protect the autonomy of the individual by protecting the identity of
the individual. 209 The object of defining personal data or personal information is to demarcate
facts, details or opinions that bear a relation to his or her identity.
3.2. Issues and International Practices
(i)
Information or data?
The terms information and data are both used in the context of informational privacy and data
protection. It appears that the word data is of comparatively more recent origin than the word
information and is used in specialised scientific fields. 210 The word has specific connotations
in the fields of computer science and information technology. ‗Information‘ on the other hand
simply means facts about something or someone. 211
It is on these lines that the IT Act draws a distinction between these terms. Under Section 2
(1) (v) of the IT Act ―information‖ includes data, text, images, sound, voice, codes, computer
programmes, software and databases or micro-film or computer generated micro-fiche. 212
Subsection (o) of the same section defines data as "data" means a representation of
information, knowledge, facts, concepts or instructions which are being prepared or have
been prepared in a formalised manner, and is intended to be processed, is being processed or
has been processed in a computer system or computer network, and may be in any form
(including computer printouts magnetic or optical storage media, punched cards, punched
tapes) or stored internally in the memory of the computer. 213
The SPDI Rules under the IT Act, building on these definitions of data and information,
grant protection to a category of information termed ―sensitive personal information or
sensitive personal data‖. 214 These definitions may have to be revisited under the proposed law
in light of global practices in which sensitive information has a different connotation.
209 Justice K.S.Puttaswamy (Retd.) v. Union of India (2017) 10 SCALE 1 paragraph 177.
210
Definition of data, can be found at: ‗Data‘, Oxford Dictionaries, available at:
https://en.oxforddictionaries.com/definition/data, (last accessed 1 November 2017).
211
Definition of information, can be found at: ‗Information‘, Oxford Dictionaries, available at:
https://en.oxforddictionaries.com/definition/information, (last accessed 1 November 2017).
212 Section 2 (1)(v), IT Act.
213 Section 2 (1)(o), IT Act.
214 Rule 3, SPDI Rules.
34