white_paper_on_data_protection_in_india_171127_final_v2

This distinction between data and information in its ordinary usage is perhaps not
determinative in data protection. As the object of the law is to demarcate the sphere of
information relevant to the protection of the identity of an individual, the choice of the term
―data‖ or ―information‖ may not matter as these terms would not be used in their ordinary
sense. The definition will have to cover both data and information if it bears a connection to
the identity of the individual.
This is reflected in international practice as well.
While the EU GDPR, 215 and Singapore 216 define the term personal data, Australia, 217
Canada 218 and South Africa 219 on the other hand use the term personal ―information‖. As is
clear from the next section, most of these terms roughly refer to the same category of
information. However, the use of the term data in the EU may have some significance as it
was the advent of new technology in the seventies resulting in easily accessible datasets that
was the catalyst for the establishment of a data protection framework. 220 In keeping with this
approach, the EU GDPR does not apply to non-automated processing of personal data which
is not intended to be part of a filing system. 221
For the purposes of this White Paper, we use the term data as the broader term which includes
any form of information. It is clear that data can be facts, objective information or even
opinions or any other sort of information. For instance, credit-worthiness of an individual
which is an assessment of his or her ability to repay loans is an opinion/assessment which is
nonetheless data. Some jurisdictions make this explicit in their legislations. Examples are
Singapore and Australia where the legislations explicitly state that whether a piece of
information is personal data does not depend on whether it is true or not. 222
(ii)
Information about/relating an individual
The object of data protection legislations as stated above is to ensure autonomy of the
individual by protecting personal data. Information which is protected under the head of
personal data must first and foremost be about such individual. The individual must be the
subject matter of the information. For instance, a file maintained by a bank containing the
KYC information of an individual is information about that individual.
215 Article 4(1), EU GDPR.
216 Section 2(1), Singapore Act.
217 Section 6, Privacy Act.
218 Section 2, PIPEDA.
219 Section 1, POPI Act.
220
Article 29 Data Protection Working Party, ‗Opinion 4/2007 on the Concept of Personal Data‘, European
Commission (20 June 2007), available at: http://ec.europa.eu/justice/data-protection/article-
29/documentation/opinion-recommendation/files/2007/wp136_en.pdf, (last accessed 17 November 2017).
221 Article 2, EU GDPR.
222 Section 2, Singapore Act.
35