white_paper_on_data_protection_in_india_171127_final_v2

isks. For instance, if participation rights are given with respect to a data set which is
supposedly anonymised, but may be capable of being re-identified, the data controller would
be required to identify the individuals first from the data. 232
The advent of the Internet of Things also poses a challenge to the degree of anonymity that
can be achieved. New devices capture data in forms which are unique. An example is that of a
person‘s gait being uniquely identified by a wearable activity tracker. 233 Such data can
perhaps never be completely de-identified. The current methods of using aggregated
anonymised data might not be secure enough when applied to such data.
In spite of these issues, several prominent jurisdictions continue to rely on definitions of
personal data which are structured around the notion of information about/related to an
identified or reasonably identifiable individual. Some nuance may be of relevance here. The
EU GDPR also qualifies the above statement by noting that the identification may be direct or
indirect thus broadening the scope of the definition. 234 Similarly, as pointed out earlier some
legislations make it explicit whether information constitutes personal information is not
dependent on its accuracy. A noteworthy feature of the POPI Act is that the definition has an
illustrative component as well which lists some of the common forms of personal
information. 235 These are some practices worth considering in constructing a definition of
personal data under the law.
(vi) A layered approach?
A prominent jurisdiction not discussed above is the US where different kinds of definitions
exist as a result of data protection being dealt with in sector-specific laws. The kind of
information to be protected is broadly referred to by the umbrella term ―Personally
Identifiable Information‖ (PII). However, definitions of PII vary widely across statutes.
Shwartz and Solove draw up a useful typology where they refer to definitions based on
standards on one hand and rule-based definitions on the other hand. 236 Definitions in the EU,
Canada and Australia referred to above are examples of standard-based definitions which
are largely technologically neutral and rely on the standard of identification.
In the US, the Video Privacy Protection Act, 1988 (VPPA) is pointed out as an example of a
similar approach. However, the VPPA protects only the category of information which
identifies an individual and does not use the standard of identifiability. A different standard
found in the GLB Act is that of non-public personal information. The standard used here is
232 OECD, OECD Digital Economy Papers No. 229, ‗Privacy Expert Group Report on the Review of the 1980
OECD Privacy Guidelines‘, 10, available at: http://www.oecd-ilibrary.org/science-and-technology/privacyexpert-group-report-on-the-review-of-the-1980-oecd-privacy-guidelines_5k3xz5zmj2mx-en.,
(last accessed 1
November 2017).
233 Scott R Peppet, ‗Regulating the Internet of Things: First Steps Toward Managing Discrimination, Privacy,
Security and Consent‘, 93(85) Texas Law Review 156 (2014).
234 Article 4 (1) , EU GDPR.
235 Section 2, POPI Act.
236 Paul M. Shwartz and Daniel Solove, ‗The PII Problem: Privacy and a New Concept of Personally Identifiable
Information‘, 86 NYU Law Quarterly Review 1814 (2011).
38