white_paper_on_data_protection_in_india_171127_final_v2

CHAPTER 4: SENSITIVE PERSONAL DATA
4.1 Introduction
All data within the category of information identified as personal data are not qualitatively
similar. As discussed previously, personal data refers to information related to a person‘s
identity. There are matters within this zone which are intimate matters in which there is a
higher expectation of privacy. Unauthorized use of such information of the individual may
have severe consequences. The observations of the Supreme Court in Puttaswamy, 240 on
sexual orientation illustrate this aspect of sensitive information:
“Sexual orientation is an essential attribute of privacy. Discrimination against an
individual on the basis of sexual orientation is deeply offensive to the dignity and
self-worth of the individual.”
Thus, apart from the harm of intrusion of one‘s privacy, as pointed out by the Supreme Court,
such data, if revealed, may also be the basis of discriminatory action. 241 It is necessary to
identify kinds of data that are ―sensitive‖ and accord higher protections to such data. Further
issues relating to sensitive personal data are discussed in Part III, Chapter 6 of this White
Paper.
4.2 Issues and International Practices
There are certain kinds of information which invariably find mention in the set of sensitive
information across jurisdictions. Some of these intuitively are of the nature described above.
These include health information, genetic information, biometric information and information
about religious beliefs, ethnic or racial origin and information relating to sexual orientation.
The EU GDPR 242 and the data protection legislations in Australia 243 and South Africa 244 all
include these categories as sensitive personal data. The level of intrusion resulting from any
unauthorised processing of such information is undoubtedly high.
There are other kinds of information such as philosophical beliefs, membership of political
associations and membership of trade unions which are also categorised as sensitive personal
data in the jurisdictions mentioned above. As noted above, the categorisation of information
as sensitive personal data depends on whether such information is treated as as an intimate
240 Justice K.S. Puttaswamy (Retd.)& Anr. v. Union of India & Ors., (2017) 10 SCALE 1, Paragraph 126.
241 See also Article 29 Data Protection Working Party, ‗Advice <strong>paper</strong> on Special Categories of Data (―sensitive
data‖)‘, European Commission (20 April 2011), available at: http://ec.europa.eu/justice/data-protection/article-
29/documentation/otherdocument/files/2011/2011_04_20_letter_artwp_mme_le_bail_directive_9546ec_annex1_en.pdf
(last accessed 2
November 2017); ICO, ‗Guidance note on Special Categories of Data‘, available at: https://ico.org.uk/fororganisations/guide-to-data-protection/key-definitions/,
(last accessed 2 November 2017), ‗The presumption is
that, because information about these matters could be used in a discriminatory way, and is likely to be of a
private nature, it needs to be treated with greater care than other personal data.‘
242 Article 9, EU GDPR
243 Section 6 , Privacy Act.
244 Section 26, POPI Act.
41