white_paper_on_data_protection_in_india_171127_final_v2

matter in which there is a serious privacy interest. The application of these factors vary from
country to country. It must thus be seen whether information in these categories are sensitive
in the Indian context.
A prima facie indication of the position on these issues is reflected in the SPDI Rules. 245 The
core categories identified by the Government in 2011 for protection as sensitive personal data
were (i) passwords; (ii) financial information such as Bank account or credit card or debit
card or other payment instrument details; (iii) physical, physiological and mental health
condition; (iv) sexual orientation; (v) medical records and history; and (vi) biometric
information. Racial or ethnic origin, philosophical beliefs, membership of political
associations and membership of trade unions are all missing from this list. A fresh assessment
would have to be carried out to ascertain whether such information should be included in the
category of sensitive personal data.
The other category of data that requires specific consideration is financial data. The SPDI
Rules prescribe financial data to be sensitive data. This is similar to the American practice of
treating financial information such as credit card information as sensitive
information. 246 Financial data, which finds mention in the SPDI Rules is not a category which
finds mention as sensitive data in the EU, South Africa or Australia. In Australia, in the
consultation processes leading to the amendment of the Privacy Act, it was suggested that
financial information should be included in the category of sensitive personal data. The
suggestion was rejected noting that while financial data shares certain characteristics with
other sensitive data in that it has to be handled with care, 247 it does relate to any intimate
personal or physical attribute like other sensitive data.
Other categories of information specific to India such as caste may also have to be considered
for inclusion. Information about the caste of an individual falls within the zone where there is
a higher expectation of privacy and it could be a reason for discrimination as well. These
point to the fact that information about caste should be included in the list of sensitive data. It
is important to distinguish information about caste from information from which caste of a
person may be surmised such as a surname. The name of a person, even if it reveals his or her
caste or religion cannot be the basis for treating the name itself as sensitive personal data. The
question whether such information is sensitive data would be context dependent. For instance,
a list of names where there is no reference to any other fact, does not mean that the entire list
is sensitive personal information because the castes of some individuals may be surmised
from their names. However, if a list is prepared indicating the caste of every person in a
separate column, that could be sensitive personal data requiring a different standard of
245 Rule 3, SPDI Rules.
246 The FTC which draws its primary authority from the FTC Act also administers and acts under a number of
other statutes such as the GLB Act, COPPA etc. FTC, ‗Protecting Personal Information: A Guide for Business‘
(23 January 2015), available at: www.ftc.gov/tips-advice/business-center/guidance/protecting-personalinformation-guide-business,
(last accessed 17 November 2017).
247 Australian Law Reform Commission, ‗The Privacy Act: Some Important Definitions‘, available at:
https://www.alrc.gov.au/publications/6.%20The%20Privacy%20Act%3A%20Some%20Important%20Definitio
ns/sensitive-information, (last accessed 3 November 2017).
42