white_paper_on_data_protection_in_india_171127_final_v2

In India, collection of statistical information by the Government is governed by the Collection
of Statistics Act, 2008 (Collection of Statistics Act). This legislation deals with the collection
of statistical information relating to economic, demographic, social, scientific and
environmental aspects by the Government. The appropriate Government can direct that a
relevant statistics officer may supervise the collection of the requested statistical
information 286 . The statistics officer requests the collection of necessary information by
serving a written notice to an informant. Upon the receipt of a written request, the informant
is bound to furnish information to the best of his/her ability. The statistics officer, or his
authorized representative has the power to access relevant records or documents in the
possession of the informant. 287
In the case of South Africa, under the POPI Act, the Information Regulator may exempt
processors from certain obligations in the following two conditions - if public interest in
processing outweighs, to a substantial degree, any interference with privacy; or if processing
involves a clear benefit to the data subject or a third party that outweighs, to a substantial
degree, any interference with privacy. Public interest has been defined to include ‗historical,
statistical or research activity.‘ Jurisdictions such as Italy, 288 South Africa, 289 UK, 290 provide
exemptions for personal data processed in for research/historical and statistical purposes.
This exemption promotes academic freedom of research, and processing of data in wider
public interest. However, the term ‗research‘ should be clearly defined to exclude nonacademic
research such as market research or processing of data for the purpose of
advertising or other commercial purposes. For instance, names, addresses collected by a nongovernmental
organization or NGO for academic research that may also be used by the same
NGO for targeted commercial activity.
(iv) Other categories of exemptions that have been incorporated by some jurisdictions
a. Regulatory activity (UK 291 , Malaysia 292 );
b. Discretionary exemptions by a Data Protection Authority or minister (Singapore 293 ,
Malaysia 294 );
c. Exemptions for small businesses (for e.g. Australia exempts small business operators
which have a turnover of less than AUD 3 million, however, there are no exemptions
for processing of health data) 295 ; Further, some considerations such as (1) the size,
286 Sections 4 and 5, Collection of Statistics Act.
287 Section 8, Collection of Statistics Act.
288 Section 100, 101, Italian Personal Data Protection Code, 2003.
289 Section 27(1)(d), POPI Act.
290 Section 33, UK DPA does not provide a blanket exemption for this category. Data protection principles such
as the requirement to keep data secure etc. would still apply.
291 Section 31, UK DPA.
292 Section 45(2)(e), Personal Data Protection Act, 2010.
293 Section 62, Singapore Act.
294 Section 46, Personal Data Protection Act, 2010.
295 Sections 6C, 6D and 6E, Privacy Act.
55