white_paper_on_data_protection_in_india_171127_final_v2

PART III
GROUNDS OF PROCESSING, OBLIGATION ON ENTITIES AND INDIVIDUAL
RIGHTS
CHAPTER 1: CONSENT
1.1 Introduction
Consent forms the foundation of data protection law in many jurisdictions. There is great
value in using consent as a validating mechanism for data processing. It satisfies two needs.
First, consent is intuitively considered as the most appropriate method to ensure the
protection of an individual‘s autonomy. 392 Allowing an individual to have autonomy over her
personal information allows her to enjoy ―informational privacy‖. Informational privacy may
be broadly understood as the individual‘s ability to exercise control over the manner in which
her information may be collected and used. 393 Second, consent provides a ―morally
transformative‖ value as it justifies conduct, which might otherwise be considered
wrongful. 394 For instance, seeking consent is what differentiates entering someone‘s house
with permission, from trespass.
Recently, the Puttaswamy judgment, held that the right to privacy would encompass the right
to informational privacy, which recognises that an individual should have control over the use
and dissemination of information that is personal to her. 395 Unauthorised use of personal
information would lead to an infringement of this right.
Consent has largely been considered to be an efficient means of protecting an individual‘s
information. 396 Operationalising consent is done through the mechanism of ―notice and
choice‖. Through this, the individual is put in charge of the collection and use of her personal
information. This is believed to be a more flexible, inexpensive and easily enforceable
mechanism of protecting personal data of individuals, rather than strict regulation over how
individuals‘ data may be used. 397 Seeking consent allows the individual to be responsible for
managing her own information, thereby resulting in ―privacy self-management‖ 398 .
392 ―In democratic societies, there is a fundamental belief in the uniqueness of the individual, in his basic dignity
and worth…and in the need to maintain social processes that safeguard his sacred individuality.‖ See: Alan
Westin, ‗Privacy and Freedom‘, (Atheneum, 1967).
393 Adam Moore, ‗Toward Informational Privacy Rights‘, 44 San Diego Law Review 809 (2007).
394 John Kleinig, ‗The Nature of Consent‘ in ‗The Ethics of Consent- Theory and Practice‘, 4 (Alan Wertheimer
and Franklin Miller (eds.), Oxford University Press, 2009).
395 Justice K.S. Puttaswamy (Retd.) & Anr. v. Union of India & Ors., (2017) 10 SCALE 1.
396 Joel R. Reidenberg et al., ‗Privacy Harms and the Effectiveness of the Notice and Choice Framework‘, 11
Journal of Law and Policy for the Information Society, 485, 489, (2015).
397 Ryan M. Calo, ‗Against Notice Skepticism in Privacy (and Elsewhere)‘, 87(3) Notre Dame Law Review
1027 (2012), available at: http://scholarship.law.nd.edu/cgi/viewcontent.cgi?article=1020&context=ndlr, (last
accessed 21 October 2017).
398 Privacy self-management has its origins in the Fair Information Practices (FIPPs), which were created in the
1970s in order to address concerns about the increasing digitisation of data. These principles also helped shape
the OECD Privacy Guidelines. See Daniel Solove, ‗Privacy Self-management and the Consent Dilemma‘, 126
Harvard Law Review 1880, 1881, (2013).
78