white_paper_on_data_protection_in_india_171127_final_v2

Another advantage of relying on consent to protect personal information is that it takes into
account varying privacy principles. An individual may often be best placed to determine how
much of her personal information she is willing to exchange in return for the goods and
services offered by an organisation. For example, an individual buying a book online may be
happy to allow the online store to track and record her shopping choices and to be informed
of new releases in her genres of interest; another may not. The information regarding the
purposes for which the online store could collect information could be provided to the
individual by way of a privacy notice. In an ideal situation, the individual would read the
privacy notice, become aware of the information collection practices of the organisation, and
then make the decision whether or not she wishes to complete the online transaction. Here,
consent could arguably be a more effective means of protecting personal data than the law
stepping in and prohibiting the use of a customer‘s personal data for promotional material.
Qua the individual, this might be an efficient solution provided the uses of such information
are within the bounds of reasonableness. But its systemic impact requires greater scrutiny.
1.2 Issues
Although consent continues to play a critical role in data protection law, several issues with
the practical operation of consent have been observed over the years. These are described
below:
(i)
Lack of Meaningful and Informed Consent
Although the purpose of consent is to enable individuals to self-manage their privacy and
ensure autonomy, this is often difficult to achieve in practice. Privacy self-management
assumes that an informed and rational individual is capable of making appropriate decisions
about her data collection and use. Needless to say, this is a questionable assumption.
Consent and notice go hand in hand. An individual can make an informed choice regarding
the collection and use of her personal information, only on the basis of information that she
receives from an organisation. Most individuals do not read privacy notices, and, if they do,
are unable to comprehend the information contained in them. This may be because of certain
flaws within the notice itself (which will be discussed in Part III, Chapter 3 of the White
Paper). In certain situations, individuals do read the privacy notice, but they lack sufficient
expertise to assess the consequences of agreeing to a particular use of their information. 399
This is particularly true in areas of rapidly changing technology where it might be difficult for
an individual to continually educate herself about the advances in technology and
consequently their impact on her privacy. Finally, even if individuals manage to read and
understand the information contained in the notice, they will be able to make an informed
choice only about the immediate use of their information. They may not be able to make an
399
CGAP, Dalberg and Dvara Research, ‗Privacy on the Line‘ (November 2017), available at:
https://dalberg.com/our-ideas/privacy-line, (last accessed 18 November 2017).
79