white_paper_on_data_protection_in_india_171127_final_v2

informed choice regarding the possible future uses of their information, and the harms that
may arise as a result. All these factors contribute towards decreasing the value of consent. 400
This issue is especially relevant with respect to the growing use of data aggregation
techniques. Individuals may be able to foresee an immediate harm caused by misuse of their
personal information, however, it is highly unlikely that they will be able to predict future
uses of their information, which takes place after combining it with other data sets.
Further, many organisations use notices as a means to disclaim their liability instead of
actually using this opportunity to inform the individual about the organisations‘ data use
practices. The presence or absence of a notice may be a first step for regulators to determine
whether an organisation is compliant with data protection laws in that country. Therefore, in
order to make their privacy notice as comprehensive as possible, and avoid liability,
organisations treat notices as legal documents and use legalese and technical terms that the
individual may not understand. 401 This is a commonly noticed phenomenon.
(ii)
Standards of consent
While recognising the importance of consent as a foundational concept, there may be a need
for having different standards of consent for different transactions. A ―one-size fits all‖ model
may not be sufficient. It may not be necessary to obtain ‗express‘ consent for certain routine
transactions, if these activities do not involve processing sensitive personal information. For
routine, low-risk transactions, an individual‘s implied consent may be sufficient. If a data
controller wishes to collect and use sensitive information, the misuse of which is likely to
cause great harm to an individual, then the express consent of the individual may be
required. 402 Therefore, there may be a need to explore and accommodate standards of consent
within the data protection law and align it with different types of information.
(iii) Consent Fatigue
Consent as it was originally intended, is likely to suffice in an environment where there are
limited reasons for collecting information and only a few uses to which it could be put. This
would make it relatively easy for an individual to keep track of her information being
collected, and to what purposes it is being put to use. 403 At present, data processing has
become a largely routine activity and individuals are flooded with notices seeking permission
to process data. Given the number of requests and the effort required to scrutinise each one,
400 Daniel Solove, ‗Privacy Self-management and the Consent Dilemma‘, 126 Harvard Law Review 1880, 1881,
(2013).
401 Fred H. Cate, ‗Failure of Fair Information Principles‘, in ‗Consumer Protection in the Age of Information
Economy‘, (Jane K. Winn ed., Routledge, 2006).
402 Article 29 Data Protection Working Party, ‗Opinion 15/2011 on the Definition of Consent‘, European
Commission (13 July 2011), available at: http://ec.europa.eu/justice/data-protection/article-
29/documentation/opinion-recommendation/files/2011/wp187_en.pdf, (last accessed 24 October 2017).
403 Rahul Matthan, ‗Beyond Consent: A New Paradigm for Data Protection- Discussion Document 2017-03‘,
Takshashila Institution, (19 July 2017), available at: http://takshashila.org.in/wp-content/uploads/2017/07/TDD-
Beyond-Consent-Data-Protection-RM-2017-03.pdf, (last accessed 24 October 2017).
80