white_paper_on_data_protection_in_india_171127_final_v2

United Kingdom
The UK DPA also requires the data subject to provide consent for the processing of her
personal data. 408 The UK DPA follows the EU GDPR approach by making consent only one
of the six grounds for lawful processing.
South Africa
The POPI Act also recognises that processing of personal data should only takes place with
the consent of the data subject. It follows the EU GDPR and the UK DPA approach by
making consent one of the other grounds for lawful processing of personal data. 409
Canada
Under Canada‘s PIPEDA, organisations are required to obtain an individual‘s valid consent to
lawfully collect, use and disclose personal information in the course of commercial
activity. 410 Recognising the need to have different standards of consent, the 2015 amendment
to PIPEDA (through the Digital Privacy Act) provides that the form of consent required
depends on the circumstances and the type of information being collected. 411 While express
consent is necessary for sensitive information, implied consent is sufficient for non-sensitive
information. 412 The Digital Privacy Act introduced a ―graduated consent standard‖ or a
―sliding-scale‖ for obtaining valid consent. The Digital Privacy Act stipulates that an
individual‘s consent will be valid only if an individual could reasonably expect to understand
the nature, purpose and consequences of the collection, use or disclosure of the personal
information to which she has consented. 413
Australia
Under the Privacy Act, consent is not directly a pre-requisite for collecting personal
information. The only requirement prior to collecting personal information is that the
information should be reasonably necessary for the agency‘s (government body) or the
organisation‘s (private entity) activities. The APPs set out that personal information should be
collected directly from the individual unless the individual has consented to collection from
other sources, or if it is authorised by law. 414 The bar is significantly higher for the collection
of sensitive information as the individual‘s consent is required in addition to the condition
408 Section 4, read with Schedule 1 (Principle 1), Schedule 2 (Condition 1) and Schedule III (Condition 1) of the
UK DPA.
409 Section 11(1)(a)-(f), POPI Act.
410 Principle 4.3, Schedule 1, PIPEDA.
411 Principle 4.3.4, Schedule 1, PIPEDA.
412 Principle 4.3.6, Schedule 1, PIPEDA.
413 Dan Cooper, ‗Highlights of the Canada Digital Privacy Act‘, Covington & Burling LLP (24 June 2015),
available at: https://www.insideprivacy.com/international/canada/highlights-of-the-canada-digital-privacy-act-
2015/, (last accessed 24 October 2017).
414 APP 3.6, Privacy Act.
82