white_paper_on_data_protection_in_india_171127_final_v2

that the collection is reasonably necessary for the entity‘s functions. Under the Privacy Act,
consent can mean either express consent or implied consent.
United States
In the US, privacy is protected by a patchwork of laws at the state and federal levels. Many
are sector specific. Data protection practices are carried out largely on the basis of consent
and notice. For example, legislations such as the GLB Act, 415 which governs the financial
services industry, places certain obligations on financial institutions to seek the consent of
consumer prior to collecting non-public financial institution and does not permit the
disclosure of any non-public financial information to a third party in the absence of the
consumer‘s consent (obtained by way of notice). 416 Similarly HIPAA, which regulates
medical information, requires that written consent of the data subject is required before
disclosing medical information. 417
1.4 Provisional Views
1. The importance of consent in data protection law is widely recognised. Keeping in
mind the importance of consent, it is proposed that consent of individuals should be one
of the grounds for collection and use of personal data. However, at the same time is it
recognised that consent is being used as a means to disclaim liability. In the context of
data collected and processed by the government, the individual often has no choice but
to provide her data. Thus the validity of consent will have to be carefully determined.
2. In order for the consent to be valid, it should be freely given, informed and specific to
the processing of personal data by way of a well-designed notice (discussed in Part III,
Chapter 3 of the White Paper).
3. All transactions may not warrant the same standards of consent. Therefore, there may
be a need to explore and accommodate standards of consent within the data protection
law and align it with different types of information. Additionally, the standards for
implied consent may need to be evolved in order to ensure that adequate information is
provided to the individual giving her consent.
1.5 Questions
1. What are your views on relying on consent as a primary ground for processing personal
data?
Alternatives:
415 15 U.S.C. Sections 6801-6827.
416 Section 502, GLB Act.
417 42 U.S.C. Section 1301.
83