Privacy Law Blog : Privacy Lawyers & Attorneys : Proskauer Rose Law Firm : CAN-SPAM, FCRA, FACTA

Rule 5(1) of the Privacy Rules requires a company to obtain prior written consent through letter, fax or email when collecting sensitive personal data or information from the provider of such information. Rule 6 of the Privacy Rules requires companies to obtain prior consent to disclose or share sensitive personal data or information with third parties. These rules would have made it extremely difficult for Indian call center operators and Indian providers of business process outsourcing services to operate as it would mean, for example, that a call center operator providing customer service on behalf of a U.S. bank or insurance company would have to obtain a caller’s prior written consent before it could collect any personal account or health information required to respond to the caller’s questions or to share such information with the bank or insurance company of whom the caller is a customer. However, the ministry has clarified that Rules 5 and 6 do not apply to companies providing services relating to the collection, storage, dealing or handling of sensitive personal data or information under contractual obligation with any legal entity located within or outside of India. However, companies collecting sensitive personal data or information from individuals pursuant to a contractual obligation directly with such individuals would still be subject to these Rules. Further, in instances where the prior written consent requirement would still apply, the ministry’s release clarifies that “consent given by any mode of electronic communication” is acceptable. This implies that consent provided by checking a consent box as part of an online account registration process would satisfy the consent requirement of the Privacy Rules and that letter, fax and email are not the only acceptable means of obtaining consent.

Another important clarification made by the ministry relates to the potential extra-jurisdictional application of the Privacy Rules. The Privacy Rules have been promulgated under the Indian Information Technology Act (2000) (the “IT Act”). Section 1(2) of the IT Act states that it applies to “the whole of India and…to any offence or contravention thereunder committed outside India.” However, the ministry’s release clarifies that the Privacy Rules only apply to companies or persons “located within India.” Therefore, concerns that foreign companies not located in India may have to comply with provisions of the Privacy Rules mandating the publication of online privacy policies containing certain required disclosures and the appointment of a grievance officer to address privacy-related issues seem to have been alleviated.

The release also clarifies that the term “provider of information” as used in the Privacy Rules refers to a natural person who provides sensitive personal data or information to an Indian company.

With these clarifications, Indian companies providing outsourcing services, non-Indian customers of such services and multi-national companies doing business in India now have guidance on when compliance with the Privacy Rules is required and how such compliance with the Privacy Rules can be achieved.
 

Data Controller:

The definition of data controller, under Article 2(d) of the Directive, is “the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data . . . .”

In clarifying the definition of controller, the Working Party analyzed its constituent parts. 

• In its discussion of “joint control,” the Working Party stated that parties who act jointly have certain flexibility with respect to the allocation of obligations and responsibilities under the Directive. In its assessment, the Working Party said that the factual circumstances relating to the relationship must be considered.  It warned that joint control among multiple controllers may lead to a lack of clarity in the allocation of responsibilities, which could potentially result in a violation of the principle of fair processing.

• In its discussion of “determines,” the Working Party advised that such an analysis should be factual, and should begin with the questions “why is this processing taking place? Who initiated it?” “[A] body which has neither legal nor factual influence to determine how personal data are processed cannot be considered as a controller.”

• In its discussion of “purposes and means of processing,” the Working Party advised that the key questions that should be asked when analyzing purposes of processing are “why the processing is happening and what is the role of possible connected actors like outsourcing companies: would the outsourced company have processed data if it were not asked by the controller, and at what conditions?” It also stated that the key questions that should be asked when analyzing the means of processing include technical questions, like “which hardware or software will be used?” and organizational questions, like “which data shall be processed? For how long shall they be processed?” The Working Party went on to state that determining the purpose of processing is reserved solely to the controller, while determining the means of processing may be delegated by the controller to a processor. 

Data Processor:

Data processor, under Article 2(e) of the Directive, is defined as “a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller.” The processor must be a separate legal entity with respect to the controller. In its assessment, the Working Party focused on the meaning of “on behalf of the controller.”  It called upon the legal concept of “delegation,” in that the processor is only permitted to perform data processing within the bounds of the mandate given by the controller. The Working Party stressed that should a processor exceed such bounds and begin to acquire a role in determining the purposes and means of processing, it may become a controller rather than a processor under the Directive. 

Under Directive 95/46/EC, personal data may only be transferred by EC Member States to a third country if that country ensures an adequate level of data protection.  EC Member States may circumvent this relatively high standard by incorporating SCCs covering data protection into their agreements with personal data processors in countries that lack adequate data protections.  The SCCs are intended to ensure that personal data is appropriately safe guarded when transferred to a data processor in a third country that does not otherwise provide an adequate level of data protection.