“There is a need to talk about consent explicitly from a data protection perspective”

“Now we have the demarcation between personal data identified as the bill data and sensitive data because very rightly the risks associated with a piece of data will vary with the kind of data it might be. The more sensitive it is the higher the risk context which means the security context is higher and the protection context is even more important. In that context, I think we need to have the ability to look at when we talk about consent in the context of these kinds of data, how are we going to be implementing the consent requirements. Right now we want to talk about consent explicitly from the data subject which is good and important. It is also important to realize how we are going to be implementing those pieces. So when we talk about consent about mobiles and addresses, well this is a kind of data we are throwing anywhere. But at the same time looking at how many times you are going to prompt a user in this digital world to give consent, you would end up having multiplicity and fatigue of taking consent in that process.

So we need to think a little bit broader in that sense. Notification can be used in that case rather than asking for consent every time.  You can talk about the legitimate interest that you have in using a data beyond the consent that you might have given is covered within the legitimate piece in the notification. Using notification is a good tool. Again looking at de-identification, a lot of data does get gathered but doesn’t have value because its linked to an individual. It might just have value as a meta tag. That data might get gathered on a server somewhere on the world just to give an analysis of de-identifying them from their names to get them into that space of knowing their routines etc. There is value in using de-identified data and that value should not be hampered because we are talking about every piece of data that might lead to some individual. So we need to be very careful about the rules of de-identification.”  

Meenu Chandra
Senior Attorney Manager, IP& DCU Lead (India Region) - Microsoft