Deemed consent

A Data Principal is deemed to have given consent to the processing of her personal data if such processing is necessary:

Section 8(1)

(1) in a situation where the Data Principal voluntarily provides her personal data to the Data Fiduciary and it is reasonably expected that she would provide such personal data;

Illustration 🎬

‘A’ shares her name and mobile number with a Data Fiduciary for the purpose of reserving a table at a restaurant. ‘A’ shall be deemed to have given her consent to the collection of her name and mobile number by the Data Fiduciary for the purpose of confirming the reservation.

Section 8(2)

for the performance of any function under any law, or the provision of any service or benefit to the Data Principal, or the issuance of any certificate, license, or permit for any action or activity of the Data Principal, by the State or any instrumentality of the State;

Illustration 🎬

‘A’ shares her name, mobile number and bank account number with a government department for direct credit of agricultural income support. ‘A’ shall be deemed to have given her consent to the processing of her name, mobile number and bank account number for the purpose of credit of fertilizer subsidy amount to her bank account.

Section 8(3)

for compliance with any judgment or order issued under any law;

Section 8(4)

for responding to a medical emergency involving a threat to the life or immediate threat to the health of the Data Principal or any other individual;

Section 8(5)

for taking measures to provide medical treatment or health services to any individual during an epidemic, outbreak of disease, or any other threat to public health;

Section 8(6)

for taking measures to ensure safety of, or provide assistance or services to any individual during any disaster, or any breakdown of public order;

Section 8(7)

for the purposes related to employment, including prevention of corporate espionage, maintenance of confidentiality of trade secrets, intellectual property, classified information, recruitment, termination of employment, provision of any service or benefit sought by a Data Principal who is an employee, verification of attendance and assessment of performance;

Illustration 🎬

‘A’ shares her biometric data with her employer ‘B’ for the purpose of marking A’s attendance in the biometric attendance system installed at A’s workplace. ‘A’ shall be deemed to have given her consent to the processing of her biometric data for the purpose of verification of her attendance.

Section 8(8)

in public interest, including for:

(a) prevention and detection of fraud;

(b) mergers, acquisitions, any other similar combinations or corporate restructuring transactions in accordance with the provisions of applicable laws;

(c) network and information security;

(d) credit scoring;

(e) operation of search engines for processing of publicly available personal data;

(f) processing of publicly available personal data; and

(g) recovery of debt;

Section 8(9)

for any fair and reasonable purpose as may be prescribed after taking into consideration:

(a) whether the legitimate interests of the Data Fiduciary in processing for that purpose outweigh any adverse effect on the rights of the Data Principal;

(b) any public interest in processing for that purpose; and

(c) the reasonable expectations of the Data Principal having regard to the context of the processing.