India

Abstract

India has neither prepared or implemented specific data protection or privacy laws. Since 2011, the Indian Parliament has presided over a Privacy Bill, and today there continues to be little progress on implementing dedicated privacy laws. In 2017, India released a White Paper in relation to a data protection framework for the country, which sought community comment in relation to future privacy and data protection. The White Paper highlights many of the principles that other nations and the EU have currently adopted in their respective data protection laws. India has based the community feedback by looking to the EU, United States of America, Australia, Canada and Singapore, to assist and guide the development of specific privacy laws in their country. However, the current approach is neither close to the EU, Singapore or Australia’s model. The current approach taken by India sits well outside what is being considered the global standard, but has similarities to Indonesia. Arguably, one of the dilemmas for India in the continued delay in establishing specific data protection laws, may come at a cost to their Internet economy. This is because, India has one of the largest Internet economies in the world, that has developed from their online outsourcing industry. Arguably, India, as it has sought, and is seeking to continue to position itself as an attractive destination for business and data processing (Kessler, D, Ross, S, Hickok, E A Comparative Analysis of Indian Privacy Law and the Asia-Pacific Economic, Cooperation Cross-Border Privacy Rules, National Law School of India Review, Vol. 26, No. 1 (2014), pp. 31–61). The courts in India have interpreted data protection in accordance with the right to privacy in accordance with Article 19 and 21 of the Constitution of India (Justice K S Puttaswamy, and ANR v Union of India and Ors, No. 494 of 2012). Chapter 6 will demonstrate how India’s current approach is far from specific or coherent and rather based on industry sectors. Due to the limited scope of India’s privacy and data protection laws, this Chapter only discusses the key concepts and principles such as Personal Information, Right to be Forgotten, Data Controller, Public and Private, Consent and Collection. The Chapter will also discuss the principles and concepts similar to other chapters and include Cross-Border Transfer, Retention, Enforcement, Commissioner, Controller Functions, Codes of Practice and Standards, along with a brief outline of the Proposed New Privacy and Protection Law and Supporting Laws. The Chapter concludes by summarizing the key principles of the proposed data protection and privacy laws.