A Comparative Study Of GDPR And Local Legislations In Dealing With Cyber Crimes
Author: LawSphereX
Category: Criminal Law
Published:
Updated:
A COMPARATIVE STUDY OF GDPR AND LOCAL
LEGISLATIONS IN DEALING WITH CYBER CRIMES
Shubh Kapoor, Amity Law School, Amity University, Noida Dr. Ekta Gupta, Amity Law School, Amity University, Noida The GDPR Framework on Data Protection and Cyber Crime Prevention
1. Origin and Objectives of the GDPR
The General Data Protection Regulation (GDPR) was adopted by the European Parliament and the Council of the European Union on 27 April 2016 and came into force on 25 May 2018. It replaced the outdated Data Protection Directive 95/46/EC, which had governed data protection in the European Union (EU) since 1995. The GDPR was introduced to address the dramatic technological changes and the increased complexity of data processing brought about by digitalisation, cloud computing, social media, and global data flows. It aimed to unify and modernise data protection laws across the EU, giving individuals greater control over their personal data while also simplifying the regulatory environment for international business within the EU1 The origin of the GDPR lies in the recognition that personal data has become a crucial asset in the information economy.
As the internet expanded and the global digital ecosystem grew more complex, the risks of privacy violations and cyber crimes intensified. The 1995 Directive, being a product of its time, lacked the mechanisms to effectively regulate modern data-driven practices. It did not include provisions to address issues such as data portability, profiling, or large-scale cross-border data transfers. As a result, the EU embarked on a comprehensive reform of its data protection rules in 2012, culminating in the GDPR, which was adopted after extensive consultations and legislative negotiations. The GDPR’s objectives are multi-fold.
Primarily, it seeks to protect fundamental rights and freedoms of natural persons with regard to the processing of personal data and ensure the free 1 European Commission, Proposal for a Regulation on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation), COM(2012) 11 final.
flow of such data within the EU. The regulation emphasises the need for transparency, accountability, and fairness in data processing activities. It introduces several groundbreaking concepts such as the right to be forgotten, data portability, and privacy by design and by default, which are aimed at enhancing user autonomy and empowering individuals in the digital age2 Another key objective is to harmonise data protection laws across all EU member states. Prior to the GDPR, variations in national data protection laws created regulatory fragmentation and compliance burdens for companies operating in multiple jurisdictions. By introducing a single, uniform regulation applicable across the EU, the GDPR reduces legal uncertainty and fosters a consistent approach to data privacy.
Moreover, the regulation has extraterritorial reach, applying to any entity—whether within or outside the EU—that processes the data of EU residents. This global application of GDPR principles has made it a de facto standard for data protection worldwide Additionally, the GDPR was crafted to increase accountability of data controllers and processors. Organisations are now required to implement technical and organisational measures to ensure data protection, conduct Data Protection Impact Assessments (DPIAs), and appoint Data Protection Officers (DPOs) in certain cases. Heavy penalties for noncompliance—up to €20 million or 4% of global annual turnover—serve as a deterrent and reinforce the seriousness of data protection obligations In conclusion, the GDPR represents a landmark shift in privacy and data governance.
It was born out of the EU’s longstanding commitment to human dignity and privacy, aiming to restore trust in the digital economy while curbing misuse of personal data and mitigating cyber risks. Its comprehensive scope and strong enforcement mechanisms position it as a cornerstone in global efforts to regulate cyberspace and enhance cybersecurity.
2. Key Principles: Lawfulness, Transparency, Accountability, etc.
The General Data Protection Regulation (GDPR) is founded upon a framework of core principles that guide all data processing activities. These principles are enshrined in Article 5(1) of the GDPR and serve as the foundation for interpreting and enforcing the regulation. Their role is pivotal in ensuring that data controllers and processors operate within the bounds
2 Orla Lynskey, The Foundations of EU Data Protection Law (Oxford University Press 2015) 86.
of fairness, respect for individual rights, and responsible governance. The key principles include lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Lawfulness, Fairness, and Transparency These interlinked principles collectively require that personal data be processed in a manner that is lawful (based on a legal ground), fair (not unduly harmful or deceptive), and transparent (clear and open to the data subject). Lawfulness is typically ensured when processing is based on one of the six legal bases under Article 6, such as consent, performance of a contract, or legitimate interests3.
Transparency requires that individuals are clearly informed about how their data is used, often through privacy notices and declarations Purpose Limitation Data should be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. This principle prevents ‘function creep’, where data collected for one objective is later used for unrelated purposes without consent. For instance, data collected by an app for providing fitness advice should not be repurposed for marketing without express user approval. Data Minimisation The GDPR mandates that only data which is adequate, relevant, and limited to what is necessary for the purpose be collected.
This principle is designed to limit the data footprint of organisations and reduce risks of misuse or breach4 For example, collecting users’ home addresses when only their email is needed would violate this principle. Accuracy Organisations must take reasonable steps to ensure that personal data is accurate and up-todate. Inaccurate data must be erased or rectified without delay. This principle is especially relevant for sectors like finance and healthcare, where inaccurate data could have significant
3 Article 6, Regulation (EU) 2016/679 (General Data Protection Regulation
4 Christopher Kuner, Transborder Data Flows and Data Privacy Law (Oxford University Press 2013) 101.
consequences. Storage Limitation Data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purpose for which the data was collected. This encourages organisations to implement data retention policies and to regularly purge outdated information. Integrity and Confidentiality This principle requires that personal data be processed in a way that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage. It highlights the need for technical safeguards such as encryption and firewalls, as well as organisational safeguards like access control and training.
Accountability Perhaps the most revolutionary element of the GDPR is the principle of accountability, which places the onus on data controllers to demonstrate compliance with all the above principles5. This means maintaining documentation, conducting impact assessments, appointing data protection officers where required, and being able to prove that processing activities align with the law. These principles do not operate in isolation. Rather, they form an interconnected framework that shapes the responsibilities of entities handling data and safeguards the rights of data subjects. A failure to uphold these principles can result in regulatory sanctions, reputational damage, and civil liability.
In conclusion, the GDPR’s core principles represent a values-based approach to data protection, ensuring that the digital economy operates with ethics, accountability, and respect for individual autonomy. By requiring transparency and justifiability in data processing, these principles not only combat cyber crimes and privacy breaches but also promote public trust in data-driven systems.
5 Article 5(2), GDPR.
3. Rights of Data Subjects and Obligations of Data Controllers
The GDPR, as a landmark regulation in the domain of data protection, emphasizes not only robust regulatory mechanisms but also empowers individuals (data subjects) with enforceable rights and obligates data controllers to uphold those rights transparently and accountably. The regulation aims to shift the balance of power from organisations towards individuals, ensuring autonomy over personal information. Rights of Data Subjects Data subjects under the GDPR are granted a series of rights that enhance their control over their personal data.
These include: Right to Access (Article 15): Individuals have the right to obtain confirmation whether their personal data is being processed, and where that is the case, access to the data and relevant information such as purposes of processing, categories of data, recipients, and retention period6 Right to Rectification (Article 16): This allows data subjects to request correction of inaccurate or incomplete personal data without undue delay. Right to Erasure (Right to be Forgotten) (Article 17): Individuals may demand deletion of their personal data in circumstances such as when the data is no longer necessary, or when consent has been withdrawn and no other legal ground exists.
Right to Restrict Processing (Article 18): Data subjects may request limitations on how their data is processed under certain conditions, such as while accuracy is contested or where processing is unlawful but deletion is not preferred. Right to Data Portability (Article 20): This allows individuals to receive their personal data in a structured, commonly used format and transmit it to another controller, facilitating interoperability and user choice. Right to Object (Article 21): Data subjects can object to processing based on legitimate interests or direct marketing, requiring controllers to cease processing unless compelling
6 Art. 15, Regulation (EU) 2016/679 (General Data Protection Regulation).
legitimate grounds are demonstrated. Rights in Relation to Automated Decision-Making and Profiling (Article 22): The GDPR protects individuals from decisions based solely on automated processing, including profiling, which significantly affect them, unless explicit consent is given or legally authorized. These rights represent a paradigm shift in digital regulation, prioritising user consent, control, and transparency in data use. They also ensure a checks-and-balances system against excessive or invasive surveillance and data monetisation practices. Obligations of Data Controllers Data controllers, defined under Article 4(7) as entities that determine the purposes and means of processing personal data, are entrusted with significant responsibilities to ensure the implementation and enforcement of GDPR principles.
Lawful Processing: Controllers must ensure that all data processing activities have a lawful basis under Article 6, such as consent, legal obligation, or contract performance. 7 Transparency and Information: They are obligated to provide clear and accessible information to data subjects about how their data is being used, usually through privacy notices or consent forms. Accountability and Documentation: Controllers must maintain detailed internal records of processing activities under Article 30, especially when processing poses risks to data subjects.
Implementation of Data Protection Measures: Controllers are required to adopt technical and organisational measures (such as pseudonymisation, encryption, access controls) to ensure data protection by design and by default (Articles 25 and 32) Notification of Data Breaches: In the event of a data breach, controllers must notify the relevant Data Protection Authority (DPA) within 72 hours under Article 33 and, in serious cases, inform the affected data subjects under Article 34.
7 Art. 6, GDPR.
Cooperation with Supervisory Authorities: Controllers must cooperate with the authorities for investigation and enforcement of GDPR, including enabling audits, access to records, and responding to complaints or requests. These obligations are not merely theoretical but come with substantial penalties for noncompliance. GDPR allows for administrative fines up to €20 million or 4% of global turnover, whichever is higher, in cases of serious violation. In sum, the GDPR establishes a balanced data governance regime. On one hand, individuals are granted comprehensive rights that empower them in the digital space; on the other hand, data controllers are held to high standards of responsibility, transparency, and security. Together, they form the bedrock of modern digital trust architecture.
4. Security Measures and Breach Notification Requirements
With the exponential increase in the volume of personal data being processed digitally and the corresponding rise in cyber threats, data protection mechanisms have had to evolve from mere administrative measures to highly dynamic technical and organisational safeguards. The General Data Protection Regulation (GDPR) represents a paradigm shift in this evolution. It prescribes both preventive and reactive obligations for entities involved in personal data processing. These obligations are not only aimed at securing personal data but also at ensuring accountability in the event of a data breach.
I. Security Measures Under Article 32
Article 32 of the GDPR establishes that data controllers and processors must implement appropriate technical and organisational measures to ensure a level of security that is proportionate to the risk presented by data processing activities. This includes consideration of the state of the art, cost of implementation, and the nature and scope of processing operations. The regulation's risk-based approach acknowledges that the same level of security cannot be universally applied to all types of data or organisation8 Some key prescribed security measures include:
8 Regulation (EU) 2016/679, Art. 32, General Data Protection Regulation (GDPR).
Pseudonymisation and Encryption of Data: The GDPR advocates for pseudonymisation and encryption as fundamental tools in mitigating risks related to data exposure. Pseudonymisation involves processing data in a manner that it can no longer be attributed to a specific subject without additional information stored separately. Encryption protects the confidentiality and integrity of data by making it unintelligible to unauthorised individuals. Resilience of Systems and Services: Entities must ensure that their data processing systems can maintain functionality and recover quickly in the event of physical or technical incidents This implies robust disaster recovery protocols, system redundancy, and uninterrupted access to data where needed. Regular Testing and Evaluation: Security measures must not remain static.
The GDPR imposes a duty on controllers to regularly test and assess the effectiveness of security practices. This is designed to adapt the level of protection to emerging technological threats. Furthermore, Article 25 introduces the principles of data protection by design and by default, placing the onus on developers and organisations to integrate security features into technologies and processes from the very beginning, rather than as an afterthought9
II. Breach Notification Obligations
The GDPR’s breach notification provisions, codified in Articles 33 and 34, are among its most progressive elements. They reflect an understanding that even with the best security frameworks, breaches may occur, and therefore timely and transparent disclosure is essential to mitigate harm. Notification to Supervisory Authorities: Article 33 mandates that in the case of a personal data breach, the data controller must notify the competent supervisory authority within 72 hours of becoming aware of it. The notification must detail the nature of the breach, including the number of affected data subjects and records, potential consequences, and measures taken or proposed to address the breach. If notification is not made within the stipulated time, reasons for the delay must be justified.
9 GDPR, Art. 32(1)(b).
Communication to Data Subjects: Where a breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller must also inform the affected individuals without undue delay. This empowers individuals to take necessary precautions and ensures organisational accountability. There are, however, exceptions to this obligation: l If data was encrypted or anonymised, l If post-breach measures neutralised the risk, l If direct communication involves disproportionate effort, in which case a public notice suffices. III. Documentation of Breaches
Even if the breach does not warrant external reporting, Article 33(5) obligates data controllers to maintain internal documentation of all data breaches. This includes the facts relating to the breach, its effects, and remedial action taken. Such documentation is critical for supervisory authorities during audits or investigations.10 IV. Practical Challenges and Global Impact
While the GDPR has introduced a comprehensive framework for data security, implementation is not without challenges. Many organisations, especially SMEs, struggle with technical knowhow, costs of compliance, and coordinating incident response across multiple jurisdictions. Additionally, the standardisation of breach notification procedures has had a significant influence on data protection regimes globally, including the California Consumer Privacy Act (CCPA), Australia’s Notifiable Data Breaches (NDB) scheme, and India’s Digital Personal Data Protection Act, 2023. The GDPR has redefined the relationship between organisations and data subjects, turning privacy from a mere compliance obligation into a strategic priority and trust-building tool. By embedding security measures and breach notification into the legal fabric, it not only promotes
10 Ibid, Art. 33(5).
resilience in the digital economy but also ensures that individuals’ rights are better protected in the event of cyber vulnerabilities.
5. Enforcement Mechanism and Penalties
The General Data Protection Regulation (GDPR) introduced one of the most robust and farreaching enforcement mechanisms in the realm of data protection and privacy. Its goal is to ensure that organisations comply with obligations not through mere formalism, but through a culture of accountability, transparency, and deterrence. The enforcement mechanisms are designed to give real teeth to regulatory oversight by empowering supervisory authorities and ensuring high penalties for non-compliance. I. Supervisory Authorities and the One-Stop-Shop Mechanism
The GDPR mandates the establishment of independent supervisory authorities (SAs) in each Member State, responsible for monitoring the application of the Regulation, promoting public awareness, and handling complaints from individuals. The European Data Protection Board (EDPB) coordinates these authorities to ensure uniform interpretation across the EU. The "One-Stop-Shop" mechanism (Article 56) is particularly notable. It allows multinational entities with cross-border processing operations to deal with a single lead authority, streamlining compliance and avoiding conflicting national approaches. However, this system also ensures that cooperating supervisory authorities from affected countries can still participate in investigations.11 II. Investigatory and Corrective Powers
Articles 58(1) and 58(2) of the GDPR give extensive powers to supervisory authorities, including: Investigatory powers – access to all data and premises, the power to conduct audits, and the right to obtain information from the controller or processor. Corrective powers – issuing warnings, reprimands, ordering rectification or erasure of data, restricting processing, suspending data flows, and most importantly, imposing administrative
11 GDPR, Art. 56.
fines. The decision to impose a fine is based on various criteria, including the nature of the breach, the intentionality or negligence involved, actions taken to mitigate damage, the categories of personal data affected, and prior infringements. III. Penalties under the GDPR
The GDPR stipulates a two-tier penalty system: Up to €10 million or 2% of global annual turnover (whichever is higher) for less severe breaches, such as failure to maintain records, cooperate with authorities, or implement adequate security measures. Up to €20 million or 4% of global annual turnover (whichever is higher) for serious violations such as unlawful processing, failure to obtain consent, or infringement of data subject rights12. These penalties have a profound deterrent effect and represent a shift from reactive compliance to proactive governance. Some landmark fines include: The €746 million fine against Amazon by Luxembourg’s DPA in 2021 for targeted advertising practices. The €225 million fine against WhatsApp by Ireland’s Data Protection Commission for failure to provide adequate transparency in data sharing13 IV. Judicial Remedies and Class Actions
Data subjects are empowered under Articles 77–82 to file complaints and seek judicial remedies for violations of their rights. They may claim compensation for material or nonmaterial damage resulting from data breaches. The GDPR also permits not-for-profit organisations to bring representative actions on behalf of individuals, expanding access to justice.
12 Ibid, Art. 83(5).
13 Irish Data Protection Commission, “WhatsApp Decision,” 2021.
6. Role of GDPR in Combating Cyber Crimes
While the GDPR is not a cybercrime statute per se, it plays a pivotal role in preventing, deterring, and responding to cybercrimes, particularly those involving personal data. Its comprehensive structure of rights, obligations, and enforcement mechanisms strengthens the legal response to threats in cyberspace. I. GDPR as a Cybersecurity Enabler
The GDPR’s requirements for data minimisation, security by design, and breach notification directly address vulnerabilities exploited in cybercrime. For example, mandating pseudonymisation and encryption under Article 32 reduces the impact of data exfiltration attacks. The obligation to notify breaches ensures that incidents do not remain hidden and that victims and authorities can act promptly. Furthermore, GDPR compliance often involves conducting Data Protection Impact Assessments (DPIAs), which evaluate risks posed by new technologies or processing activities. These assessments inherently integrate cybersecurity concerns into the broader privacy compliance framework. II. Deterrence of Data-Driven Crimes
The GDPR’s penalties create a strong incentive for organisations to invest in robust cyber defenses, such as secure databases, intrusion detection systems, and access control. Organisations failing to secure data not only risk reputational harm but also multi-million-euro fines. This economic consequence serves as a deterrent against negligence that facilitates crimes like identity theft, phishing, and ransomware.
III. Encouraging Cyber Incident Reporting
The GDPR mandates the notification of personal data breaches within 72 hours (Article 33). This provision increases transparency and ensures that cyberattacks are promptly reported to relevant authorities. Unlike earlier regimes, where incidents were often concealed, GDPR creates a formal obligation to act responsibly and inform stakeholders14
14 GDPR, Art. 33.
IV. Supporting Cross-Border Enforcement
Given the global nature of cybercrimes, the GDPR's architecture facilitates cross-border cooperation between supervisory authorities through the EDPB and the consistency mechanism. This cooperation can lead to harmonised responses to international cyber threats and large-scale data breaches impacting multiple jurisdictions. V. Synergy with Cybercrime Laws
Though GDPR is complementary to instruments like the Council of Europe’s Convention on Cybercrime (Budapest Convention), it offers an essential civil and administrative dimension. While cybercrime laws focus on criminalising conduct and prosecuting offenders, GDPR focuses on preventing the crime through compliance and ensuring restitution for victims via data subject rights. In conclusion, GDPR has transformed data protection law into a cornerstone of cybercrime prevention. By embedding strong data governance standards, empowering individuals, and creating accountability mechanisms, it not only protects personal privacy but also contributes meaningfully to global cybersecurity resilience.