Safeguarding Data Privacy - A Comparative Study Of Legal Protections In Brazil And India
Author: LawSphereX
Category: Constitutional & Human Rights
Published:
Updated:
SAFEGUARDING DATA PRIVACY: A COMPARATIVE
STUDY OF LEGAL PROTECTIONS IN BRAZIL AND INDIA
Rohit Tamang, LL.M, CMR University School of Legal Studies, Bangalore
ABSTRACT
This study examines data protection and privacy as fundamental rights in Brazil and India. exploring their legal frameworks, key principles, and challenges. Both countries have implemented legislative measures impired by international vandards such as the GDPR, UDHR, and ICCPR. This study highlights the constitutional status of these rights and the establishment of national data protection authorities in both nations. Despite these advances, the effectiveness of these recent laws remains uncertain, with common challenges, such as balancing privacy with national security concerns and ensuring robust enforcement mechanisms. Utilizing an exploratory and hypothetical deductive methodology, this study underscores the dynamic nature of data privacy issues in the digital age.
It is concluded that while Brazil and India have made significant progress in recognizing and safeguarding data privacy ap rights, ongoing efforts are required to address emerging challenges and ensure the effectiveness of these legal protections Keywords: Data Protection, Privacy Rights, Brazil, India, Legal Frameworks, GDPR, UDHR, ICCPR, Constitutional Rights, National Data Protection Authorities, Enforcement Mechanisms, National Security, Digital Age, Emerging Challenges.
1 INTRODUCTION
This study aims to evaluate the effectiveness and operation of Brazil’s legal protection framework within the context of international standards, as well as to examine national debates around proposed amendments. By analyzing the core legal rights and present-day data protection regulations in Brazil and the EU, we identify where these data regulations and how they are found and what they are implemented, their intended recipients, and how they address personal data privacy protection policies. In Brazil, the lack of a comprehensive national privacy law has led to reliance on industry-specific privacy regulations and broad constitutional principles. The nation's legislative structure for safeguarding privacy is built upon these sectorspecific laws and the fundamental rights to privacy and personal intimacy, which are safeguarded by the Federal Constitution.
In the 20th century, few legal concepts underwent as much change and evolution as the right to privacy. What was once a relatively narrow idea expanded to address the complexities of modern life, adapting to new challenges posed by technological advances and shifting societal norms. From safeguarding personal information to protecting against intrusions into private life, the right to privacy evolved into a vital part of individual freedoms. This transformation reflects society’s growing recognition of the need to protect personal space and data in an increasingly interconnected and digital world. 1Several legal concepts evolved significantly in the 20th century, deeply impacting the privacy rights. This shift highlights privacy violations that occur when photographs of public figures are captured in compromising or private moments and are widely disseminated without consent.
It also deals with the mass collection of personal data by private companies and government bodies, made possible by modern technology. This ensures individuals' data is protected and they have control over their information in today's digital world. Stefano Rodotà argues that privacy was reinvented in the twentieth century, expanding beyond just the right to be left alone or maintaining confidentiality. It has now encompassed concepts such as transparency and control of personal data leading to the development of data protection rights. 2 Since the 1970s, there has been a growing recognition of the importance to protect personal privacy, resulting in the establishment of national data protection laws and international agreements that ensure the 1 Regarding transnational policy instruments on data protection, including, e. g. , Convention 108 of the Council of Europe) Bennett, C. J.
, & Raab, C. D. (2006). The governance of privacy: Policy instruments in global perspective (2nd ed. , pp. 83–115). MIT Press.
2 Ibid
safety of individuals' data. This shift reflects an increasing awareness of privacy rights in a world in which technology plays an ever-greater role in collecting and processing personal information. 3 In response to the increasing use of electronic data collection and processing by governmental bodies and major corporations, initial data protection laws emerged in Europe and North America. This development was driven by growing concerns about how personal information was gathered, used, and shared in an increasingly digital world. Recognizing the potential risks to individual privacy, lawmakers sought to establish guidelines and protections that would empower citizens and hold organizations accountable for their handling of personal data.
4 Since then, technology and data protection laws have continued to evolve, expanding beyond borders and reaching more regions to better protect personal data in an increasingly interconnected world. 5 Today, many emerging countries in Asia and Latin America are leading the way, with numerous nations updating their laws over the past decade to strengthen personal data protection. This reflects a growing commitment to safeguarding individuals' privacy in a rapidly changing digital landscape. Every person deserves fundamental rights like the right to live freely, to be treated equally, and to live with dignity simply because they’re human. These rights aren’t earned; they’re a part of who we are as people. These rights belong to and cannot be taken away.
To protect these rights, countries and organizations like the United Nations have created important documents, like the Universal Declaration of Human Rights and national constitutions. These documents list and explain our basic rights to make sure everyone knows them and has them protected. By putting these rights in writing, they become visible, allowing people to understand and demand them, while also holding governments accountable for safeguarding them. 6 Some rights are directly spelled out in these documents, where as have been added over time because they are closely tied to basic freedoms. The right to privacy is a key personal right. It lets people keep their lives personal and protects them from unwanted interference.
Key international agreements, including the Universal Declaration of Human Rights, International Covenant on Civil and Political Rights, and Convention on the Rights of the Child, acknowledge this fundamental right. 7 Right to Privacy integral part of human life. In India, the
3 Ibid
4 Mayer-Schönberger,“The diffusion of data protection legislation by region” in Bennett and Raab (2006, p. 127).”
5 Ibid.
6 Prakash Shah, “International human Rights
A perspective from India,” 7 Article 12, “No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such right to privacy is considered a basic part of the right to live freely and express oneself. It is protected under Articles 21 and 19 of the Constitution, which cover life, liberty, and freedom of speech . Every individual has a right to a “personal sphere” that safeguards from unnecessary intrusion or monitoring by the state or other entities. Although there is broad recognition of the obligation to safeguard privacy, international human rights bodies have not yet fully delineated the exact boundaries of this right.
The absence of clear articulation of what this right entails has led to challenges in its implementation and enforcement. Since the right to privacy is a qualified right, interpreting it presents challenges in defining the boundaries of the private sphere and determining what serves the public interest. In matters of the public interest, individuals' rights can be infringed upon through various forms of communication. The 21st century has marked a significant rise in the digital revolution, with India fully embracing this trend. India now has one of the highest numbers of internet users globally. In response, the Government of India launched the "Digital India" initiative, which encouraged the widespread processing of personal data via electronic devices and applications.
While this program has yielded numerous advantages, it also poses potential threats to fundamental freedoms, particularly the right to privacy. Both the public and private sectors are continually gathering personal data, and with the frequent use of the internet, individuals regularly share personal information across various apps, forms, and devices. For instance, people often provide personal details when filling out forms or applications for government or private services, participating in online marketing, shopping online, posting on social media, uploading resumes to job sites, purchasing SIM cards, or playing. These activities require individuals to share key personal information, such as full names, addresses, contact details, locations, and friends.
Although individuals consent to sharing this data for specific purposes, advertisers and even organized criminals can access and misuse it. This widespread exposure to personal information not only infringes upon an individual’s right to privacy via electronic platforms but also underscores the urgent need for strong data protection laws. In response to these developments, this paper the data protection frameworks in Brazil and India, focusing on their core principles and recent legislative updates. It investigates the challenges that each country encounters in attempting to balance technological progress with effective privacy safeguards, highlighting how both nations are adapting to the changing interference or attacks. ” Accessed October 21, 2016, http://www. un.
org/en/documents/udhr/, Article 17 (1), “No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation. landscape of data protection.
2. CONCEPTUALIZING DATA PROTECTION AND PRIVACY RIGHTS IN BRAZIL
AND INDIA (a) Safeguarding Personal Information and Ensuring Privacy Rights in Brazil - Prior to the extensive adoption of the Internet. for information sharing and communication, Brazil’s constitutions8, framework, unlike some other countries, did not explicitly address privacy protections related to databases. According to Limberger9, In Brazil, the legal framework that most closely addresses data protection is found in the habeas data provision, which is outlined in Article 5, subchapter LXXII7 of the Brazilian Constitution and further detailed in Law No. 9. 507/97.
10 As highlighted by this author, “the scope of the right to habeas data is highly restricted because it ensures that only the individual awareness and understanding of information in relation to data repositories of government agencies or a public character getting impaired is protected in relation to private institutions or in consumer relations”. 11In data protection laws, it is important to clearly define what counts as personal data, as this sets the foundation for protecting people’s information. A clear definition also helps us to understand the various ways in which data types can be utilized and handled by different rules. The concept of 'personal data' serves as the gateway to the applicability of the General Data Protection Regulation (GDPR). The GDPR only comes into effect during data processing involves personal information.
This key term is defined explicitly in Article 4 (1) of the GDPR that can be found in the Definitions section where "personal data' means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an 8 The example of this, the Spanish Constitution provides, in article 18. 4: “[... ] la Ley limitará el uso de la informática para garantizar el honor y la intimidad personal y familiar de los ciudadanos y el pleno ejercicio de sus derechos” David López Jiménez, ‘Los Códigos Tipos Como Instrumento Para La Protección de La Privacidad En El Ambito Digital: Apreciaciones Desde El Derecho Español’ (2013) 11 Estudios constitucionales 575 accessed 24 September 2014. p. 575-614.
9 Limberger T, O Direito à Intimidade Na Era Da Informática: A Necessidade de Proteção Dos Dados Pessoais (Livraria do Advogado 2007). p. 116-119. 10 Article 5 [... ]: LXXII – habeas data shall be granted: a) to ensure the knowledge of information related to the person of the petitioner, contained in records or data banks of government agencies or of agencies of a public character; b) for the correction of data, when the petitioner does not prefer to do so through a con dential process, either judicial or administrative; [... ] BRAZIL, ‘Constituição Da República Federativa Do Brasil. ’
11 Limberger
identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person". 12 Before Brazil passed its general data protection law, there was no clear definition of personal data, and existing laws had only started to touch on the topic. While the new law included provisions about "personal data" and how it should be handled in Article 7, it did not define these terms. Consequently, during public consultations, many people expressed the need for clearer definitions in the regulatory decree. Many participants felt that these definitions should be directly included in the personal data protection law, which was also being discussed, rather than just in the decree.
Personal data is defined under Article 5(1) of the Brazilian General Data Protection Law, which states “that personal data means information regarding an identified or identifiable natural person”. 13 A key provision emphasized is Article 14(1), which addresses the handling of personal data belonging to children and adolescents. This article stipulates that such data must be treated with particular care and requires the authorization of either a parent or legal guardian for processing. Article 14 (1) state that “The processing of personal data of children and adolescents shall be carried out in their best interest, pursuant to this article and the relevant legislation”. Paragraph 1 state that “Processing personal data of children and adolescents shall be carried out with the specific consent given by at least one of the parents or a legal guardian".
14 (b) Privacy rights and information security in the Indian Legal Framework-Data protection has become more important worldwide. Many countries recognize its significance and are creating laws to manage and protect personal information from misuse. The term "data protection" comes from the German word "Datenschutz," which means safeguarding personal information. It focuses on keeping people's private data secure and respecting their privacy”. 15 The safeguarding of personal information is integrally tied to individual privacy and, form the core of data protection. However, privacy is not an exclusive focus in this domain. A range of 12 Regulation (EU) 2016/679 of the European Parliament and of the Council Regulations originating from the EU, No. 679, CHAPTER I
13 iapp.org, “Brazilian General Data Protection Law”, Article 5 (1).
14 Lei no 13.709, op. cit, Submitted to Shrewsbury Sixth Form College.
15 Further on the origins of “Datenschutz”, Smitis, S. (ed.), “Bundesdatenschutzgesetz, Nomos
Verlagsgesellschaft, Baden-Baden,” 6th edition, (2006): 62–63. other, often intersecting, principles have been incorporated, with particular emphasis on the concepts of "freedom," "liberty," and "autonomy. "16. The primary concern of individual is whether data protection is recognized as a fundamental right. Although there are several issues in this area, the concept of data protection focuses primarily on safeguarding individual information. There are two aspects to this: data privacy and data protection. Data privacy refers to when, how, and to what extent a consumer’s the personal data of a consumer can be shared and communicated to others. The personal information include name, address, ethnicity, phone number and marriage status, etc. With the increase in internet usage over the years, there is an urgent need for data privacy regulations.
Data protection, on the other hand, is the legal safeguarding of data against loss, damage or corruption. As we collect data at an incredible rate, there’s a real concern about keeping that information safe from unauthorized access. 17 The Universal Declaration of Human Rights, 1948, recognized and established the right to safeguard an individual’s privacy. No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks. This human right has also been articulated in the International Covenant of Civil and Political Right,
1976. Privacy is accepted as a right of a human being in many international and regional
agreements, for example, the Universal Declaration of Human Rights and the International Covenant on Civil and Political Rights. Today, it stands as one of the most burning human rights issues in the world. The Supreme Court case of State of UP v. Kaushaliya and others, in 1965, explored the question of whether sex workers should be compulsorily evicted from their residential and working places or that they have the right to freely move within the territory as part of the same fundamental right available to Indian citizens under Article 19(1d and c) of the Indian Constitution. The case asserted that women have an absolute right of privacy concerning their right to choice of occupation and residence.
Though not mentioned specifically in the Constitution, the right of privacy is regarded as a penumbral right - one that the Supreme Court has proclaimed as being basic to the fundamental right to life and liberty. 16 Westin, A. F. , “Privacy and Freedom,” Atheneum, New York (1970); Miller, A. , “The Assault on Privacy: Computers, Data Banks and Dossiers,” University of Michigan Press, Ann Arbor (1971). Indeed, as pointed out further below, “privacy” in this context has tended to be conceived essentially as a form of autonomy – i. e. , one’s ability to control the flow of information about oneself. 17 blog. ipleaders. in , “Data protection and data privacy laws in India” https://blog. ipleaders. in/dataprotectionlaws-in-india-2/. ”
The first seven-judge bench decision on the matter was Kharak Singh v. State of U. P. In 1964, the majority of the court determined that, although the Constitution does not refer to a "right to privacy" per se, it broadly construed the right to personal liberty and hence included a right to dignity. The judgment declared that the common law rights a man has in his domicile, as well as the disturbances which accompanies it, are violated when there is uninvited entry into a person's house. Even though the litigations in a number of Supreme Court as well as High Courts judgments heavily debated this, still, the judgment from the Supreme Court that was held 15 years after declared, R Raja Gopal vs State of Tamil Nadu, The case here involved the balancing right of privacy that a citizen, no less, or against the right of the press to comment and criticize public officials' acts and conduct.
In the biography, he commented on his contacts and relation with various high ranking police officers' disclosures, which would have been extremely sensational. 18
4. "Data Protection and Privacy as a Fundamental Right: The Legal Framework in
Brazil" Over the past few decades, Brazil has established a legal framework for data protection based in constitutional principles , supported by specific legislative measures. While various laws incorporate elements of privacy, this discussion focuses on the foundational aspects of Brazil's data protection framework, including its constitutional basis and related legal provisions.
1. "Data Protection and the Right to Privacy as Fundamental Rights under the
Constitution of the Federative Republic of Brazil, 1988". The Brazilian Constitution19 It explicitly acknowledges the protection of personal privacy, dignity, honour, and image as fundamental rights, while also ensuring the right to compensation for both material and moral damages. Wolfgang Scarlet stated “The term ‘fundamental rights’ applies to the rights of the human being recognised and affirmed in the constitutional law of a given State.”20 The Brazilian Constitution directly addresses issues regarding information by providing fundamental rights of freedom of expression21 18 In the autobiography he had commented on his contact and relation with various high ranking police official dislcloser which would have been extremely sensational.
19 Article 5 BRAZIL, (Website Oficial do Planalto, 1988) accessed 23 February 2014.
20 T he efficacy of fundamental rights is well described in
Sarlet, Ingo Wolfgang, A eficácia dos direitos fundamentais, 6a ed. Porto Alegre: Livraria do Advogado Editora, 2006, pág. 35/36.
21 Art. 5 , IX; art. 220, Federal Constitution.
and access to information and transparency. 22 In addition, it acknowledges the inviolability of private life and privacy23, telegraphic and data communications,24and establishes that the home is the holy and inviolable refuge of the individual. 25 Furthermore, it provides for the writ of habeas data,26 which gives citizens a way to access and correct data about themselves held by third parties. In Brazil, the Federal Constitution of 1988 outlines Fundamental Rights in its Preamble and in Title II, Article 5. What makes this constitution unique is that it places the chapter on Fundamental Rights at the beginning, unlike earlier constitutions that had this section at the end.
As Flávio Martins explains, there was a change in priority: “The paradigmatic change in the priority of the topic was not only formal but spiritual as far as the constituent subject is concerned, placing the human person at the centre of concerns, rather than the State organisation with its competences and structure”. 27The holders of Fundamental Rights are thus identified in Article 5, caput, of the 1988 Federal Constitution: “The law treats everyone equally, making no distinctions. The law guarantees that both Brazilian citizens and foreign residents in Brazil would have their human rights inalienably conferred-life, liberty, equality, security, and property”. 28 The Supreme Court upholds this principle by stating that all residents in the nation, including its overseas, share in the Fundamental Rights.
The STF contends that, under the context of the protection of the inviolability of the fundamental rights, save for constitutional exceptions, also extends to foreigners who do not reside or are not domiciled in Brazil. The universal nature of human rights does not square with the statutes that ignore them. The expression of residents in Brazil must be interpreted in the sense that the Federal Charter can only ensure the validity and enjoyment of fundamental rights within Brazilian territory. ”29 Fundamental rights are a set of guarantees that help ensure respect and dignity for everyone under state protection of the state. They support the values of life, freedom, equality, and dignity, thereby giving citizens a sense of security. In Brazil, these protections are extended to both residents and visitors . As society changes, the recognition of new
22 9 Art. 5 , XIV;Art. 220;Art. 5 , XXXIII;Art. 5 , XXXIV, Federal Constitution.
23 Art. 5 , X, Federal Constitution.
24 Art. 5 , XII, Federal Constitution.
25 Art. 5 , XII, Federal Constitution.
26 Art. 5 , LXXII, Federal Constitution.
27 Freely translated from
Junior, Flávio Martins Alves Nunes, Curso de Direito Constitucional, 4a ed. São Paulo: Saraiva Jur. Editora, 2020, pág. 610.
28 Constituição da República Federativa do Brasil, https://www.senado.leg.br/atividade/const/
con1988/con1988_15. 12. 2016/art_5_. asp [accessed: 8. 04. 2021]. 29 Again, our free translation from the insights on the Constitutional Law course presented in: Curso de Direito Constitucional... , op. cit. , pág. 610. rights is also important. To maintain and enhance individual dignity, it’s essential to create new rules to address today’s challenges. One clear example is the need for a Data Protection Law to safeguard the personal information of Brazilian citizens, and ensure that their privacy, image, and honour are respected. In Brazil, the focus on privacy primely revolves around protecting individual rights. In recent years, significant progress has been made in this area through actions by lawmakers and court rulings that address the challenges of data processing.
While Brazil still lacks a comprehensive data protection law, it has looked to other South American countries for inspiration to improve its privacy rights, which are outlined in the Constitution and various personal data laws. The importance of data protection has grown alongside constitutional privacy rights, leading to on about whether data protection should focus on transparency and control instead of just being a privacy concern. Recent court decisions have supported public authorities' efforts, along with new regulations introduced in 2011. “As a consequence, one can observe the coexistence of two kinds of legal tools that deal with the flow of information in the Brazilian legal system, that is, privacy tools and data protection tools’’, in the words of Paul de Hert and Serge Gutwirth.
30 This paper concentrates on the data protection framework in Brazil, from its foundations to new developments, examining perspectives for further evolution and challenges to be faced. Rather than conducting a static analysis,31 The primary focus of this discussion is to explore how the Brazilian data protection framework is evolving. 5. SAFEGUARDING INFORMATION THROUGH BRAZIL'S CONSUMER PROTECTION LEGISLATION OF 1990 Privacy rights and habeas data are enshrined in the Brazilian Constitution. The modern concept of data protection initially emerged in Brazil within the realm of consumer protection. Law
8.078 of 1990, known as the Consumer Protection Code, has established a comprehensive
framework to address concerns related to privacy and data protection. The evolution of data protection rights in Brazil mirrors trends observed internationally, where legal frameworks adapt to address emerging societal needs. In the Brazilian context, the Consumer Protection 30 According to them, privacy tools and data protection tools are complementary: while the former focuses more on opacity, the latter emphasizes control and transparency. See De Hert and Gutwirth (2006).
31 Highlighting the non static feature of privacy and data protection, Gutwirth et al. (2011), p. v.
Code assumed this responsibility, incorporating a series of principle-based regulations designed to tackle new challenges arising advancement in from information technology. 32 In Brazil, the legal system prioritizes the protection of consumers enactment of the Consumer Protection establishes a more equitable relationship between customers and businesses, ensuring that individuals have access to essential information and are granted appropriate rights when making purchases. 33 The text outlines the principles for private, procedural, and criminal law while establishing a mechanism to enforce consumer rights. It also coordinates the efforts of more than 600 public organizations across federal, state, and local levels focused on consumer protection, offering an alternative to court proceedings for dispute resolution.
Additionally, consumers retain the option of seeking redress through the judicial system, especially in small claims courts. 34In Brazilian law, consumer protection has a pivotal constitutional status. Article 170, V, of the federal constitution designates consumer protection as an economic order principle, while its transitional provisions' Article 48 state the Consumer Protection Code. Furthermore, within the fundamental rights chapter, the Constitution declares that "the State shall promote, as provided by law, consumer protection" (Article5, XXXII). This constitutional provision goes beyond a mere subjective right, impose a protective obligation on the state across its executive, legislative, and judicial branches. This multifaceted approach underscores within the importance of consumer protection in Brazil's legal framework. In its Art.
43of The Consumer Protection Code, specific rights and safeguards regarding personal information stored in databases, namely: (a) consumers shall have access to all the personal information stored on databases (right of access); (b) all stored data shall be objective, accurate and in a comprehensible language (principle of data quality); (c) consumers shall be notified, through written communication, before the storage of any negative personal information(principle of transparency); (d) the party responsible for the database shall immediately promote the rectification or cancellation of any inaccurate data that is being stored (right of rectification and implicitly justified cancellation35); and (e) the time limit for storage of negative personal data is 5 years (right to forget). This norm, which was inspired by the U. S.
32 Anilo Doneda, “Data Protection in Brazil
New Developments and Current Challenges” Reloading Data Protection (pp.3-20)
33 Marques et al. (2006, p. 33).
34 Anilo Doneda, “Data Protection in Brazil
New Developments and Current Challenges” Reloading Data Protection (pp.3-20)
35 Gambogi Carvalho (2003, p. 77–119)
Fair Credit Reporting Act,36 clearly has many similarities with the fair information principles of data protection.37 The Brazilian Consumer Protection Code has a wide definition of "consumer," which means it applies to many situations, not just the usual buyer-seller relationship. It ensures protection for anyone who may be affected by a product or service, extending beyond just those who make a purchase.
6. GENEARL DATA PROTECTION LAW (LGPD) IN BRAZIL
Brazil's General Data Protection Law38(LGPD) was introduced to address the critical need to protect people’s fundamental rights regarding personal that are data shared and stored online. This law establishes a comprehensive framework to ensure that these rights are respected. The LGPD is organized into 10 chapters with a total of 65 articles, although our study focuses on the most relevant ones. It was ratified on August 14, 2018, but not come into immediately right away; it wasn’t until July 2019, when a national data protection authority was set up, that the law officially took effect on September 18, 2020. This means that the LGPD is still relatively new in Brazil and marks a significant development in its legal landscape.
With the LGPD, Brazil officially joined the group of countries with specific data protection laws in 2020, aiming to protect the fundamental rights of both public and private of individuals and entities. “The first section of this law concerns the handling of personal data, whether in electronic media or otherwise, by private persons or organizations. Its purpose is to protect basic rights such as freedom and confidentiality, and to ensure the free development of individual identities. ”39 Similarly, Luiz Fernando do Vale de Almeida Guilherme, a Brazilian writer, observes that: “The purpose of the General Data Protection Law is to protect the rights of personality and keep alive the fundamental rights of man, since today with the advancement of technology, especially after the pan demic, this new paradigm should bring a new meaning to the freedom
36 See Herman Benjamin et al. (2005, p. 400).
37 Bennett systematizes the Fair Information Principles in six principles
openness, individual access and correction, collection limitation, use limitation, disclosure limitation and security. See Bennett (1992, p. 101).
38 Lei no 13.709, de 14 de agosto de 2018, https://www.in.gov.br/materia/-/asset_publisher/
Kujrw0TZC2Mb/content/id/36849373/do1-2018-08-15-lei-no-13-709-de-14-de-agostode-2018-36849337 [accessed: 8.04.2021]
39 Lei no 13.709, de 14 de agosto de 2018, https://www.in.gov.br/materia/-/asset_publisher/
Kujrw0TZC2Mb/content/id/36849373/do1-2018-08-15-lei-no-13-709-de-14-de-agosto de-2018-36849337 [accessed: 8. 04. 2021] to hire natural persons. 40”According to Patrícia Pack Pinheiro, the regulatory body adopted a specific approach: "The regulator devised this methodology as a more concrete way to address a regulation that, while concerning essential rights like privacy protection, needed to be implemented in a manner compatible with business operations and corporate frameworks. "41The handling of children's and adolescents' personal information must be conducted with their welfare as the primary concern, in accordance with this provision and applicable laws. Section 1 stipulates that the processing of personal data belonging to minors requires explicit authorization from either a parent or legal guardian.
42 Government entities must adhere to the personal data processing requirements set forth in Article 23 of the LGPD. By following these obligations, they can safeguard against the misuse of personal information and protect individuals' right to privacy. The law also addresses accountability for violations, as outlined in Articles 3143 and 3244. The LGPD also covers data transfers between Brazil and other countries or international organizations, with specific rules outlined in Article 33. This is designed to protect individuals’ data, and it's crucial for everyone involved to follow these regulations. Violations of these regulations can result in disciplinary actions against dataprocessing organizations. The Consequences may include formal reprimands or monetary penalties, with fines reaching up to 50 million reais (R$50,000,000. 00) per infraction.
7. INDIA'S CONSTITUTIONAL FRAMEWORK FOR SAFEGUARDING DATA
PRIVACY AND PROTECTION AS A FUNDAMENTAL RIGHT An overview of The Digital Personal Data Protection Bill, 2023 Any information that can identify or help identify a person. Both businesses and government agencies use this data to provide goods and services. By processing personal data, they can understand people's preferences, which helps them customize offerings, deliver targeted ads, and make better recommendations. Moreover, processing this information can assist in law
40 Manual de proteção de dados..., op. cit., pág. 26.
41 Comments on the LGPD in
Pinheiro, Patrícia Peck Pinheiro, Proteção de dados pessoais. Co mentários à LEI N. 13.709/2018 (LGPD), 2a ed. São Paulo: Saraiva Educação, 2020, pág. 33.
42 Lei no 13.709, op. cit.
43 Ibidem.
44 Ibidem.
enforcement. Unregulated data processing can potentially infringe upon individual privacy rights, which are now recognized as fundamental. 45 Currently, India doesn't have a specific law for data protection. Instead, personal data usage is governed by the Information Technology (IT) Act of 2000, which addresses various aspects of digital security and privacy. In 2017, the National Government established the Committee of Experts on Data Protection to discuss data protection issues in India. The committee, headed by Justice B. N. Srikrishna, finalized its investigation and submitted its report in July 2018. Subsequent to the committee's recommendations, the Personal Data Protection Bill was introduced in the Lok Sabha in December 2019. A Joint Parliamentary Committee was formed to analyse the bill, which presented its report in December 2021.
The legislation was withdrawn from parliamentary scrutiny in August the following year. In November 2022, a draft version of the bill was made available for public comment. 46 The Digital Personal Data Protection Bill,
2023 was presented to Parliament in August 2023.47
8. CONSTITUTIONAL SAFEGUARDS FOR INFORMATION PROTECTION AND PERSONAL PRIVACY IN INDIA DATA PROTECTION AND RIGHT TO PRIVACY 'Data protection' and 'right to privacy' are closely intertwined concepts. Effective safeguarding of data can only be accomplished by safeguarding against privacy breaches, thus ensuring the security and respect of individuals' personal information. Privacy laws, particularly those related to information, have been evolving constantly as technology advances48. In their groundbreaking 1890 publication “The Right to Privacy”, Warren and Brandeis expressed apprehension about the increasing encroachment of technology on individuals' personal lives, especially with the emergence of "instantaneous photographs" and the proliferation of newspapers.
They cautioned that these technological advancements could potentially infringe upon the privacy of both individuals and families. Furthermore, they anticipated that future technologies might make it more challenging to maintain the confidentiality of personal 45 Justice K. S. Puttaswamy (Retd) vs. Union of India, W. P. (Civil) No 494 of 2012, Supreme Court of India, August 24, 2017. 46 The Draft Digital Personal Data Protection Bill, 2022, Ministry of Electronics and Information Technology, November 18, 2022.
47 The Digital Personal Data Protection Bill, 2019, as introduced in Lok Sabha.
48 Graham Greenleaf and Sinta Dewi Rosadi, “Indonesia’s data protection Regulation 2012: A brief code with data breach notification,” Privacy Laws & Business International Report, Issue 122, (2013): 24-27. conversations, reflecting the notion that private whispers could eventually become public declarations heard by all. 49 Now they are developed in ‘data protection. The modern concept of privacy rights encompasses multiple aspect of data protection. These include an individual's ability to gain entry to data repositories, scrutinize the precision of stored information, ensure its currency and accuracy through updates and corrections, maintain the confidentiality of sensitive details, and regulate the dissemination of personal data. Collectively, these interconnected rights constitute the contemporary understanding of privacy in the digital age.
50 Data protection and privacy are closely connected rights. In the early 1950s, efforts to recognize the right to privacy began, mainly addressing concerns about police surveillance and unwarranted invasions of people's homes. These early discussions laid the groundwork for understanding privacy as a fundamental right that should be protected from unnecessary intrusion. Back then, authorities had the power to conduct these searches at any time, day or night, to see if individuals might be involved in illegal activities. In the case M. P Sharma v. Satish Chandra51, The Supreme Court ruled that “the argument claiming search and seizure infringed upon Article 19(1)(f) of the Constitution was invalid.
The Court reasoned that a simple search did not interfere with property rights, and while seizure might impact these rights, it was only a temporary measure and constituted a reasonable limitation on the right to privacy”. Within India's constitutional framework, the recognition of privacy rights has evolved, particularly in relation to Articles 19(1)(a) and 21. Furthermore, in the case of Kharak Singh v. State, Justice Subba Rao examined the concept of liberty as being protected under Article 21 of the Constitution. 52 In a significant ruling, the Supreme Court of India expanded privacy law by declaring that “police home inspections and the sharing of personal information were intrusions on privacy”. This decision addressed concerns that align closely with modern data protection issues. In case of R Rajagopal v.
State of Tamil Nadu53, the plaintiff, who served as the editor, printer, and publisher of a Tamil weekly magazine headquartered in Madras, petitioned the court. There was a legal order that came in to restrain the Tamil Nadu government from interfering with the published text of Auto Shankar's life story, whose biography was sourced from public records, since he is an condemned prisoner.
49 Supra Note 3.
50 I. N. Walden and R. N. Savage, “Data Protection and Privacy Laws
Should Organizations Be Protected? ”The International and Comparative Law Quarterly, Vol. 37, No. 2 (1988): 337-347.
51 AIR 1954 SCR 1077
52 AIR 1963 SC 1295.
53 (1994) 6 SCC 632
In this case54 Jeevan Reddy, The court restated that privacy is inherent to Article 21, which applies fundamental rights to life and liberty. The court also reiterated that every individual should have the 'right to be left alone' to protect their personal privacy. Being a basic human right, privacy is recognized in several international instruments like the 1948 Universal Declaration of Human Rights;55International Convention on the Protection of the Rights of All Migrant Workers and Members of Their Families56 UN Convention on the Protection of Child; 5758and International Covenant on Civil and Political Rights. 58 In India, the right to privacy is not recognized as a distinct legal entitlement, unlike in international legal instruments. Instead, it is incorporated into Article 2159 of the Indian Constitution and has evolved through a series of Supreme Court rulings.
This development began with the landmark case of R. Rajagopal v. State of Tamil Nadu60, commonly referred to as the "Auto Shankar's Case. " The Auto Shankar case involved a convicted serial killer who wrote an autobiography detailing his associations with various government officials, including some who allegedly participated in his crimes. The editor of "Nakkheeran," a Tamil magazine, sought legal action to prevent government interference with their right to publish autobiography. The Supreme Court's decision established that government officials could not claim privacy rights regarding their official duties, even if the published material contained false statements. The Court state that the government and its representatives were not permitted to censor potentially defamatory content before publication.
Instead, officials may only take legal action only after the material has been published and proven false.
9. LEGAL SAFEGUARDS IN THE INFORMATION TECHNOLOGY ACT 2000
PRIVACY PROTECTION LEGISLATION Development of the Right to Privacy legislation is ongoing. This concept was first proposed in 2011, with the most recent iteration being the 2014 Right to Privacy Bill. This legislation
54 (1994) 6 SCC 632
55 Article 12
“No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.”
56 Article 14
57 Article 16.1
58 Article 17.1
“No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation.”
59 Article 21
“No person shall be deprived of his life or personal liberty except according to the procedure established by law.
60 (1994) 6 SCC 632
acknowledges the Right to Privacy as an essential element of Article 21 of India’s Constitution. Its primary objective is to shield individuals from the misuse of personal information by governmental organizations and private companies. The bill states that an individual's privacy rights can only be limited under certain circumstances, such as protecting India's sovereignty and integrity, maintaining national security, preventing criminal activity, and preserving public order. Any unauthorized gathering, handling, storage, or distribution of personal data considered a violation of privacy. The bill also includes punitive measures for those who breached its provisions. 61 (a) INFORMATION TECHNOLOGY ACT, 2000 The Act aims to defend against cybercrime and protect computer data systems from unauthorized access.
The Information Technology (IT) Act of 2000 was enacted to create a legal framework for digital governance and address cyber offenses in India. The objective is to ensure safe digital transactions, curb cyber offenses, and uphold data security. The Act legal validity to electronic documents and digital authentication, facilitating secure online activities, and incorporates measures to deter unauthorized access, data intrusions, and cyber deception. The new section has been amended in this act section 43Aand Section 72A . Section 43A and Section 72A was amended in 2008 under Information Technology (Amendment Act), 2008. The Information Technology Act, 2000, stipulates in Section 43A that companies must offer reimbursement if they fail to protect data adequately.
62 Any corporate entity that owns, manages, or operates a digital system storing confidential personal information must employ adequate safeguards to protect that data. If such an entity is negligent in maintaining these security practices, resulting in unauthorized gain or loss for any individual, the corporation must pay damages as compensation to the affected party. 63
61 GK today, current affair& general studies , “Right to Privacy Bill 2014
Current Status” https://www.bing.com/ck/a?!&&p=6d0dfd4ae5cc3b8edf41458042474cd8d39587000a8e57e037ba58843c7ad5c 9JmltdHM9MTczMDUwNTYwMA&ptn=3&ver=2&hsh=4&fclid=3cec8888-c74a-63dc-101f- 9c78c63562f0&psq=the+privacy+bill+2014&u=a1aHR0cHM6Ly93d3cuZ2t0b2RheS5pbi9yaWdodC10by1wc ml2YWN5LWJpbGwtMjAxNC8&ntb=1
62 Indiankanoon, “Section 43A in The Information Technology Act, 2000”
https://indiankanoon.org/doc/76191164/
63 ibid
Clarification. -In the context of this section,- (i)"body corporate" refers to any company and encompasses firms, sole proprietorships, or other groups of individuals involved in commercial or professional endeavors;64 (ii)"reasonable security practices and procedures" denotes measures designed to safeguard information from unauthorized access, harm, usage, alteration, disclosure or compromise, as outlined in an agreement between parties or as specified by current laws. In the absence of such agreements or laws, these practices and procedures may be prescribed by the Central Government in collaboration with relevant professional organizations or associations;65 (iii) " Sensitive personal data or information" refers to private details that may be determined by the Central Government in collaboration with relevant professional organizations or associations.
66 The Information Technology Act, 2000 includes Section 72A, which outlines penalties for revealing information that violates a legal agreement. The Information Technology Act, 2000 includes Section 72A, which outlines penalties for revealing information that violates a legal agreement. 67 Unless otherwise stated in this Act or any other applicable law, any individual, including an intermediary, who obtains authorized access to materials containing another person's personal information while providing services under a valid contract, and intentionally or knowingly discloses such materials to others without the concerned person's consent or in violation of a lawful agreement, potentially causing wrongful loss or gain, shall face penalties. These penalties could involve incarceration for up to three years, a fine of up to five lakh rupees, or both.
68 The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules were enacted by the Central Government in 2011. 69 Under Section 43A of the Act, the "SPDI Rules" were designed that brought out and defined the term 'Sensitive Personal Data or Information' (SPDI). According to these regulations, SPDI
64 ibid
65 ibid
66 ibid
67 IT Law , “Section 72 A
Punishment for Disclosure of information in breach of lawful contract” Section 72 A: Punishment for Disclosure of information in breach of lawful contract - Info. Technology Law 68 Ibid
68 ibid
69 Iblog pleader, “Is Section 43A out of the scope of t Act, 2000 – iPleaders”
encompasses personal details about an individual related to: - Passwords - Financial data (including bank account information, credit/debit card details, or information about other payment methods) - Physical, psychological, and mental health status - Sexual preferences - Medical history and records - Biometric data. Section 3 of the SPDI Rules also includes information on whether data is furnished to a corporate body for processing or storage in connection with any such service, or under any legal arrangement. Except: information shall not be considered as sensitive personal data or information if it is readily available or accessible to the public. It has been furnished pursuant to the Right to Information Act, 2005 or otherwise available under any other law in force.
70 (b) Indian Penal code 1860 and Data Protection No specific law address that data privacy under the Indian Penal Code 1860. However, only a few sections exist;
1. Section 403. Any individual who unlawfully takes or uses someone else's movable
property for personal gain shall face legal consequences. The punishment for such an offense may include imprisonment for up to two years, a monetary penalty, or both. This applies to cases of fraudulent misappropriation or unauthorized conversion of movable assets.71
2. Section 409. Any individual who, in their role as a public servant, banker, merchant,
factor, broker, attorney, or agent, is entrusted with property or has control over it, and commits criminal breach of trust regarding that property, will face severe penalties. The punishment for such an offense includes either life imprisonment or a prison term of up to ten years, along with a potential fine. This applies to those who misuse their position of trust in handling property within their professional capacity.72
3. Section 378. Theft—An individual commits larceny when they intentionally and
dishonestly remove movable property from another person's possession without their approval. Clarification 1. Objects attached to the ground are not considered movable 70 https://www.argus-p.com/papers-publications/thought-paper/a-review-of-the-information-technologyreasonable-security-practices-and-procedures-and-sensitive-personal-data-or-information-rules-2011/
71 Indiancode , “THE INDIAN PENAL CODE,1860” ipc_act.pdf
72 ibid
property and thus cannot be stolen; however, once detached from the earth, they become potential targets of larceny. Clarification 2. The act of detachment can simultaneously constitute the act of theft. Clarification 3. Causing an object to move includes eliminating barriers to its movement, separating it from other items, or physically relocating it. Clarification 4. Inducing an animal to move is considered moving that animal, as well as any objects consequently displaced by the animal's movement. Clarification 5. The consent referenced in the definition may be explicit or implicit, and can be granted by either the possessor or an individual with appropriate authorization, whether express or implied. 73 10. A Comparative Analysis of Legal Frameworks in Brazil and India From the European Model, Brazil bases its recognition of data protection and privacy as a fundamental right.
The country's General Data Protection Law (LGPD), that was enacted in 2018, gives preference to the individual's control over their personal information and tries to build consumer confidence. In contrast, India introduced its Personal Data Protection Bill in 2019, which similarly aims to regulate how government and private entities collect and process individuals' data within the country. Both legislative frameworks incorporate specific safeguards for children, including age verification and parental consent requirements. Brazilian and Indian approaches highlight a growing dedication to data privacy, with Brazil taking the lead in implementation. Both nations have established laws that protect the right to privacy and data , offering crucial safeguards. These measures not only support individual privacy but also contribute to national security.
Despite significant progress, Brazil and India continue to face considerable obstacles in addressing data protection risks in an increasingly digital world. Key challenges persist in this area. • Effective Law Enforcement: While laws exist, ensuring their enforcement is challenging, especially as societal needs evolve. • Adapting to Technological Change: Legislative frameworks must continually adapt to keep pace with the rapidly changing digital landscape. • Addressing Legislative Gaps: Critical gaps remain within the current laws that require
73 ibid
governmental attention and action. Strong oversight system and active public involvement are crucial for Brazil and India to protect data rights effectively. This will help to build trust and security in the digital age. Conclusion In today’s digital age, where millions of people use the internet and vast amounts of data are exchanged, it’s essential to strengthen the existing laws to protect individuals' privacy and fundamental rights. Countries must prioritize enacting and implementing data protection laws to ensure the safety and dignity their citizens. No rights are compromised in this interconnected world. Furthermore, International agreements, such as the Universal Declaration of Human Rights and the International Covenant on Civil and Political Rights, uphold the right to privacy. It is essential for countries to uphold these obligations and safeguard their citizens’’ rights.