The Analysis Of The Digital Rights And Privacy Law With Special Reference To Europe, USA And India
Author: LawSphereX
Category: Constitutional & Human Rights
Published:
Updated:
THE ANALYSIS OF THE DIGITAL RIGHTS AND PRIVACY
LAW WITH SPECIAL REFERENCE TO EUROPE, USA AND
INDIA
Adesh Kumar, University of Lucknow
ABSTRACT
In 21st , there is a rapid race of digital innovation that presents significant challenges to the existing laws, necessitating a delicate between technological advancement and the protection of individual rights. This paper examines the digital rights and privacy of individuals in a technologically advanced world, aiming to establish a balance between digital rights and individual privacy. Through a historical overview, the paper traces the development of privacy laws from their inception to the current global regulatory framework including some major legislation such as the General Data Protection Regulation (GDPR), Communication Decency Act (CDA), the Children Online Privacy Protection Act (COPPA), the California Consumer Privacy Act (CCPA).
It delves into the challenges posed by emerging technologies such as artificial intelligence, the internet of things, the big data, and examines case studies that illustrate these challenges, the analysis reveals a dynamic interplay between digital rights and privacy of individuals, while in the lack of strict regulatory authority on digital rights may impede individual rights of privacy and if we emphasis more on individual rights of privacy then it affects the digital rights. In India, the development of digital rights is intricately linked to the prevalence of the internet, the use of mobile phones, and government programs such as Digital India, which seek to transform the country into a digitally empowered society.
Although these measures have stimulated economic expansion and enhanced the availability of services, they have also sparked apprehension over safeguarding individual privacy and the principle of ethical personal data usage. This paper has analyzed significant events such as the Supreme Court’s pivotal ruling in Justice K. S. Puttaswamy vs Union of India SC 20171, which held that privacy is an inherent entitlement under our constitution. Furthermore, I have analyzed the consequences of the Aadhar biometric identification system and the continuing discussion surrounding the Personal Data Protection Act. Therefore, both are interlinked, and
1 AIR SCC 2017
statutory law deals with individuals' digital and privacy rights developed simultaneously. Keywords: Privacy Law, Individual Rights, GDPR, CCPA, Data Protection Act.
1. INTRODUCTION
At present, the culture, economy, and population are interconnected around the world. Globalization, which served as the spark has resulted in significant economic growth, technological advancement, and social revolution in India. Millions of Indians' lives have changed dramatically due to emergence of mobile technology and the internet, which have transformed communication, business, and information access. In contrast, the fast digitalization of Indian society has brought to the forefront important issues involving the digital rights and privacy of individuals. There has been a concern raised regarding data security, unauthorized surveillance, and possible misuse of personal information due to the massive generation and collection of personal data by private and public institutions.
It is a complicated story that illustrates India’s efforts to balance the advantages of globalization and technical advancement and the safeguarding of individual liberties. The voyage of digital rights and privacy in India is a complex one. This analysis investigates the development of digital rights and privacy of individuals in world as well as in India. It does so by analyzing the expansion of internet and mobile usage, the influence of government efforts, and legislative landmarks that have contributed to the formation of the current landscape. It dives into issues of controversies that surround significant development such as the decision made by the Supreme Court in the case of Justice K. S. Puttaswamy vs Union of India,2 the consequence of the Aadhar biometric identification system, and the Digital Personal Data Protection Act.
In addition, it examines how globalization affects India’s attitude to digital privacy, particularly in connection to global standards such as the GDPR of the European Union, as well as the difficulties associated with aligning international norms with India’s socioeconomic reality. At the end of the day, it emphasizes the need for privacy as a fundamental right and asks for comprehensive data protection legislation that emphasizes human autonomy.
2 Ibid 3
2. History of Privacy Laws
The history of privacy laws can be traced back to the late 19th and early 20th centuries, with seminal works like Samuel Warren and Louis Brandeis' 1890 Harvard Law Review article, "The Right to Privacy," which argued for the legal recognition of privacy as a right. However, it was not until the latter half of the 20th century that privacy laws began to take shape formally, responding to the rise of computer technology and the increasing capacity for data processing and storage. The U. S. Privacy Act of 1974 marked one of the first attempts by government agencies to regulate personal data collection, use, and dissemination, setting a precedent for future privacy legislation. later on, U. S.
passed the Communication Decency Act 1996 here in after called (CDA), the Children Online Privacy Protection Act 1998, California Consumer Privacy Act 2018 here in after called (CCPA) legislation which set the milestones in the field of digital privacy law. Internationally, the adoption of the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data in 1980 established key principles for privacy protection, influencing subsequent laws around the world. The European Union has been at the forefront of privacy legislation, culminating in the GDPR in 2018, which set a new global standard for data protection and privacy.
In India, the Information Technology Act 2000 and the Digital Personal Data Protection Act 2023 here in after called (DPDPA) have been passed by the Indian parliament either side gives digital rights to an individual whereas on the other side, it protects the individual's privacy.
3. Impact of Digital Technology on Privacy and Data Collection
The evolution of digital technology has been a double-edged sword for privacy. On the one hand, advancements such as the internet, mobile computing, AI, and IoT have transformed everyday life, offering new convenience and opportunities for social attraction, commerce, and access to information. In contrast, these technologies have also introduced complex challenges for privacy protection. They have enabled the collection and analysis of vast quantities of personal data, often without an individual’s knowledge or consent. Social media, location monitoring, and targeted advertising have all made it harder to distinguish between the public and private spheres, leading to concerns about privacy, surveillance, and personal data. To account for these new realities, privacy regulation must be reassessed in the digital age.
With the fast advancement of technology, the interaction between innovation and privacy remains an important and dynamic research subject.
4. Present State of Privacy Law
The privacy laws of different jurisdictions are different and complicated. They differ due to cultural differences, legal customs, and the government’s interest in protecting individual interests and personal data. The CCPA of the USA and the GDPR of the EU are considered the Magna Carta of privacy and data protection laws. Both laws act as models for other states.
5. United States’s Approach
The United States adopts a sector-wise approach to privacy, with a mixture of federal and state laws governing various aspects of data protection. The absence of a unified federal privacy law results in a complex regulatory environment. The U. S. passed CDA 1996, intending to prohibit the use of any telecommunication devices by a person not disclosing their identity to threaten, harass, abuse, or annoy any person who receives such communication. The Children Online Privacy Protection Act here in after called (COPPA) protects the privacy of children under 13 years old from online collection of their personal information. It applies to websites and online services directed at children or knowingly collecting personal information from children. Websites require parental consent if they collect children's personal information.
it also requires that websites notify parents of their information practices and provide them access to their children’s personal information. Under this act, parents have the Right to Revoke their consent and delete their children's information.
5.1. The California Consumer Privacy Rights Act (CCPA) gives consumers the following
rights;
5.1.1. Right to Know- Consumers have the right to know about the personal information a
business collects about them and how it is used and shared.3 It gives the right to residents of California to know what personal information they collected about them, whether it is shared to a third party or not, the purpose for what they have collected, and the source of data.
5.1.2. Right to Delete—Individuals have the right to delete their data collected by businesses,
websites, or online platforms.4 The right to delete means the individual can request the
3 California Consumer Privacy Act, 2018, Sec. 1798.100
4 Id. Sec. 1798.105
company, governments or organisation to delete the data collected by them. This right comes under the purview of the right to privacy.
5.1.3. Right to Opt-out – Consumer right to their sale or share their personal information.5
It is the right of the individual not to participate in certain activities or programs, and a system uses their personal information. Many app and service providers store customer data like search history, location, and purchasing activity. Under the Act, the customers have the right to opt out of their personal Information.
5.1.4. Right to Non-Discrimination.6 The Act gives the right that no one will be
discriminated against for exercising their right available under CCPA. The right to nondiscrimination is a fundamental right enshrined in the Universal Declaration of Human Rights hereinafter called UDHR. A person can not be discriminated against based on caste, race, nationality, religion, or place of birth. A right available under CCPA is somehow similar to a right available under UDHR.
6. THE PRIVACY LAW IN EUROPE AND GENERAL DATA PROTECTION
REGULATION
The first step taken towards the right to privacy and data protection law was a law enacted by Sweden in 1973 and Germany in 1977. Later on, the Council of Europe’s Convention 1981 was the first international initiative towards privacy law. The Charter of Fundamental Rights of the European Union, adopted in 2000 and made legally binding in 2009, is a comprehensive document that protects the fundamental rights and freedoms of individuals within the EU. It enshrines a wide range of civil, political, economic, and social rights, including human dignity, freedom of expression, equality, data protection, and the right to a fair trial. The Charter applies to EU institutions and member states when implementing EU law, ensuring that these rights are respected and upheld across all areas of European governance.
It serves as a cornerstone of EU values, reinforcing the commitment to democracy, the rule of law, and the protection of individual freedoms in a modern, interconnected society.
5 Id. Sec. 1798.120
6 Id Sec. 1798.125
With the implementation of the GDPR on May 25, 2018, privacy legislation achieved a significant milestone by establishing an international standard for data protection. Its wide application covers both organizations inside the EU and those outside the EU that handle the data of EU citizens. consent, openness, data, minimization, the right to data portability, the right to erasure often known as the (“right to be forgotten’’), and access are just a few of the values that GDPR highlights. It also emphasizes the significance of accountability and governance in data handling by requiring the reporting of personal data breaches within 72 hours. Global privacy standards have been greatly impacted by the GDPR, which has forced companies in all over the world to implement stricter data protection policies.
6.1. Extraterritorial effect:7 The GDPR has an extraterritorial effect. in general, the
GDPR applies to (1) individuals that are EU residents, (2) organizations that are based in the EU, (3) organizations based outside the EU, that target EU citizens. For example if any Asian company or their subcontractor targets EU citizens they have to adhere to the guidelines of GDPR.
6.2. Right to access by data subject:8 A natural person has the right to access their data
whether it has been processed or not, if it is processed then they have a right to know, the purpose of processing, the categories of personal data concerned, the recipient to whom the personal data have been disclosed, the time period for which the data has been stored, if personal data is not stored than any other information related to their source.
6.3. Conditions for consent: 9 Under the GDPR, there is a provision of consent for utilizing
the data of data subjects. If the data subject gave consent for a particular matter then only to that matter data can be utilized. there has to be a clear declaration regarding data utilization, if the declaration is not clear or there is any infringement, then the regulation shall not be binding.
6.4. Right To Erasure: This right is also known as the right to be forgotten. The data
subjects shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation
7 General Data Protection Regulation Art. 3
8 id Art.15
9 Id Art. 07
to erase personal data without undue delay.10 The data subjects can ask the controller to erase personal data, data for which data subjects withdraw consent, data that has been unlawfully processed, or data that no longer is necessary for personal data for which it was processed.
7. Privacy Law in Other Jurisdictions
In Asia Pacific, some countries like Australia, South Korea, and Japan adopted strong privacy frameworks. Two prominent examples are the Personal Information Protection Act (PIPA) of South Korea and the Act on the Protection of Personal Information (APPI) of Japan. These rules focus on a person's permission, rights, and the transfer of data from one state’s jurisdiction to another state. Latin America: Both Brazil and Argentina have passed comprehensive privacy laws. The privacy law of Brazil known as LGPD came into effect in September 2020. It is similar to Europe’s General Data Protection Regulation. Cooperation among the nations is essential for the regulation of privacy law and data transfer and to ensure the privacy of individual data. The EU and US privacy shield framework facilitated the flow of data over the Atlantic although this was declared invalid by the court in 2020.
One another example of cross border flow of data is APEC’s cross-border privacy rule framework, which protects personal data while facilitating the data movement among the Asia-Pacific country.
8. The development of digital rights and privacy rights in India.
The evolution of digital rights and privacy in India is closely associated with the nation's technical progress and governmental endeavours to promote digital inclusion. The early 1990s economic liberalization of India, which encouraged foreign investment and technological advancement, laid the groundwork for the digital revolution. The Internet facility was first made available in 1995 by Videsh Sanchar Nigam Limited (VSNL).
8.1. Growth of the internet and digital India
The Indian government launched the "Digital India" initiative, recognising the transformative potential of digital technologies in 2015. With a focus on three main vision
10 Id Art.17
areas, this ambitious program aimed to transform India into a knowledge economy and society facilitated by digital means.
8.1.1 Digital Infrastructure as a Core Utility to Every Citizen: This encompassed
initiatives such as Bharat Net, aimed at linking all 250,000 Gramme Panchayats with high-speed broadband via optical fibre networks. More than 150,000 Gram Panchayat has been linked till 2021 and it reduces the urban-rural digital gap. This initiative ensured universal access to mobile connectivity, particularly in remote and backward areas.11
8.1.2 Governance and Services on Demand:
The unified digital platform helps in easy accessibility and transparency in government schemes and policies. The digitalization of land records, tax filing, and one window platform for business startups, etc helps in improving transparency and reducing corruption.
8.1.3 Digital Empowerment of Citizens:
The government has launched the Pradhan Mantri Gramin Digital Literacy (PMDISHA) program to provide digital education to Indian citizens. It helps over 6 crore people through training. These projects resulted in substantial enhancements in digital infrastructure and service accessibility. The emergence of digital payment platforms, especially the Unified Payments Interface (UPI), transformed the banking sector. The National Payments Corporation of India (NPCI) said that UPI transactions exceeded 2 billion per month in October 2020, indicating extensive acceptance. Digital payments have facilitated financial inclusion and diminished dependence on cash, which is especially important in a nation where a substantial segment of the population was formerly unbanked.12
11 Internet in India 2020." Internet and Mobile Association of India (IAMAI), Jan. 2021
12 "Bridging the Digital Divide: Skill Development and E-Inclusion in India." National Sample Survey Office (NSSO) Report, Government of India, 2018.
9. Challenges and privacy concerns
While rapid digitalization has brought numerous benefits, it has also exposed vulnerabilities in data security and privacy. The excessive collection and processing of personal data by government programs and private companies have raised concerns about it.
9.1. Data Breaches: Cyberattacks and data breaches have increased in frequency. For
instance, a security breach in 2018 resulted in the exposure of millions of Aadhaar user's personal information. In 2020, there was another incident wherein the personal information of more than 20 million Big Basket members was compromised and sold on the dark web. These breaches draw attention to gaps in data security protocols as well as the possibility of financial fraud and identity theft.
9.2. Unauthorised Surveillance: Concerns about privacy violations have been raised by
law enforcement and intelligence organizations using surveillance technologies without sufficient legal protections. These worries were heightened by reports that activists, journalists, and politicians were being watched by malware like Pegasus. WhatsApp sued NSO Group in 2019 because the Israeli company's spyware was being used to target users in India and other nations.
9.3. Absence of Regulatory Structures: Due to a lack of comprehensive data protection
legislation, people are now more vulnerable and have fewer legal choices when their privacy is violated. The extant legislation, such as the Information Technology Act of
2000 and its modifications, incorporates provisions about data security and cybercrime.
However, it is considered inadequate to address the complexities of data protection in the digital age. These challenges have posed an urgent need for the government to enact legislation to safeguard individuals' data, digital rights, and privacy.
10. The Digital Personal Data Protection Act:
In response to the Supreme Court directives and the need for comprehensive data protection legislation, the government introduced the personal data protection bill in December 2019, based on the recommendation of a committee led by Justice B N Srikrishna. Later on, it was passed by both houses of parliament received the assent of the president on 11 August
2023 and became an Act.
10.1. Key features of the DPDPA:
Applicability: The act applies to the processing of personal data by the government, companies incorporated in India, and foreign companies dealing with the personal data of individuals in India. This includes data collected online and offline, covering a wide range of entities. 13 • Consent framework: It emphasizes specific and clear consent for data processing, with provisions for withdrawal of consent. Data fiduciaries must provide notice regarding the process and nature of data processing. 14 • Individual rights: It grants individuals rights such as confirmation and access to their personal data, correction and erasure, data portability, and the right to be forgotten. These rights empower individuals to exercise control over their personal information. 15 • Data fiduciary: Entities processing data are termed data fiduciaries and are obligated to process data fairly and transparently.
Significant data fiduciaries, determined based on factors like the volume of data processed, must undertake additional compliance measures. 16 • Data localization: sensitive personal data must be stored in India but can be processed abroad under certain conditions. critical personal data as defined by the government must be stored and processed only in India. This aims to protect national interests and ensure data sovereignty. 17 • Data protection authority: this act establishes a regulatory authority to oversee data protection with the power to monitor investigate, and enforce compliance. the DPA will have the authority to issue direction, conduct audits, and levy penalties.
11. Criticism and challenges:
Government exemptions: The act allows the central governments to exempt any of its
13 The Digital Personal Data Protection Act 2023 sec. 3
14 id. sec.11
15 Id. sec. 12
16 Id. Sec 2(i)
17 Id. sec. 16
agencies from the provision of the act for reasons such as national security, public order, and sovereignty. Critics argue that the scope of the exemption could lead to unchecked surveillance and undermine privacy rights. • Surveillance concern: Civil society groups express concern that the Act does not adequately address state surveillance and may facilitate mass surveillance without sufficient oversight. • Lack of enforcement: even when regulation exists, enforcement can be lax. Regulatory agencies may lack the resources or authority to monitor and penalize organizations adequately. • Data collection practices: many digital platforms and services have come under fire for their extensive data collection practices. Critics argue that companies collect more data than necessary and use it for purposes that individuals do not consent to.
• User consent challenges: obtaining informed consent from users for data collection and processing can be challenging. critics contend that privacy policies are often lengthy complex and written in a way that makes it difficult for users to understand the implications of sharing their data. • Data profiling and discrimination: data-driven profiling and algorithms can lead to discrimination and bias, especially in areas like employment, housing, and financial services. critics say that data protection efforts should address these issues more comprehensively. • Data resale: personal data is often bought and sold in the data marketplace, which some view as an unethical concern. Critics say that individuals should have more control over how their data is used and who profits from it.
12. Judicial discourse/ JUDICIAL ROLE
In the case of Shreya Singhal vs Union of India 201518 The Supreme Court struck down section 66A of the IT Act, which criminalizes online offensive content. In this context The
18 SCC AIR 2015
Supreme Court in the case of Justice K. S. Puttaswamy vs Union of India (2017)19 was a critical point in India's digital privacy framework. The dispute emerged when retired justice Puttaswamy consented to the legitimacy of the Aadhar scheme, asserting that it infringed upon the right to privacy. On August 24, 2017, the Supreme Court’s nine-judge bench unanimously ruled that the right to privacy is a basic right to life and personal liberty, embracing many dimensions- • Personal autonomy: the ability to make personal choices regarding one’s body, belief, and association without undue inference. • Information privacy: control over the dissemination and use of personal data, recognizing that unauthorised use can infringe on dignity and autonomy. • Family and sexual privacy: protection of inmate personal relationships and choices, including marriage, procreation, and sexual orientation.
In the case of Anuradha Basin vs Union of India,20 It evaluated the restriction imposed on communication in Jammu and Kashmir following the abrogation of Article 370. It emphasized the need for proportionality and transparency in the restriction of free speech. The court held that access to the Internet is a fundamental right under Article 19(1)(a) and 19(1)(g) of the Indian constitution. The judgment established that any infringement of privacy must satisfy the legality, necessity, and proportionality test. The state must demonstrate that an encroachment on privacy serves a legitimate aim, is necessary in a democratic society, and is proportionate to the need. The ruling set a precedent for future cases and policies concerning privacy and data protection, compelling the government to address the legal vacuum in this area.
13. Digital Personal Data Protection Rules (DPDPR) 2025
The government of India drafted the Digital Personal Data Protection Rules 2025, which is an extension of DPDPA. These rules detailed the operational framework for compliance with
19 SCC AIR 2017
20 SCC AIR 2020
DPDPA including procedures for data processing storage transfer and enforcement mechanisms. Key provisions of the DPDPR. • Establishment of the Data Protection Board of India • Establish a mechanism for compliance with the timeline • Details explanation of rights of data principles. • Obligation for business (Data Fiduciary) • Principles of data processing
14. India’s Digital Personal Data Protection Act and GDPR
14.1 Similarities
data protection principle: both emphasise lawful processing, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality. • Individual rights: both grant rights to access, correct, and erase personal data, and the right to data portability. • Establishment of regulatory authorities: both propose independent bodies to oversee data protection and enforce compliance.
14.2 Difference
Right to be forgotten: GDPR provides a more direct mechanism for individuals to have their data erased, while the DPDPA require individuals to apply to the DPDPA, which may grant or deny the request based on considerations like free speech and the right to information. • Data localization: GDPR allows the free flow of data, provided adequate
protection is ensured without mandating data localization. The DPDPA requires certain categories of data to be stored in India, raising concerns about trade barriers and operational challenges. • Penalties: while both penalise for noncompliance, the DPDPA fines are generally lower and there are concerns about the enforcement capabilities of the DPDPA.
15. CONCLUSION & SUGGESTION
The analysis of privacy laws and digital rights in Europe, the USA, and India reveals a complex and evolving legal landscape shaped by technological advancements, judicial interventions, and legislative responses. While the European Union’s GDPR has set a global benchmark for data protection, emphasizing stringent consent requirements, individual rights, and extraterritorial applicability, the United States follows a sectoral approach, with laws like the CCPA (California Consumer Privacy Act) and COPPA (Children’s Online Privacy Protection Act) addressing specific privacy concerns. India’s journey in digital rights and privacy has been transformative, marked by judicial milestones such as Justice K. S. Puttaswamy v. Union of India (2017), which recognized privacy as a fundamental right, and the subsequent enactment of the Digital Personal Data Protection Act (DPDPA) 2023.
However, challenges persist, including concerns over government surveillance exemptions, weak enforcement mechanisms, and localization of data mandates that may conflict with global data flow norms. Key Takeaways:
1. Global Standards vs. Local Realities: While the GDPR offers a solid framework,
countries like India and the US need to strike a careful balance between protecting privacy rights and addressing national security and economic priorities.
2. Judicial Activism: In India, the courts have played a major role in shaping privacy laws,
often stepping in to uphold constitutional protections.
3. Technological Challenges: As digitalization speeds up, it brings both opportunities and
risks. Issues like data breaches, surveillance overreach, and algorithmic bias highlight
the urgent need for strong legal safeguards.
4. Looking Ahead: Moving forward, it’s crucial to improve enforcement, bring
transparency to government surveillance, and align domestic laws with global privacy standards to better protect digital rights. To build a privacy-focused digital world, countries must collaborate more on international data governance and empower oversight bodies like India’s Data Protection Board to hold organizations accountable. Raising public awareness about digital rights and informed consent is key, as is promoting ethical data practices within companies to prevent misuse. As technology evolves, privacy laws must evolve with it—ensuring individual autonomy is preserved while still allowing space for innovation. Privacy isn't just a legal issue; it's a fundamental part of any democratic society, tied closely to dignity, freedom, and trust in the digital age. A fair, rights-centered approach will be vital in addressing the challenges ahead.