Promises and illusions of data protection in Indian law

Abstract

Discusses how the size and economic importance of India has caused its data protection and privacy rules to come under increasing scrutiny and how, in recent years, the Indian government has enacted disparate pieces of legislation dealing with data protection in areas such as information technology, credit information, and access to public sector information. Discusses how the privacy protection through the courts has also expanded. Shows that, despite this, India still lacks a comprehensive legal framework for data protection, and much of the legislation fails to protect the rights of individuals as much as it promises (or pretends) to do. Analyses the basic principles of data protection, which are often not sufficiently implemented into Indian legal provisions, or are so implemented only in relation to one sector. Analyses how some of the legal structures that have been constructed ostensibly to protect individual rights (such as credit information) may actually have the result of increasing the surveillance of individuals, and how some exist only on paper, without regulations or administrative measures to give them effect. Discusses how India also lacks a system of genuinely independent data protection regulators, or a wide enough range of remedies. Concludes that India has made progress in data protection in the last few years, but still lacks a satisfactory legal framework for data protection. Its legal structure is evolving, and the precise points at which it is still lacking need to be understood so that they can be remedied.