white_paper_on_data_protection_in_india_171127_final_v2

PART IV
REGULATION AND ENFORCEMENT
CHAPTER 1: ENFORCEMENT MODELS
1.1 Introduction
As a result of the nature and complexity of the legal provisions commonly constituting a data
protection law, a broad range of questions arise regarding how these provisions can best be
enforced. So as to develop a sound legal and regulatory framework, we must consider certain
aspects of institutional design and overall approach before we can develop and align
individual elements of the framework. This may be in terms of the extent of burden placed on
entities covered under such framework, the structure and functions of any enforcement
agency, or the tools at its disposal.
The enforcement of data protection norms is complicated by two factors primarily: first, the
application of the norms across different fields, sectors, industries and contexts and, second,
the rapid pace of development and change in data processing technologies. 656 These factors
produce unique enforcement problems not found in other regulatory fields.
For instance, while many laws apply across different sectors, it has been observed that norms
regarding information can be very contextual. 657 It could be quite problematic for a data
protection law to run slip-shod over requirements in distinct walks of life that individuals
desire to differentiate. Similarly, privacy norms have always been catching up to changes in
technology that modify the playing field on which information is shared. The original
conception of the right to privacy by Warren & Brandeis was driven by technological changes
that permitted easier dissemination of information. 658 Similarly, the rise of computers and the
internet have posed profound challenges for informational privacy. 659
If anything, the rate of change of technology has only increased with time and appropriate
legal responses are called for with greater rapidity. To add to this, different technologies with
similar effects often come to be assessed according to various criteria including their
prevalence and acceptability in society. 660 These concerns may not be capable of being
addressed even where the substantive provisions of the law are technology-neutral. Instead,
they additionally raise issues regarding the capacity of a data protection authority, if such an
authority has been envisaged.
656 Report of the Justice AP Shah Committee, 75 (October 16, 2012).
657 Helen Nissenbaum, ‗Privacy as Contextual Integrity,‘ 79 Washington Law Review 119, 137-41 (2004).
658 Samuel Warren and Louis Brandeis, ‗The Right to Privacy,‘ 4(5) Harvard Law Review 193 (15 December
1890).
659 Jerry Kang, ‗Information Privacy in Cyberspace Transactions‘, 50 Stanford Law Review 1193, 1202-03
(April 1998).
660 For example, in determining whether there had been a ‗search‘ under the Fourth Amendment, the US
Supreme Court has differentiated aerial surveillance from thermal imaging of homes on the basis of how
common each practice was. See, Florida v. Riley, 488 U.S. 445, 447, 452 (1989) and Kyllo v. United States, 533
U.S. 27, 34, 40 (2001).
143