white_paper_on_data_protection_in_india_171127_final_v2

1.2 Types of Enforcement Models
There have been concerns in the past regarding the strength and effectiveness of enforcement
mechanisms in the Indian context, especially when it comes to technology-related laws. 661
Appropriate consideration must thus be given to the enforcement model that is to be
employed. Generally, one may consider three different variations: 662
(i)
‗Command and control‘ regulation
This approach requires the State to provide legal rules or clear prescriptions for regulated
entities, with no room for discretion. If these prescriptions are not followed, the State
exercises its power to sanction. Where elements of a ‗command and control‘ system are
adopted, necessary features include the involvement of some governmental authority or the
other, whether this involvement is through the establishment of a single, specialized agency
or the creation of a federated, sectoral framework.
A number of issues are raised on this point, including whether the state machinery involved
should be unified, how independent it should be from governmental control and industry
influence, whether it should have regional spread, what regulatory tools and forms of sanction
it should have at its disposal etc. Most jurisdictions do not have data protection frameworks
that are purely ‗command and control‘ in nature and create some room for industry
involvement.
(ii)
Self-regulation
This approach involves private organisations complying with standards they set for
themselves without any enforcement by the State. 663 In a self-regulatory framework, norms
become established either through market forces (such as demand for privacy from
consumers), through industry standard-setting or through some limited facilitation of market
transactions in the form of choice-enhancing legal rules such as information disclosure norms.
Legal obligations that enhance the fairness of transactions such as notice and privacy policy
requirements may require governmental enforcement machinery and do not always fit
comfortably in the self-regulation rubric. The US is a good example of a jurisdiction with
largely self-regulatory elements, though a few sector-specific and state-specific laws are also
in place. As these rules are a threshold requirement for achieving regulatory effectiveness,
661 Deborah Roach Gaut and Barbara Crutchfield George, ‗Offshore Outsourcing to India by U.S. and E.U.
Companies Legal and Cross-Cultural Issues that Affect Data Privacy Regulation in Business Process
Outsourcing‘, 6 UC Davis Business Law Journal 13 (2006).
662 Dennis D. Hirsch, ‗The Law and Policy of Online Privacy: Regulation, Self-Regulation, or Co-Regulation?‘
34 Seattle University Law Review 439, 440-41 (2011).
663 Reuben Binns, ‗Data Protection Impact Assessments: A meta-regulatory approach,‘ 7(1) International Data
Privacy Law 22, 25-29 (2017); Cary Coglienese and Evan Mendelson, ‗Meta-regulation and Self-Regulation‘ in
Oxford Handbook of Regulation, 146, 147-148 (Robert Baldwin et al eds., 2010).
144