white_paper_on_data_protection_in_india_171127_final_v2

they form core, substantive elements of a data protection framework and are not,
appropriately, to be considered as part of the enforcement mechanism.
(iii) Co-regulation
This typically involves elements of both ‗command and control‘ regulation and selfregulation.
Co-regulation may be described as ―initiatives in which government and industry
share responsibility for drafting and enforcing regulatory standards.‖ 664 This model advocates
the formulation of a general data protection statute with broad provisions complemented by
―codes of practices or conduct‖ formulated by the industry and approved by the government
or the relevant data protection authority.
Once these codes are approved, compliance with the detailed requirements of the code is
treated as compliance with or evidence of compliance with the general provisions of the
statute, thus promoting legal certainty within an otherwise uncertain regulatory scheme
through the creation of ‗safe harbours‘. 665 The reason for the uncertainty that would otherwise
prevail is the inherent generality of a broad statute that is unable to capture the multitude of
situations that can arise in data processing. Such a co-regulatory approach would therefore
appear useful in promoting compliance while also making room for innovation within the
digital economy which may otherwise come to be severely restricted, especially for small
businesses and start-ups.
In the context of privacy law in India, it may be noted that a co-regulatory model was
suggested by the Justice AP Shah Committee. 666 A ‗command and control‘ regulatory
mechanism may be too rigid and may lag behind rapid technological changes which are
prevalent in today‘s day and age. On the other hand, a pure self-regulation approach may lack
enforcement and may lead to a situation where the objectives sought to be achieved by a data
protection law are, effectively, not met. 667 Co-regulation may seem like an appropriate middle
path that combines the flexibility of self-regulation with the rigour of government rulemaking.
668
664 Dennis D. Hirsch, ‗The Law and Policy of Online Privacy: Regulation, Self-Regulation, or Co-Regulation?‘
34 Seattle University Law Review 439, 441 (2011) (describing co-regulation as ―initiatives in which government
and industry share responsibility for drafting and enforcing regulatory standards‖); Hans-Bredow-Institut and
Institute of European Media Law, ‗Final Report: Study on Co-Regulation Measures in the Media Sector‘, 17
(June 2006).
665 Dennis D. Hirsch, ‗Going Dutch? Collaborative Dutch Privacy Regulation and the Lessons it Holds for U.S.
Privacy Law,‘ 2013 Michigan State Law Review 83, 86-87, 96 (2013); Ira S. Rubinstein, ‗Regulating Privacy by
Design,‘ 26 (3) Berkeley Technology Law Journal 1410, 1451-53 (2011).
666 Report of the Justice AP Shah Committee, 75 (October 16, 2012).
667 S. Pearson and A. Charlesworth, ‗Accountability as a Way Forward for Privacy Protection in the Cloud‘, in
5931 Cloud Computing, Lecture Notes in Computer Science 131, 133 (M.G. Jaatun et al eds., 2009).
668 However, the processes by which rule-making and enforcing powers are shared can raise concerns regarding
undue benefits to industry with public interest being sidelined; Neil Gunningham and Darren Sinclair, ‗Leaders
& Laggards: Next Generation Environmental Regulation‘, 105-06 (Greenleaf, 2002); regarding the scope for
abuse, see Bradyn Fairclough, ‗Privacy Piracy: The Shortcomings of the United States Data Privacy Regime and
How to Fix It,‘ 42 (2) The Journal of Corporation Law 461, 476-77 (2016).
145