white_paper_on_data_protection_in_india_171127_final_v2

PART II
SCOPE AND EXEMPTIONS
CHAPTER 1: TERRITORIAL AND PERSONAL SCOPE
1.1. Introduction
The borderless nature of the Internet raises several jurisdictional issues in data protection. A
single act of processing of personal data could very easily occur across multiple jurisdictions.
Traditional principles of sovereignty and territorial jurisdiction have evolved in circumstances
where such cross-border actions were uncommon. As such, it is not easy to determine the
kind of application clause which a data protection legislation must have.
The power of a State to prescribe and enforce its laws is governed by the rules of jurisdiction
in international law. Broadly, the territory of a State is where its jurisdiction ends and States
are prohibited from exercising jurisdiction in the territory of another State, unless so
permitted under a treaty or customary law. 176 Thus, for instance, a State in whose territory a
crime occurs has jurisdiction to deal with the crime. While the principle of territoriality
ordinarily connotes jurisdiction of a State over an act committed within its territory, under the
principle of objective territoriality, jurisdiction can be exercised over acts which take place
outside the State but have consequences within the State. A common illustration is that of a
gun being fired in one country causing a death in across the border in another State. 177
In addition to these general rules, there are certain circumstances in which extraterritorial
action may be permissible under other rules. Under the nationality principle, a State may
claim jurisdiction over actions of its nationals even on foreign territory. 178 Conversely, under
the passive personality principle, a State may exercise jurisdiction over actions which affect
its nationals, no matter where the act has occurred. The application of this principle is
contested. 179
1.2. Issues
The frequency of cross border actions on the Internet might require some thinking outside the
framework of these principles. 180 A legislation which adheres to any strict notion of
territoriality will fail to adequately protect Indian residents and citizens as a large number of
actions which the State may have a legitimate interest in regulating will fall outside the scope
176
―S.S. Lotus‖ (France v. Turkey), 1927 PCIJ (SER.a) No. 10., available at: http://www.icjcij.org/files/permanent-court-of-international-justice/serie_A/A_10/30_Lotus_Arret.pdf,
(last accessed 1
November 2017).
Crawford, Brownlie‘s Principles of International Law‘, 456 (Oxford, 8th Ed, 2008).
Crawford, Brownlie‘s Principles of International Law, 457 (Oxford, 8th Ed, 2008).
Crawford, Brownlie‘s Principles of International Law, 458 (Oxford, 8th Ed, 2008),.
180 Dan Jerker B. Svantesson, ‗Extraterritoriality in the context of Data Privacy Regulation‘, 7(1) Masaryk
University Journal of Law and Technology 87 (2012); Christopher Kuner, ‗Extraterritoriality and Regulation of
International Data Transfers in EU Data Protection Law‘, University of Cambridge Faculty of Law Research
Paper No. 49/2015 (30 August 2015).
24