white_paper_on_data_protection_in_india_171127_final_v2

ambit of the term organisation. 191 This may well be construed to be an indirect claim of
jurisdiction over foreign entities as well.
South Africa
The Protection of Personal Information Act, 2013 (POPI Act) of South Africa applies to
processing of personal information by parties domiciled in South Africa or where parties not
domiciled in South Africa, use automated or non-automated means within the territory of
South Africa. 192
Canada
The experience of Canada in applying the PIPEDA is also instructive. Section 4 of the
PIPEDA is silent on extraterritorial jurisdiction. Canadian courts have interpreted this silence
to mean that there is no bar on applying the PIPEDA to foreign entities in all circumstances
where there is a real and substantial link to Canada. 193
From these practices it is clear that in area of data protection, claims of jurisdiction under the
exceptions to the territoriality norm, such as passive personality are commonly found in
statutes. Vulnerability to harm arising from action which may not be strictly within territorial
jurisdiction is perhaps the reason why most jurisdictions have clauses which permit such
extraterritorial jurisdiction or jurisdiction over foreign entities as the case may be.
1.4. Enforceability of provisions of laws
Prescribing provisions that depart from ordinary principles of territoriality may not by
themselves be sufficient to ensure that the interests of a State in protecting the personal data
of its residents are secured. In several cases, foreign entities have expressed reluctance to
comply with orders of courts or directions of governments to comply with local laws. A
common plea in such cases is that it is only the local arm (of a multinational corporation) that
is answerable to the concerned jurisdiction. The primary method of enforcing jurisdictional
claims against foreign entities remains the cumbersome processes of letters rogatory or
through Mutual Legal Assistance Treaties. 194 There are suggestions that restricting access to
markets may be a method of dealing with such issues. 195 For instance, a Brazilian Court in
2013 ordered that all Facebook IP domains be blocked for failure to remove offending
content on the ground that it was the responsibility of entities incorporated in other
jurisdictions. 196 A more acceptable approach may perhaps be to adopt penalties of the nature
191 Section 2, Singapore Act.
192 Section 3, POPI Act.
193
A.T. v. Globe24h.com 2017, FC 114 (CanLII), available at:
https://www.canlii.org/en/ca/fct/doc/2017/2017fc114/2017fc114.html, (last accessed 2 November 2017).
194 Andrew Keane Woods, ‗Against Data Exceptionalism‘, 68(4) Stanford Law Review 729, 748 (April 2016).
195 Dan Jerker B. Svantesson, ‗Extraterritoriality in the context of Data Privacy Regulation‘, 7(1) Masaryk
University Journal of Law and Technology 87,138 (2012).
196 Dan Jerker B. Svantesson, ‗Extraterritoriality in the context of Data Privacy Regulation‘, 7(1) Masaryk
University Journal of Law and Technology 87,138 (2012).
27