Cross-Border Transfers of Personal Data: A Comparative Analysis of the European Union’s and India’s Regulatory Approaches and a Proposed Framework for Cooperation
Abstract
Abstract: Regulating cross-border transfers of personal data requires balancing the protection of individual rights with the needs of international trade and cooperation between public authorities, including law enforcement agencies. Divergent regulatory requirements can complicate lawful transfers even when jurisdictions share similar data protection objectives. This article compares the European Union’s General Data Protection Regulation (GDPR) with India’s Personal Data Protection Bill of 2019 as a legislative proposal. The analysis focuses on the conditions for lawful processing, the rights of data subjects, data localization requirements, obligations in the event of a personal data breach, and audit requirements. It examines how differences in these areas can hinder cross-border transfers and identifies areas in which greater regulatory compatibility could facilitate them while preserving safeguards for personal data. Drawing on this comparison, the article explores options for an EU–India cooperation framework and provides a basis for policymakers and researchers to assess how closer regulatory coordination could support lawful transfers while accommodating differences between the two legal systems.
Downloads
References
[1]. C. Kuner, Regulation of Transborder Data Flows under Data Protection and Privacy Law: Past, Present and Future, Working Paper No 187 - OECD Digital Economy Papers, OECD, vol. 7 (2011)
2. Communication from the Commission to the European Parliament and the Council Exchanging and Protecting Personal Data in a Globalised World, COM/2017/07 final, p. 1.
3. Available at <https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_contribution
gdprevaluation_20200218.pdf>, p. 3 accessed on 10 January 2020
4. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance) OJ L 119, 4.5.2016, p. 1–88, Article 4 (1). Hereafter GDPR
5. GDPR, Article 9 (1).
6. GDPR, Article 9 (4).
7. Available at: <https://www.meity.gov.in/content/information-technology-act> accessed on
26 April 2020
8. Available at: <https://meity.gov.in/sites/upload_files/dit/files/GSR313E_10511(1).pdf>
accessed on 26 April 2020
9. Available at: <https://meity.gov.in/writereaddata/files/Personal_Data_ Protection_ Bill,2018.pdf> accessed on 26 April 2020.
10. Available at: <https://www.prsindia.org/billtrack/personal-data-protection-bill-2019> accessed on 27 April 2020.
11. GDPR, Article 9 (1).
12. A. Kaushik, Dissertation: Data Protection On Cyber Space- Issues and Concerns, Post Graduate Diploma in Cyber Law and Cyber Forensics (National Law School of India University, Bangalore, 2017), Reg. Number: CLCF/352/15).
13. GDPR, Article 44
14. GDPR, Article 45 (1).
15. Judgement of the Court (Grand Chamber) of 16 July 2020 in case C-311/18 Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems
16. Court of Justice of the European Union, Case C-362/14, Maximillian Schrems v. Data Protection Commissioner (“Schrems”), ECLI: EU: C:2015: 650, paras. 73-74
17. Read more: . Importantly, the transborder data flow as outlined in GDPR must not be confused with the rules established for the data exchange in law enforcement purposes. In addition to the so-called “Police Directive”, access to data needed for example for criminal investigations are regulated by the EU EEvidence framework and domestic criminal procedure laws, keeping in mind that EU Member States are Parties to the Council of Europe Budapest Convention. In February 2019, the European Commission proposed to start international negotiations on cross-border access to electronic evidence with the United States and for the participation in negotiations on a second Additional Protocol to the Council of Europe Convention on Cybercrime. Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA OJ L 119, 4.5.2016, pp. 89–131; See for more .
18. Commission Implementing Decision (EU) 2019/419 of 23 January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information (Text with EEA relevance) C/2019/304/.
19. Commission Implementing Decision (EU) 2019/419 of 23 January 2019 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by Japan under the Act on the Protection of Personal Information (Text with EEA relevance) C/2019/304/. Relevant topics are also covered in the Supplementary Rules under the Act on the Protection of Personal Information for the Handling of Personal Data Transferred from the EU based on an Adequacy Decision, and Official representations, assurances and commitments, Annexes to the same original document.
20. Article 46(5) GDPR allows the decisions adopted by the European Commission on the basis of Article 26(4) of Directive 95/46/CE to remain in force until amended, replaced or repealed. SCCs are established on this basis still being used by organizations as appropriate safeguards under Article 46.
21. European Data Protection Supervisor, Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, 2020, available at: accessed on 24 April 2020.
22. Other relevant adopted documents include: European Data Protection Supervisor, Strategy for Union institutions, offices, bodies and agencies to comply with the “Schrems II” Ruling, 2020, available at: accessed on 22 April 2020 and Recommendations 02/2020 on the European Essential Guarantees for surveillance measures, 2020, availble at: accessed on 20 April 2020
23. Available at: accessed on 27 April 2020.