Published On: December 19th 2025
Authored By: Nameera Iqbal
Sultan-ul-uloom College of Law, affiliated to Osmania University, Hyderabad
Abstract
This article examines the legal issues that emerge at the interface of human rights and rapidly evolving digital technologies, with a focus on data protection and privacy. It outlines the aims of privacy law, surveys landmark international and domestic frameworks, identifies core criticisms, including state overreach, weak enforcement, consent fatigue and algorithmic opacity and proposes practical legal, institutional and technological reforms. The analysis draws on primary legal instruments (including the GDPR[1] and international human rights law)[2], key jurisprudence (notably India’s Puttaswamy decision)[3] and contemporary scholarship on surveillance and algorithmic accountability.[4] The article concludes with recommendations for policymakers and regulators seeking to preserve human dignity and autonomy in the digital age.
Introduction
The rise of digital platforms, cloud storage and algorithmic decision-making has radically altered how personal information is created, shared and used. While these innovations bring economic and social benefits, they also create new risks such as large-scale data breaches, hidden profiling, discriminatory automated decisions, and intrusive surveillance. Privacy and data protection therefore sit at the centre of modern human rights debates: they are necessary conditions for dignity, free expression and democratic participation.[5] This article addresses how law can respond effectively to those challenges by mapping objectives, diagnosing weaknesses in existing regimes, and recommending reforms that are legally principled, technologically realistic and rights-respecting.
Objectives of Data Protection and Privacy Law
Data protection law advances several related objectives. First, it protects personal autonomy and human dignity by limiting unauthorised uses of personal information. Second, it empowers individuals with meaningful control over their data[6], allowing them to determine how it is collected, shared, and used. Third, privacy law seeks to prevent tangible harms such as identity theft, discrimination, or algorithmic exclusion. Fourth, modern regimes also ensure transparency and accountability of data processors, granting individuals enforceable rights (access, correction, deletion, and portability). Finally, effective data protection reconciles these individual rights with legitimate public interests[7] – such as security, health, or innovation through clear exceptions and effective oversight.
Existing Legal Frameworks: Selected Highlights
The European Union’s General Data Protection Regulation (GDPR) established a comprehensive, principle-based framework that imposes strong obligations on data controllers and provides enforceable rights to data subjects. It emphasizes principles such as purpose limitation, data minimization, and privacy by design[8], while promoting compliance through administrative fines[9] and supervisory authorities.[10]
International human rights instruments also anchor privacy in law: Article 17 of the International Covenant on Civil and Political Rights protects individuals against arbitrary or unlawful interference with their privacy and mandates legal safeguards against such interference.
In India, the Supreme Court’s nine-judge decision in Justice K.S Puttaswamy (Retd.) v Union of India[11] recognised privacy as a fundamental right under the Constitution, forming a constitutional basis for data-protection law and regulation. More recently, the Parliament enacted the Digital Personal Data Protection Act, 2023 (DPDP Act)[12] to regulate processing of digital personal data for lawful purposes while seeking to balance individual rights and public interests.
Criticisms and Gaps in Current Regimes
Despite significant progress, several gaps in data protection remain. First, state powers to access personal data for security or law enforcement are often broadly defined and implemented with limited judicial or parliamentary oversight. Such open-ended exceptions risk transforming data-protection law into a licence for mass surveillance[13]. Second, enforcement capacity is uneven: many supervisory authorities lack sufficient resources or independence, and penalties may be too low to deter non-compliance.Third, the consent model, central to many data protection laws, is increasingly ineffective[14] in practice, as complex terms, bundled consents, and ‘dark patterns’ undermine meaningful choice. Fourth, cross-border data flows and jurisdictional fragmentation complicate enforcement[15] and create regulatory loopholes. Finally, algorithmic systems are frequently empty; without mandatory impact assessments and credible auditing, discriminatory or exclusionary practices can remain invisible and unremedied.
Solutions and Recommendations
The following reforms, pursued together, would materially strengthen the protection of privacy and data rights in the digital era:
- Strengthen independent oversight: Data protection authorities must be independent, well-funded and granted investigative, corrective and sanctioning powers. Parliamentary and judicial review is essential where law enforcement or national security exceptions are invoked.
- Modernise legal definitions and ensure technology neutrality: Laws should define personal data, profiling, sensitive categories and automated decision-making in ways that can accommodate emerging technologies (biometrics, inferences, derived data), while remaining technology-neutral.
- Algorithmic transparency and auditing: High-risk automated decision-making systems should be subject to mandatory risk or impact assessments.[16] Independent audits should be required, with disclosure of non-sensitive findings, and affected individuals should have meaningful rights to explanation or review when decisions significantly impact them.
- Move beyond consent where appropriate: Consent should not be the lone legal basis for common-sense privacy protections. For non-essential processing, stronger default privacy protections and opt-out mechanisms are appropriate; for public-interest uses, clear legal standards and democratic oversight are needed.
- Strengthen remedies and sanctions: Effective enforcement requires fast, low-cost dispute resolution[17], through administrative remedies and collective actions, along with financial penalties strong enough to ensure compliance.
- International cooperation: mutual adequacy frameworks, cross-border supervision and harmonised minimum standards[18] can create more uniform regulations and better protect individuals as their data moves across jurisdictions.
- Promote privacy-enhancing technologies (PETs) and public education: policymakers should incentivise PETs (end-to-end encryption, anonymisation techniques, differential privacy) and invest in digital-literacy programmes so that individuals can make informed privacy choices.
Challenges in Implementing Privacy Solutions and Potential Fixes
Even with strong laws and frameworks, making privacy real is a human and systemic challenge. Regulators are often under pressure, balancing limited resources, fast-moving technology, and competing political priorities. Organizations, especially small businesses, may see compliance as a burden rather than a responsibility. Meanwhile, ordinary users can feel overwhelmed or powerless, unsure how to control their own data in a world of endless tracking. Technology itself adds another layer: AI algorithms, predictive analytics, and global cloud systems operate in ways most people and even regulators, cannot fully see or understand.
The “fix” isn’t just new laws, it’s creating a culture of privacy. Regulators need not only power but foresight and technical understanding. Businesses should be partners in protecting data, not just rule-followers. And people should be empowered through education and tools that make privacy tangible in daily life as in easy-to-use dashboards, alerts about risky data sharing, or clear explanations when automated decisions affect them. In other words, solving privacy challenges means combining law, technology, and human-centered thinking into a system that actually works for people, not just on paper.
Case Study: India – From Puttaswamy to the DPDP Act
India provides a useful case study of tensions between constitutional privacy rights and regulatory design. The Supreme Court’s Puttaswamy’s judgment acknowledged privacy as a constitutional right and set out principles of legality, necessity and proportionality for government access into privacy. This ruling created a clear mandate for legislative action. The subsequent DPDP Act, 2023 represents Parliament’s attempt to operationalise data protection: it creates obligations for data fiduciaries and grants individuals key rights, such as access, correction and erasure of their data, with enforcement through administrative mechanisms. At the same time, commentators have raised concerns about the DPDP Act’s broad exemptions[19] for government processing, the readiness of regulators during the transition period, and the potential costs of compliance for smaller actors.To bring the Act closer to the principles set out in Puttaswamy, policymakers should narrow government exemptions, introduce independent review for state access requests, and require clear algorithmic audits for high-risk systems.
Conclusion
Privacy and data protection are not merely technical or commercial issues; they are central to the protection of human dignity, autonomy and democratic governance in the digital era. Landmark instruments – international human rights law, the GDPR and constitutional jurisprudence such as Puttaswamy provide strong foundations. Yet law must continue to evolve: to close gaps in state oversight, to operationalise algorithmic accountability, moving beyond superficial consent mechanisms and ensuring effective remedies alongside coordinated cross-border protections. Beyond legal safeguards, fostering technological standards, ethical design practices, and public awareness is crucial. By integrating these elements, states can uphold human rights, mitigate risks, and create an environment where responsible innovation can thrive.
References
[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) [2016] OJ L119/1.
[2] International Covenant on Civil and Political Rights, 16 December 1966, 999 UNTS 171, art 17.
[3] Justice K.S. Puttaswamy (Retd.) v Union of India (2017) 10 SCC 1.
[4] Shoshana Zuboff, The Age of Surveillance Capitalism (PublicAffairs 2019) 98–102.
[5] Justice K.S. Puttaswamy (Retd.) v Union of India (n 3) paras 59, 66; GDPR (n 1) recital 1; Zuboff (n 4) 98–102.
[6] DPDP Act 2023 (n 5) s 3.
[7] GDPR (n 1) arts 5–7.
[8] GDPR (n 1) art 25 (Privacy by Design).
[9] GDPR (n 1) art 83 (administrative fines).
[10] GDPR (n 1) arts 32–34 (security and breach notification).
[11] Justice K.S. Puttaswamy (Retd.) v Union of India (n 3) para 93.
[12] The Digital Personal Data Protection Act 2023 (India).
[13] Justice K.S. Puttaswamy (Retd.) v Union of India (2017) 10 SCC 1, para 145.
[14] Justice K.S. Puttaswamy (Retd.) v Union of India (n 3) para 59.
[15] GDPR (n 1) arts 44–50 (cross-border transfers).
[16] GDPR (n 1) art 35 (Data Protection Impact Assessment).
[17] DPDP Act 2023 (n 5) ss 26–28 (penalties and enforcement).
[18] UN Human Rights Council, ‘Report on the Right to Privacy in the Digital Age’ UN Doc A/HRC/27/37 (2014).
[19] DPDP Act 2023 (n 5) ss 22–24 (government exemptions).
