Understanding GDPR: Its Legal Implications and Relevance to South Asian Privacy Regimes
DOI:
https://doi.org/10.32890/uumjls2022.13.1.3Keywords:
EU-South Asia Relations, GDPR, GDPR and South Asian Privacy Regimes, Implications of GDPRAbstract
Emerging as a buzzword, the General Data Protection Regulation (GDPR) has had immense implications on global data protection regimes. The GDPR appears as a worldwide standard for protecting personal data based on the omnibus legal substance, extensive extraterritorial scope, and influential market of the European Union
(EU). It resulted in a global wave where countries are either adopting new legislation or modifying existing data privacy laws to comply with the GDPR. Historically, the South Asian region, abode to one-fifth of the world’s people, has strong trade and economic ties with Europe. As reflected in current bilateral or multilateral trade
agreements, the EU tends to be one of the largest trading partners of most South Asian countries. Therefore, it is understandable that the EU’s norms, laws, policies, particularly the GDPR, would have far-reaching impacts on South Asian countries. However, the issue has not been yet evaluated in legal academic settings that require an analysis of GDPR’s overview and its impacts on South Asian privacy regimes. The findings of this doctrinal legal study, together with the sharing of a brief overview of the GDPR and South Asian privacy regimes, reiterate the influence of GDPR in this region. The findings of this research also have the prospects to enlighten the stakeholders in understanding the GDPR and its implications on global as well as South Asian privacy regimes. This article concludes with several suggestions and policy alternatives that policymakers can explore
in South Asia and beyond in designing their potential personal data protection policy strategies.
References
Abdul Ghani, A., I. M. (2020) Challenges for legal education in the era of I.R.4.0. UUM Journal of Legal Studies, 11(2), 27-51.
Arakali, H. (2019, December 13). The personal data protection Bill could be a serious threat to Indians’ Privacy. Forbs India. http://www.forbesindia.com/article/leaderboard/the-personal-data-protection-bill-could-be-a-serious-threat-to-indians-privacy/56623/1
Assembly, G. (1966a, December 16). International Covenant on Civil and Political Rights (ICCPR). https://treaties.un.org/doc/ Publication/MTDSG/Volume%20I/Chapter%20IV/IV-4.en.pdf
Assembly, G. (1966b). International Covenant on Civil and Political Rights (ICCPR). https://treaties.un.org/doc/Publication/ MTDSG/Volume%20I/Chapter%20IV/IV-4.en.pdf
Ayub, Z. A., & Yusoff, Z. M. (2020). Right of online informational privacy of children in Malaysia: A statutory perspective. UUM Journal of Legal Studies, 9, 222.
Babele, A. (2019, October 10). Sri Lanka introduces final draft of personal data protection Bill. Medianama. https://www. medianama.com/2019/10/223-sri-lanka-final-draft-of-data-protection-legislation/
Bradford, A. (2012). The Brussel’s effect. Northwestern University Law Review, 107, 1.
Bennett, C. J. (2018). The European general data protection regulation: An instrument for the globalisation of privacy standards? Information Polity, 23(2), 244.
Bennett, C. J., & Raab, C. D. (2018). Revisiting the governance of privacy: Contemporary policy instruments in global perspective. Regulation & Governance.
Berecki, B. (2019, February 4). 5 Best Practices for Data Breach Prevention in 2019. endpointprotector.com/blog/5-best-practices-for-data-breach-prevention-in-2019/
Buttarelli, G. (2016). The EU GDPR as a clarion call for a new global digital gold standard. International Data Privacy Law, 6(2).
Cannataci J. (2019, October 17). Report of the Special Rapporteur on the Right to Privacy. A/HRC/40/63, para 107, p. 16. https://rm.coe.int/40th-hrc-session-report-of-the-special-rapporteur-on-the-right-to-priv/1680933f08
Commission, EU. (2018a, June 24). Statement by Vice-President Ansip and Commissioner Jourová Ahead of the Entry into Application of the General Data Protection Regulation. https://ec.europa. eu/commission/presscorner/detail/en/STATEMENT_18_3889.
Commission, EU. (2000b, August 11). Hague Conference on Private International Law. https://assets.hcch.net/upload/wop/jdgmpd11. pdf
Commission, EU. (2019c). Adequacy decisions. https://ec.europa.eu/ info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
Commission, EU. (2019d January 23). European Commission adopts adequacy decision on Japan, Creating the world’s largest area of safe data flows. https://ec.europa.eu/commission/ presscorner/detail/en/IP_19_421
Council, EU. (2000b). The Brussels I Regulation 2000: Regulation (EC) No 44/2001 of 22 December 2000 on Jurisdiction and the Recognition and Enforcement of Judgments in Civil and Commercial Matters. http://www.dutchcivillaw.com/ legislation/brusselsone.htm
Damro, C. (2012). Market power Europe. Journal of European Public Policy, 19(5), 682-699.
De Hert, P. & Czerniawski, M. (2016). Expanding the European data protection scope beyond territory: Article 3 of the general data protection regulation in its wider context. International Data Privacy Law, 6 (3), 230-43.
DLA Piper. (2020, February 8). EU general data protection regulation - Key changes. https://www.dlapiper.com/en/uk/focus/eu-data-protection-regulation/key-changes/
EDPB. ( 2019). First Overview on the implementation of the GDPR and the roles and means of the National Supervisory Authorities. file:///C:/Users/user/Downloads/19_2019_edpb_ written_report_to_libe_en.pdf
Ekran. (2019, June 27). 5 industries most at risk of data breaches. https://www.ekransystem.com/en/blog/5-industries-most-risk-of-data-breaches
European Commission. (2015) Countries and regions, Bangladesh: Trade Picture. https://ec.europa.eu/trade/policy/countries- and regions/countries/bangladesh/#:~:text=The%20EU%20 is%20Bangladesh’s%20main,EU’s%20total%20imports%20 from%20Bangladesh
European Union. (2016a). Relations between the EU and Bangladesh. https://eeas.europa.eu/delegations/bangladesh/926/ bangladesh-and-eu_en
European Union. (2017b). The Economy. https://europa.eu/european-union/about-eu/figures/economy_en Fact Sheets, EU: South Asia. (2019). https://www.europarl.europa.eu/ factsheets/en/sheet/181/south-asia.
Goldsmith, J. (2019, January 21). France slaps Google with €50M fine for privacy violation under GDPR. https://www.forbes. com/sites/jillgoldsmith/2019/01/21/france-slaps-google-with-e50m-fine-for-privacy-violation-under-gdpr/#2722b09a79ec
Greenleaf, G. (2019a). Global Data Privacy Laws 2019: 132 National Laws & Many Bills. Privacy Laws & Business International Report, 157 (14-18), 7.
Greenleaf, G. (2019b). Asia’s Data Privacy Dilemmas 2014–19: National Divergences, Cross-Border Gridlock. Revista Uruguaya de Protección de Datos Personales (Revista PDP) 49-73 UNSWLRS 103, 60.
Greenleaf, G. (2019c). Countries with Data Privacy Laws – By Year 1973-2019 (May 10, 2019). SSRN: https://ssrn.com/ abstract=3386510 or https://doi.org/10.2139/ssrn.3386510
Greenleaf, G. (2014d). Asian Data Privacy Laws: Trade & human rights perspectives. Oxford: Oxford University Press, 10.
Greenleaf, G. (2012e). The Influence of European data privacy standards outside Europe: Implications for Globalisation of Convention 108. International Data Privacy Law, 2(2), 68.
Greenleaf, G. & Cottier, B. (2018). Data privacy laws and Bills: Growth in Africa, GDPR influence. Privacy Laws & Business International Report, 152 (18-52), 5.
Hague Conference on Private International Law. (1967). Hague Conference: Supplementary Protocol to the Hague Convention on the Recognition and Enforcement of Foreign Judgments. assets.hcch.net/docs/7e92b6a1-1eff-4567-ae95-9b8e93104c9e.pdf
Hern A. (2018, May 21). What Is GDPR and how will it affect you? The Guardian. https://www.theguardian.com/technology/2018/ may/21/what-is-gdpr-and-how-will-it-affect you
Huth, D. (2017). A pattern catalogue for GDPR compliant data protection. In PoEM Doctoral Consortium, 34-40.
ICO. (2018a, May 25). The Principles. Information Commissioner’s Office, UK. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/
ICO. (2018b, May 25). International Transfers. Information Commissioner’s Office, UK. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers#adequacy-decision
ICO. (2018c, October 25). ICO issues maximum £500,000 fine to Facebook for failing to protect users personal information. Information Commissioner’s Office, UK. https://ico.org. uk/facebook-fine-20181025?utm_source=twitter&utm_ medium=iconews&utm_term=7e7dd63a-2bfd-407c-b985-c21fa7b16b6c&utm_content=&utm_campaign=%C2%A0
ICO. (2018d, September 20). Equifax Ltd. Information Commissioner’s Office, UK. https://ico.org.uk/action-weve-taken/enforcement/ equifax-ltd/
IMF. (2019, November 4). Building on South Asia’s Economic success. IMF Country Focus. https://www.imf.org/en/News/ Articles/2019/11/01/NA110219-building-on-south-asias-economic-success
Islam, M. T., & Karim, M. E. (2019, September/ October). UPDATE: A Research Guide on the South Asian Association for Regional Cooperation (SAARC). https://www.nyulawglobal.org/ globalex/SAARC1.html#_Information_and_Poverty
Islam, M. T., & Karim, M. E. (2020). Extraterritorial application of the GDPR: An International Law Perspective. IIUM Law Journal, 28(2), 531-565.
Ius Laboris (2019, September 17). The impact of the GDPR Outside the EU. https://theword.iuslaboris.com/hrlaw/whats-new/the-impact-of-the-gdpr-outside-the-eu
Jiali, M. (2012). SAARC: Achievements and challenges. Policy Perspectives, 161-65.
Karim, ME. (2005) Citizen’s right to privacy: Reflection in the International Instruments and National Laws. 9 Bangladesh Journal of Law, 54.
Karim, ME. (2020) Cyber law in Bangladesh. Wolters Kluwer, 223. Kennedy J. Ireland’s Government agrees ‘digital age of consent’ should be 13. (2020). https://www.siliconrepublic.com/comms/ digital-age-of-consent-ireland
KPMG. (2018, April 11). Extraterritorial scope of the GDPR: The impact of the GDPR on organisations in Asia. https://assets. kpmg/content/dam/kpmg/sg/pdf/2018/04/impact-of-gdpr-in-asia.pdf
Kuner, C. (2010). Data protection law and international jurisdiction on the internet (Part 2). International Journal of Law and Information Technology, 18 (3), 227-47.
Langheinrich, M. (2018). The golden age of privacy? IEEE Pervasive Computing, 17 (4), 4-8.
Lexology. (2019, June 5). Happy birthday GDPR. At one year on, what have we learned? https://www.lexology.com/library/ detail.aspx?g=649cd552-7853-4abc-81c6-37af2c8dd415
Makulilo, AB. (2017). The GDPR implications for data protection and privacy protection in Africa. 1 International Journal of Data Protection Officer, Privacy Officer & Privacy Counsel, 15-16.
Mandavia, M. (2019, December 10). Data protection Bill: Centre has the power to exempt any government agency. The Economic Times. https://economictimes.indiatimes.com/ tech/internet/data-protection-bill-centre-has-the-power-to-exempt-any-government-agency-from-application-of-act/ articleshow/72454669.cms
Neupane. (2019, February 2018). Introduction to the Privacy Act 2018. https://www.neupanelegal.com/news-detail/introduction-to-the-privacy-act-2018.html
Paul, Joel R. (1991). Comity in International Law. Harvard International Law Journal, 32, 1.
PDPA. (2010). Personal Data Protection Act 2010. (Act No. 709, Malaysia).
Prasad, S. K., & Aravindakshan, S. (2020). Playing catch up–privacy regimes in South Asia. The International Journal of Human Rights, 1-2.
Privacy International. (2018, August). Personal Data Protection Bill, 2018: Civil Society submission to the Ministry of Information Technology and Telecommunications. https://digitalrightsfoundation.pk/wp-content/uploads/2018/08/DP-Comments-Brief-Final-8.8.18-1.pdf
Reed, C. (2004). Internet law: Text and materials: Cambridge University Press, 271.
GDPR (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46. Official Journal of the European Union, 59(1-88), 294.
Report, S. B. (2019, November 27). Data protection act soon: Jabbar. https://www.thedailystar.net/business/data-protection-act-in-bangladesh-soon-1832320
Rustad, M. L., & Koenig, T. H. (2018). Towards a global data privacy standard. Florida Law Review, 71, 18-16.
Ryngaert, C. (2015). Jurisdiction in International Law. USA: Oxford University Press.
Schulze, E. (2019a, May 23). The US wants to copy Europe’s strict data privacy law – But only some of It. The CNBC. https://www. cnbc.com/2019/05/23/gdpr-one-year-on-ceos-politicians-push-for-us-federal-privacy-law.html
Schulze, E. (2019b, November 27). Uber fined nearly $1.2 million by British and Dutch authorities for 2016 data breach. The CNBC. https://www.cnbc.com/2018/11/27/uber-fined-more-than-1-million-dollars-by-uk-and-dutch-authorities.html
Schwartz, P. M. (2019). Global Data Privacy: The EU Way. New York University Law Review, 94, 4.
S&R Associates. (2020, January 7). India: The Personal Data Protection Bill, 2019. Mondaq. http://www.mondaq.com/ india/x/880766/data+protection/The+Personal+Data+Protecti on+2019
Svantesson, D. J. B. (2014). The extraterritoriality of EU Data Privacy Law-Its theoretical justification and its practical effect on US businesses. Stanford Journal of International Law, 50(1), 55.
Teixeira, G. A., da Silva, M. M., & Pereira, R. (2019). The critical success factors of GDPR implementation: A systematic literature review. Digital Policy, Regulation and Governance, 21(4), 402.
UNHRC. (2006, September 14). Decisions of the Human Rights Committee Declaring Communications Inadmissible under the Optional Protocol to the International Covenant on Civil and Political Rights. http://www.worldlii.org/int/cases/ UNHRC/2006/48.html
Walsh, R. (2013). Extraterritorial confusion: The complex relationship between Bowman and Morrison and a revised approach to extraterritoriality. Valparaiso University Law Review, 47 (2), 629.
WB. (2016, May 24). The Potential of Intra-regional trade for South Asia. World Bank Infographic. https://www.worldbank.org/en/ news/infographic/2016/05/24/the-potential-of-intra-regional-trade-for-south-asia
WEF. (2018a). The Global Competitiveness Report 2018: South Asia. World Economic Forum. http://reports.weforum.org/global-competitiveness-report-2018/south-asia/
WEF. (2019b, October 2). The South Asia Risks Landscape. World Economic Forum. https://www.weforum.org/whitepapers/the-south-asia-risks-landscape
Westin, A. F. (2003). Social and political dimensions of privacy. Journal of Social Issues, 59(2), 431-53.
Wu, T. & Goldsmith, J. (2006). Who controls the internet? Illusions of a borderless world. New York: Oxford University Press.
Zarsky, Tal Z. (2017). Incompatible: The GDPR in the age of big data. Seton Hall Law Review, 47(4), 995.
Published
Issue
Section
How to Cite
Research impact
Harvested 2026-09-07Counts differ between services because each indexes a different body of literature. None of them is the whole picture.
