Data Beyond Borders: OTT Platforms, The DPDP Act And Cross-Border Data Transfers
Anshika Singh, Jindal Global Law School
ABSTRACT
The introduction of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) has been an important change in the Indian data governance system, especially regarding cross-border data transfers. Departing from previous proposals which mandate rigid data localization, the Act follows a much lenient, ‘negative list’ approach that permits the transfer of personal data out of India except to the jurisdictions identified by the Central Government. The implications of this approach are far-reaching to Over-the-Top (“OTT”) platforms, whose operating architecture, relies on constant transnational flows of data as the means of content delivery, algorithmic personalization, and the world-digital cloud-based infrastructure. This paper is a critical study which looks at whether the DPDP Act provides a coherent and adequate regulatory framework on cross-border transfer of personal data in OTT platforms. It goes on to examine Section 16 and its design on a statutory level, the accountability requirements of Section 8 and the relationship with sectoral regulations. It also goes on to compare the framework with constitutional principles of privacy and proportionality as enshrined in Justice K.S. Puttaswamy v Union of India and also providing a comparative analysis to European Union’s General Data Protection Regulation (“GDPR”). It ultimately finds that while the DPDP Act is logical in its economic and regulation goals, it is not enough to provide strong data protection as there are no systematic protection measures and so, the DPDP framework needs additional rulemaking and institutional development in order to be useful in governing the cross-border data flows in a globalized digital economy.
