ANIRUDH BURMAN
The European Union’s (EU’s) General Data Protection Regulation (GDPR) took effect in May 2018, harmonizing data protection and privacy requirements across the EU.1 Many other countries have either implemented data protection requirements or are in the process of considering them. In the United States, for example, Senator Elizabeth Warren has proposed a bill to expand criminal liability for the executives of companies that suffer data breaches.2
India, too, is taking steps to enact a data protection framework modeled along the lines of the GDPR. In July 2017, the government of India appointed a Committee of Experts on a Data Protection Framework for India, or Data Protection Committee (DPC), under the chairmanship of Justice B.N. Srikrishna, to study issues related to data protection in India.3Though the committee submitted its report—and proposed a comprehensive law on data protection—on July 27, 2018, it failed to weigh the economic costs and benefits of implementing a GDPR-style law in India.
Emerging economies—like India—that are considering such proposals need to carefully evaluate the direct and indirect costs of such laws vis-à-vis the benefits from a data protection framework. A survey of the existing literature that estimates these costs and benefits highlights the need for further research on data protection laws.