BALANCING PRIVACY AND PUNISHMENT: A COMPARATIVE STUDY OF CRIMINAL LIABILITY IN DATA PROTECTION LAW

The rapid expansion of digital ecosystems has transformed personal data into one of the most valuable contemporary assets, simultaneously intensifying concerns relating to privacy, security, and accountability. Legal systems across the world have responded by developing diverse enforcement mechanisms designed to regulate the collection, processing, and misuse of personal information. While jurisdictions such as the European Union, the United Kingdom, and the United States continue to employ regulatory models that combine administrative sanctions with targeted criminal liability for serious data-related misconduct, India’s enactment of the Digital Personal Data Protection Act, 2023 represents a notable departure through its predominantly decriminalized enforcement structure. This paper undertakes a comparative legal analysis of India’s data protection enforcement framework against selected international jurisdictions in order to examine the implications of decriminalization on regulatory accountability. The study first evaluates the European Union’s rights-based regulatory architecture under the General Data Protection Regulation, followed by an examination of the United Kingdom’s hybrid enforcement model under the UK Data Protection Act 2018, which integrates administrative penalties with criminal sanctions for specific violations. It further analyses the sectoral regulatory approach adopted by the United States, with particular reference to the Health Insurance Portability and Accountability Act of 1996 and related federal enforcement mechanisms. Through comparative analysis, the paper identifies the strengths and limitations of India’s current framework and explores whether the complete absence of criminal liability may weaken deterrence in cases involving deliberate, malicious, or egregious misuse of personal data. The study ultimately proposes a balanced reform-oriented model aimed at strengthening accountability while preserving regulatory efficiency within India’s evolving digital governance framework.