Advisory for APS School Students

Modern international trade heavily relies on data transfers for the exchange of digital goods and services. User data travels across multiple jurisdictions and legal regimes, each with different rules for processing it. Since international treaties and standards for data protection are inadequate, states, in an effort to protect their citizens' data, have begun extending their domestic privacy laws beyond their borders. However, this opens a Pandora's box of legal and administrative complexities for both, the data protection authorities and data processors. The former must balance the harmonization of domestic data protection laws with their extraterritorial enforcement, without overreaching into the sovereignty of other states. The latter must comply with the data privacy laws in all states where it collects, stores, and processes data. While the international legal community continues to grapple with these challenges, India can draw valuable lessons to refine the Digital Personal Data Protection Act, 2023 (DPDP) in a way that effectively addresses these complexities.

Why Extraterritorial Application? 

Since data moves freely across borders and entities collecting such data from users in multiple states can misuse it or use it to gain an unfair competitive advantage in local markets, data privacy laws carry a clause on their extraterritorial application. Thus, this principle is utilized by states to frame laws that can ensure comprehensive data protection for their citizens, irrespective of the data’s location.  The foremost example of this is the European Union’s (EU) General Data Protection Regulation (GDPR), 2016,  which applies to any entity that processes the personal data of its citizens, regardless of its location. Recently, India has enacted the DPDP Act of 2023, which includes a clause on extraterritorial application.

The Extraterritorial Approach: GDPR and DPDP Act

The GDPR is considered the toughest data privacy law in the world and sets a global standard in data protection. According to Article 3, its provisions apply not only to data processors within the EU but also to those established outside its territory, if they offer goods and services to and conduct behavioural monitoring of data subjects within the EU. The enforcement of this regulation relies on heavy penalties for non-compliance in the form of fines up to €20 million or 4% of the company’s global turnover, whichever is higher, in case of severe violations. As a result, corporations based in the USA, like Meta and Clearview AI, have been fined over  €1.5 billion and €5.5 million respectively, under the GDPR. 

Like the GDPR, the DPDP Act extends its jurisdiction to foreign companies dealing with personal data of data principles within Indian territory under section 3(b). It has a similar extraterritorial reach and prescribes a penalty of up to Rs 250 crores in case of breaches. However, the Act or DPDP Rules, 2025, which are currently under deliberation, do not elaborate on an enforcement mechanism through which foreign companies can be held accountable. 

Lessons for India’s DPDP on Managing Extraterritorial Application 

1. Clarity in Definitions: GDPR clearly defines ‘personal data’, covering direct information such as name and identification number,  indirect identifiers like location data, and, online identifiers that can be used to identify the physical, physiological, genetic, mental, economic, cultural, or social identity of a natural person. It also prohibits revealing special categories of personal data like religious beliefs and biometric data to protect the fundamental rights and freedoms of the subjects. On the other hand, the DPDP Act/ Rules define ‘personal data’ vaguely, leaving a broad scope for Big Tech and ad-tech firms to bypass obligations. 
2. International Cooperation: Compliance is complex for companies due to varying data protection laws in different countries. The success of regulatory measures in such a scenario depends on international cooperation for governing cross-border data flows and enforcement. For DPDP to be effective, India will have to foster cooperation frameworks with other nations. 
3. Adequate Safeguards for Data Transfers: The GDPR regulates data transfers outside the EU via pre-approved legal mechanisms such as standard contractual clauses or binding corporate rules to ensure that the same level of protection applies to EU citizens’ data even when it is processed outside the EU. The DPDP should adopt similar safeguards to ensure that Indian citizens’ data is protected when processed abroad.
4. Revised Penalty Structure: The GDPR mandates a penalty structure that must be effective, proportionate, and dissuasive. The supervisory authority in each member state has the power to impose administrative fines as per these principles, up to an upper limit set by the GDPR. On the other hand, the DPDP’s penalty structure is simplistic and will disproportionately impact smaller businesses. It must take into regard factors such as nature, gravity, and duration of the infringement, its consequences, compliance measures taken, etc.
5. Governance Structure: The GDPR envisages a multi-tiered governance structure comprising of   

• National-level Data Protection Authorities (DPAs) for enforcing national data protection laws and the GDPR, 
• European Data Protection Supervisor (EDPS) for monitoring the processing of personal data by EU institutions and bodies,  
• European Commission (EC) for developing GDPR legislation
• European Data Protection Board (EDPB) for enabling coordination between the EC, EDPS, and DPAs

In contrast, the Data Protection Board (DPB) under DPDP will be a single, centralized body overseeing compliance and enforcement. Since its members are to be appointed by the Central Government, it raises questions about the Board’s autonomy and ability to apply regulations consistently. Further, its investigative and enforcement capabilities are not well defined.

Conclusion 

The protection of the human right to privacy ( under the International Covenant on Civil and Political Rights and the Universal Declaration of Human Rights) in today’s increasingly interconnected digital economy warrants international standard-setting on cross-border data protection. In the meantime, States relying on the extraterritorial application of domestic laws is unavoidable. While India’s DPDP takes measures towards this, they must be refined to ensure clarity regarding implementation mechanisms. They should push for alignment with data protection laws of other States, and account for the complexity of enforcement in cases involving extraterritorial jurisdiction. As India sets out to position itself as a global digital leader, a well-crafted extraterritorial framework under the DPDP Act will be essential to promote international trust in India’s data governance regime.

Sources

• https://gdpr-info.eu/art-83-gdpr/ 
• https://gdpr-info.eu/recitals/no-150/ 
• https://gdpr-info.eu/recitals/no-51/ 
• https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf 
• https://www.eqs.com/compliance-blog/biggest-gdpr-fines/#:~:text=ease%20the%20burden.-,At%20a%20glance,In%20summary 
• https://gdpr-info.eu/art-3-gdpr/ 
• https://www.legal500.com/developments/thought-leadership/gdpr-v-indias-dpdpa-key-differences-and-compliance-implications/#:~:text=Both%20laws%20cover%20'personal%20data,of%20personal%20data%20as%20sensitive. 

‍

Executive Summary:

A picture about the April 8 solar eclipse, which was authored by AI and was not a real picture of the astronomical event, has been spreading on social media.  Despite all the claims of the authenticity of the image, the CyberPeace’s analysis showed that the image was made using Artificial Intelligence image-creation algorithms. The total solar eclipse on April 8 was observable only in those places on the North American continent that were located in the path of totality, whereas a partial visibility in other places was possible. NASA made the eclipse live broadcast for people who were out of the totality path. The spread of false information about rare celestial occurrences, among others, necessitates relying on trustworthy sources like NASA for correct information.

Claims:

An image making the rounds through social networks, looks like the eclipse of the sun of the 8th of April, which makes it look like a real photograph.

‍

Fact Check:

After receiving the news, the first thing we did was to try with Keyword Search to find if NASA had posted any lookalike image related to the viral photo or any celestial events that might have caused this photo to be taken, on their official social media accounts or website. The total eclipse on April 8 was experienced by certain parts of North America that were located in the eclipse pathway. A part of the sky above Mazatlan, Mexico, was the first to witness it. Partial eclipse was also visible for those who were not in the path of totality. 

Next, we ran the image through the AI Image detection tool by Hive moderation, which found it to be 99.2% AI-generated.

‍

Following that, we applied another AI Image detection tool called Isitai, and it found the image to be 96.16% AI-generated.

‍

With the help of AI detection tools, we came to the conclusion that the claims made by different social media users are fake and misleading. The viral image is AI-generated and not a real photograph.

Conclusion:

Hence, it is a generated image by AI that has been circulated on the internet as a real eclipse photo on April 8. In spite of some debatable claims to the contrary, the study showed that the photo was created using an artificial intelligence algorithm. The total eclipse was not visible everywhere in North America, but rather only in a certain part along the eclipse path, with partial visibility elsewhere. Through AI detection tools, we were able to establish a definite fact that the image is fake. It is very important, when you are talking about rare celestial phenomena, to use the information that is provided by the trusted sources like NASA for the accurate reason.

• Claim:  A viral image of a solar eclipse claiming to be a real photograph of the celestial event on April 08
• Claimed on: X, Facebook, Instagram, website
• Fact Check: Fake & Misleading

‍

Introduction

In a world perpetually in motion, the currents of the information superhighway surge ceaselessly, molding perceptions, shaping realities, and often blurring the lines that tether truth to its moorings. At the heart of this relentless churn lies a conundrum that has become all too familiar, in which veracity is obscured by the shadow-play of misinformation. Emblematic of this dilemma is the narrative of Virat Kohli, a name that has become synonymous not only with cricketing brilliance but with the complexities of a modern era where digital echo chambers amplify half-truths and outright fabrications with alarming efficacy.

It is within this intricate fabric of the digital realm that the saga of Virat Kohli—a titan of cricket whose arsenal of strokes and strategic acumen have captivated audiences worldwide—takes on a dimension that transcends the sport. The speculative murmurs have been converted into roaring waves of misinformation, crafting a narrative that, while devoid of truth, assumes a disconcerting life. This digital osmosis, the transmutation from a quiet inkling to a deafening chorus of credibility, exemplifies the troublesome dynamic that has come to define our interactions with news media in the 21st century.

Fact check: Viral Misinformation

A viral post about Virat Kohli's mother suffering from liver issues has gone viral on social media. The claim came after Kohli withdrew from the India-England test series citing 'personal reasons'. Vikas Kohli, brother of Virat Kohli, clarified on Instagram that the viral news about their mother is false. He clarified that their mother is doing well and the viral claim is false. Vikas Kohli's Instagram page dismissed the viral claim, stating that he noticed the fake news and requested the media not to spread such news without proper information.

Fake Health Crisis

As this virulent strain of rumour regarding the health of Saroj Kohli, Virat Kohli’s mother, began to swell into the digital domain, it brought to the forefront a critical examination of the checks and balances within our networks of communication. Saroj, whose resilience and nurturing presence had been an anchor in the athlete's storied journey, undeservedly became the nucleus of a fictitious tale of despair, giving us pause to reflect on the ethical boundaries of storytelling in the world of clicks and views.

Vikas Kohli—the elder brother of Virat Kohli—took to social media, the very platform from which the falsehood originated, to stand as the bulwark against the spread of this groundless narrative. 

The Consequences

The consequences of such falsehoods and their rapid dissemination are manifold, affecting individuals and communities in profound ways. The motivations behind the proliferation of deceitful stories are as labyrinthine as the networks they traverse - from manipulation and economic incentives to the pursuit of sheer sensationalism or cynical entertainment, each strand intertwines to form an intricate web wherein truth struggles to assert itself.

Conclusion 

In the ceaseless expanses of the digital cosmos, where one can easily drift into the void of falsities, let the narrative of Virat Kohli stand as a sentinel, a reminder of our duty to navigate these waters with vigilance and to preserve the sanctity of truth. Amidst the vast ocean of content that laps in our consciousness, it is precisely this unwavering dedication to facts that will act as our compass, enabling us to discern the credible beacons from the deceptive mirages and ultimately ensuring that our discourse remains moored in the bedrock of reality.

References 

• https://www.thequint.com/news/webqoof/virat-kohli-mother-sick-liver-disease-fact-check
• https://indianexpress.com/article/sports/cricket/ind-vs-eng-virat-kohlis-brother-dismisses-fake-news-circulating-about-their-mother-9136144/
• https://www.outlookindia.com/amp/story/sports/ind-vs-eng-virat-kohlis-brother-slams-fake-news-on-their-mothers-health

‍