Remedies Involving Data Firewalls and Access Commitments

Introduction

A data firewall is a legal, organisational, or technical mechanism designed to prevent unauthorised access, sharing, or use of information. It may separate personal data from commercial datasets, restrict access between departments, or prevent confidential information obtained for one purpose from being used for another.

An access commitment is a binding promise or enforceable undertaking that specifies who may access data, for what purpose, under which conditions, and with what safeguards. Such commitments are relevant in healthcare, biotechnology, competition regulation, research, and digital platforms.

Remedies involving data firewalls and access commitments aim to prevent misuse, protect confidentiality, preserve fair competition, and ensure that information is used only for authorised purposes. Their enforceability depends on the applicable statute, regulatory order, contract, or court direction.

Case laws

1. K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1
The Supreme Court recognised informational privacy as part of the fundamental right to privacy under Article 21. Any intrusion must satisfy legality, a legitimate aim, and proportionality. The Court also recognised the State’s positive duty to protect privacy against non-state actors. This supports remedies requiring restricted access, purpose limitation, and safeguards against unauthorised data use.

Indian Kanoon+1

2. K.S. Puttaswamy v. Union of India (Aadhaar judgment), (2019) 1 SCC 1
The Supreme Court examined Aadhaar’s data-security architecture, including encryption, network partitioning, firewalling, access restrictions, and limits on information sharing. It also read down or invalidated provisions that permitted excessive disclosure or private use of Aadhaar authentication. This is particularly relevant because the judgment illustrates how legal remedies may combine technical firewalls with statutory access restrictions and procedural safeguards.

2018 Supreme(SC) 947+2

3. Manohar Lal Sharma v. Union of India, 2021 INSC 682
In the Pegasus spyware proceedings, the Supreme Court recognised the serious privacy implications of unauthorised surveillance and constituted an independent technical committee to examine allegations. The decision demonstrates that where access to digital data is alleged to be unlawful, a court may order independent investigation and technical scrutiny rather than rely solely on the affected party’s assurances.

VoxJuris

Scope of remedies

Courts and regulators may order or require:

Technical separation: Firewalls, segmented networks, encryption, role-based permissions, and separate data environments.

Purpose limitation: Access only for a defined and lawful purpose; prohibit secondary use or onward disclosure.

Access commitments: Binding undertakings identifying authorised users, permitted data fields, duration, and conditions of access.

Audit and monitoring: Access logs, independent security audits, breach reporting, and periodic compliance reports.

Corrective action: Restrict or revoke access, delete unlawfully obtained copies, and remedy security weaknesses.

Enforcement: Injunctions, regulatory penalties, suspension of access, or contempt proceedings where a court order is breached.

An effective commitment should specify who is bound, what information is covered, how access is controlled, the duration of the obligation, and how compliance will be verified. A vague promise to “protect data” is difficult to enforce.

Conclusion

Data firewalls and access commitments are important remedies for preventing unlawful data access and misuse. Indian constitutional privacy jurisprudence—especially Puttaswamy—supports proportionate, purpose-limited, and secure data handling. Courts may combine technical controls with legal undertakings, audits, disclosure restrictions, and enforcement measures. The remedy must be tailored to the risk: it should protect confidentiality without unnecessarily preventing lawful, necessary, and properly authorised access.