Publication Details
Abstract
This comparative study examines how three contemporary data-protection regimes the European Union’s General Data Protection Regulation (GDPR), India’s Digital Personal Data Protection (DPDP) Act, and Uzbekistan’s Law on Personal Data - address the concept and protection of digital identity. Through systematic analysis of statutory provisions, definitional frameworks, individual rights regimes, obligations imposed on controllers and processors, and enforcement mechanisms, this article evaluates whether and to what extent digital identity is legally recognized and substantively safeguarded. The analysis reveals that none of the three instruments explicitly denies the existence of digital identity; rather, each primarily frames protection around personal data as an informational or idem aspect of identity — stable identifiers and data points such as names, unique identifiers, and contact details. The study argues that this focus on the static, idem dimension leaves an important gap and a full protection of digital identity requires legal recognition and safeguarding of the “ipse” dimension the performative, contextual and reputational aspects of identity formed through online interactions, profiles, and algorithmic inferences. To address this gap, the researcher contends that data-protection laws should expand individual control mechanisms (including stronger rights over profiling, automated decision-making, reputation management and contextual consent), enhance transparency and redress concerning inference-based identity creation, and impose affirmative duties on data actors to prevent misuse of dynamic identity attributes. Strengthening these ipse-oriented protections will better enable individuals to manage their digital personhood and control how they are perceived and represented in the digital environment.