Artificial Intelligence, Privacy, and Human Rights: A Comparative Analysis of Data Protection Laws

Abstract

Artificial intelligence (AI) systems depend on the collection, inference and reuse of personal data at a scale that strains the assumptions on which data protection law was built. This paper examines how five jurisdictions, namely the European Union, the United Kingdom, India, the United States and the People's Republic of China, respond to the privacy and wider human rights risks that AI creates. Using a functional comparative method, it evaluates each regime against five parameters: the lawful basis for using personal data to train AI models; safeguards against solely automated decision-making; transparency and the right to an explanation; protection of sensitive data and against algorithmic discrimination; and the reach of State exemptions and enforcement. The analysis draws on developments up to September 2026, including the European Union's Digital Omnibus on AI, the commencement of the United Kingdom's Data (Use and Access) Act 2025, the phased operationalisation of India's Digital Personal Data Protection Act 2023 through the 2025 Rules, the contest over federal pre-emption of State AI laws in the United States, and China's elevation of AI governance into its amended Cybersecurity Law. The paper identifies three regulatory models: a rights-based model anchored in fundamental rights (EU, and in modified form the UK), a market and sectoral model (US), and a State-directed model (China). India occupies an unsettled position: its constitutional commitment to privacy after Puttaswamy is strong, but its statutory framework is consent-centric and minimalist, lacks rights concerning automated decisions.