Balancing Free Speech and Security: Lessons from India, Bangladesh, USA, UK, and Japan

Introduction

In the digital era, balancing free speech with national security has become one of the most urgent challenges for legal systems worldwide. The internet and social media amplify voices across borders, empowering citizens and strengthening democratic participation, yet they also expose societies to vulnerabilities such as cybercrime, disinformation, surveillance, and privacy violations. This duality forces states to craft legal frameworks that reconcile liberty with security, often revealing stark contrasts in approach.

India illustrates this dilemma: judicial activism protects constitutional rights, yet executive regulations like the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021¹ and the Digital Personal Data Protection Act 2023² impose heavy compliance burdens. Bangladesh, from the Information and Communication Technology Act 2006³ to the Cyber Security Act (Amendments) 2025⁴ and 2026 and the Personal Data Protection Act 2026⁵, reflects a security-centric model with weak judicial oversight. Meanwhile, the USA, UK, and Japan offer alternative models prioritising liberty, regulator-driven accountability, and privacy-focused proactive defence, through instruments such as the First Amendment⁶, Communications Decency Act 1996, s 230⁷, the Online Safety Act 2023⁸, and Japan’s Act on the Protection of Personal Information (APPI)⁹.

Main Body

A. Legal Frameworks

India

India’s cyber law regime is anchored in the Information Technology Act 2000, which was amended in 2008 to address cybercrime, electronic commerce, and digital authentication. This Act remains the backbone of India’s digital governance, empowering authorities to regulate online activity and prosecute offences such as hacking, identity theft, and data breaches. A critical provision, Section 69A¹⁰, authorises the government to block online content in the interest of sovereignty, public order, or national security. While this provision has been used to restrict access to websites and social media accounts, critics argue that its broad scope risks undermining free expression.

The Intermediary Guidelines and Digital Media Ethics Code 2021¹¹ further expanded state oversight by imposing obligations on platforms to trace the origin of messages, remove unlawful content within tight deadlines, and appoint compliance officers in India. These rules reflect a shift toward platform accountability but raise concerns about privacy and the chilling effect on speech, particularly given India’s constitutional guarantee under Article 19(1)(a).

In parallel, the Digital Personal Data Protection (DPDP) Act 2023¹² introduced India’s first comprehensive framework for data privacy. It requires consent for data processing, establishes rights for individuals, and sets penalties for misuse. However, the Act grants broad exemptions to government agencies, allowing them to bypass consent requirements in the name of national security or public interest. This weakens its effectiveness compared to global standards such as the OECD Privacy Guidelines¹³ or the EU’s GDPR¹⁴, which emphasise independent oversight and minimal exemptions.

Together, these laws illustrate India’s attempt to balance constitutional free speech protections with national security and privacy concerns. Yet the balance remains fragile: judicial interventions, such as the Supreme Court’s decision in Shreya Singhal v Union of India (2015) 5 SCC 1 (SC, India)¹⁵, have struck down overly vague restrictions, while executive regulations continue to expand state control. Looking ahead, India faces new challenges in regulating AI-generated misinformation, deepfakes, and cross-border data flows, which will test whether its framework can evolve to protect both liberty and security in the digital age.

Bangladesh

Bangladesh’s journey in cyber regulation began with the Information and Communication Technology (ICT) Act 2006¹⁶, which was intended to address digital offences but quickly drew criticism for vague language and misuse against journalists and activists. To modernise the framework, the government enacted the Digital Security Act (DSA) 2018¹⁷, consolidating cybercrime provisions and criminalising categories such as “propaganda,” “false information,” and “offensive content.” However, the lack of precise definitions allowed authorities wide discretion, often resulting in suppression of dissent and curtailment of press freedom.

In 2023, the DSA was replaced by the Cyber Security Act (CSA) 2023¹⁸, which expanded state powers significantly. The CSA¹⁹ authorised warrantless searches and seizures, empowered agencies to block or remove online content, and criminalised a broad range of offences including hacking, cyber fraud, and online hate speech. While intended to strengthen national security, these provisions institutionalised surveillance and raised serious concerns about civil liberties.

[Editorial note for author review: independent sources indicate the Cyber Security Act 2023 was repealed on 21 May 2025 and replaced by the Cyber Security Ordinance 2025, rather than amended in place. Please confirm your intended framing — “amendment” versus “repeal and replacement” — before publication, as this changes the legal characterisation of the 2025 development described below.] The framework evolved further with the CSA 2025 amendment, which broadened enforcement powers and gave authorities greater discretion in investigations. This expansion intensified fears of overreach. Responding to criticism, the CSA 2026 amendment narrowed certain provisions, most notably removing Section 20, which had been condemned for its sweeping scope. Although this amendment marked a modest step toward balancing liberty and security, enforcement practices remain heavily tilted toward state control.

Parallel to these developments, Bangladesh introduced the Personal Data Protection Act (PDPA) 2026²⁰, its first comprehensive privacy law. The PDPA requires consent for data collection and processing, establishes penalties for misuse, and grants individuals certain rights. Yet broad state exemptions allow government agencies to bypass consent requirements, undermining the law’s effectiveness. Compared to international standards such as the OECD Privacy Guidelines²¹ or the EU’s GDPR²², Bangladesh’s privacy protections remain weak and heavily subordinated to state interests.

Taken together, Bangladesh’s legal framework reflects a security-centric approach with limited judicial oversight. While the CSA amendments and PDPA 2026 demonstrate attempts to modernise and introduce privacy safeguards, the persistence of vague definitions and state exemptions means that free speech remains vulnerable. Looking ahead, Bangladesh must confront emerging challenges such as AI-driven disinformation, deepfakes, and cyber warfare threats, while ensuring that reforms genuinely protect both liberty and national security.

United Kingdom

The UK blends historic statutes with modern regulation. The Computer Misuse Act 1990²³ criminalised hacking, while the Investigatory Powers Act 2016²⁴ expanded surveillance powers, sparking privacy concerns. The Online Safety Act 2023²⁵ introduced a duty of care for platforms, requiring proactive mitigation of harmful content. Enforcement lies with Ofcom²⁶, an independent regulator, contrasting with India’s executive-centric model. Media oversight is guided by the Ofcom Broadcasting Code, the Defamation Act 2013²⁷, and the Human Rights Act 1998²⁸, ensuring proportionality under the European Convention on Human Rights (ECHR)²⁹. The UK aligns with global norms but faces challenges in AI moderation and avoiding over-blocking.

United States

The U.S. framework is decentralised, anchored in the Computer Fraud and Abuse Act (CFAA) 1986³⁰ and the Electronic Communications Privacy Act (ECPA) 1986³¹. Section 230 of the Communications Decency Act 1996³² shields platforms from liability, fostering innovation but fuelling debates over misinformation. Judicial oversight, exemplified by Reno v ACLU 521 US 844 (1997)³³, reinforces strong First Amendment protections. The FCC regulates broadcast³⁴ but has limited online jurisdiction, reflecting minimal state interference. The U.S. prioritises liberty over regulation³⁵ but must confront algorithmic amplification, AI-driven misinformation, and cyber warfare threats.

Japan

Japan balances privacy and defence. The APPI³⁶ offers robust data protection aligned with OECD and GDPR standards.³⁷ The Unauthorized Computer Access Law (UCAL)³⁸ criminalises hacking³⁹, while the Active Cyber Defence Acts 2025⁴⁰ empower proactive state countermeasures, raising oversight concerns. Media regulation under the Broadcast Law⁴¹ and Telecommunications Business Law⁴² is overseen by the Ministry of Internal Affairs and Communications (MIC), reflecting centralised governance. Japan’s dual model of privacy safeguards alongside proactive cyber defence underscores its technological sophistication but must address cross-border cyber operations and ensure civilian oversight.

B. Case Law Analysis: Judicial Guardianship vs. Executive Overreach

India

The landmark case of Shreya Singhal v Union of India (2015) 5 SCC 1 (SC, India)⁴³ struck down Section 66A of the IT Act, holding that vague restrictions on online speech violated Article 19(1)(a) of the Constitution. This decision reaffirmed the judiciary’s role as a guardian of free speech in the digital age. Yet subsequent challenges to the Intermediary Guidelines 2021⁴⁴ reveal persistent tensions: while courts defend liberty, executive regulations continue to expand surveillance and compliance burdens, creating a fragile equilibrium between rights and regulation.

Bangladesh

Bangladeshi courts have largely upheld prosecutions under the Digital Security Act 2018 and later the Cyber Security Act 2023, often targeting journalists and activists. Cases involving alleged “false information” about COVID-19 demonstrated how broad statutory language can suppress dissent. Unlike India, Bangladesh’s judiciary has not consistently acted as a check on executive overreach, reinforcing a security-centric model. Even with the CSA 2025 and 2026 amendments, judicial passivity remains a defining feature, leaving free speech vulnerable.

United States

In Reno v ACLU 521 US 844 (1997)⁴⁵, the Supreme Court struck down provisions of the Communications Decency Act that restricted indecent speech online, cementing strong First Amendment protections. More recently, debates over Section 230 of the CDA⁴⁶ have reached courts, questioning whether platforms should retain immunity when amplifying harmful content. U.S. jurisprudence illustrates a consistent judicial commitment to liberty, though reform debates highlight the difficulty of balancing innovation with accountability.

United Kingdom

UK courts have applied the Defamation Act 2013 to online speech, carefully balancing reputational rights with free expression. The Online Safety Act 2023, still in its infancy, is expected to face judicial review to test its compatibility with human rights standards under the ECHR. The judiciary’s role will be crucial in ensuring that regulatory duties of care do not evolve into excessive censorship.

Japan

Japanese courts have actively enforced the Unauthorised Computer Access Law (UCAL) against hacking, emphasising deterrence. Cases involving privacy under the APPI highlight Japan’s strong commitment to data protection. However, the Active Cyber Defence Acts 2025 may invite future litigation, as proactive state intrusion into attacker servers raises questions about proportionality and civil liberties.

C. Critical Evaluation

India

India’s framework reflects a duality: strong judicial protection of free speech alongside expansive executive regulation. The IT Rules 2021 impose traceability obligations that threaten privacy, while the DPDP Act 2023 lacks independent oversight. India’s challenge lies in reconciling constitutional protections with regulatory ambitions. Compared to international standards such as the Budapest Convention on Cybercrime⁴⁷, India’s approach remains fragmented, with limited harmonisation across jurisdictions. Future challenges include regulating AI-generated misinformation and ensuring cross-border data flows comply with privacy norms.

Bangladesh

Bangladesh’s cyber regime illustrates the risks of over-securitisation. The Digital Security Act 2018 and Cyber Security Act 2023 criminalised vague categories like “propaganda” and “false information.” The CSA 2025 amendment expanded enforcement powers, enabling warrantless searches and broader surveillance; the CSA 2026 amendment narrowed some over-broad provisions, but enforcement remains heavy-handed. The PDPA 2026 introduced privacy protections, yet broad state exemptions undermine its effectiveness. Bangladesh’s framework diverges from international privacy standards such as the OECD Privacy Guidelines, and without judicial activism, risks chilling journalism and dissent. Looking forward, Bangladesh must address deepfake disinformation and strengthen judicial oversight to align with global norms.

USA

The USA’s reliance on Section 230 CDA fosters innovation and free expression, but critics argue it enables misinformation and harmful content. Calls for reform risk undermining the internet’s open nature. The First Amendment remains a bulwark, but balancing speech with child safety and national security is increasingly complex. Compared to the UN Guiding Principles on Business and Human Rights⁴⁸, the U.S. model prioritises liberty over accountability. Future challenges include regulating algorithmic amplification and addressing cyber warfare threats without eroding constitutional protections.

UK

The UK’s Online Safety Act 2023 represents a proactive regulatory approach, imposing duties of care on platforms. While this enhances accountability, it risks over-regulation and chilling legitimate speech. Ofcom’s role as an independent regulator is a strength, offering a model for India and Bangladesh. However, the UK must ensure compliance with European Convention on Human Rights standards to avoid excessive censorship. Emerging challenges include managing AI-driven content moderation and safeguarding against over-blocking of lawful speech.

Japan

Japan’s framework balances privacy with proactive defence. The APPI ensures strong data protection, while the Active Cyber Defence Acts 2025 empower the state to counter threats. However, proactive defence raises privacy concerns, as government access to attacker servers may infringe individual rights. Japan’s model highlights the trade-off between liberty and security but remains closer to international privacy norms. Future challenges include regulating cross-border cyber operations and ensuring civilian oversight of proactive defence measures.

D. Comparative Perspectives

Across jurisdictions, the balance between free speech and security reveals striking contrasts. India demonstrates judicial activism in protecting liberty but struggles with regulatory overreach, while Bangladesh reflects judicial passivity and a security-centric model despite amendments in 2025 and 2026 and the PDPA 2026. In contrast, the United States prioritises liberty through Section 230 and First Amendment protections, whereas India imposes heavier obligations on platforms. The UK offers a regulator-driven duty-of-care model, standing apart from India’s executive-centric approach, while Japan combines mature privacy safeguards under the APPI with proactive cyber defence, unlike India’s reactive model. Compared globally, Bangladesh’s CSA illustrates over-securitisation, while the USA, UK, and Japan provide more balanced frameworks. Bangladesh could learn from India’s judicial oversight, America’s platform immunity, Britain’s independent regulation, and Japan’s privacy protections to recalibrate its approach toward a healthier equilibrium between liberty and security.

The following table distills these frameworks into a comparative snapshot, highlighting how each country approaches the intersection of media regulation, cyber governance, and the delicate balance between freedom and security.

Conclusion

The comparative study of India, Bangladesh, USA, UK, and Japan reveals that while all nations grapple with the same fundamental challenge — balancing free speech with security imperatives — their responses diverge sharply. India demonstrates strong judicial activism but struggles with executive overreach, while Bangladesh’s framework remains security-centric, with limited judicial oversight despite reforms in 2025 and 2026 and the introduction of the PDPA 2026. The United States prioritises liberty through the First Amendment and Section 230, whereas the UK adopts a regulator-driven duty-of-care model. Japan stands out for its robust privacy protections under the APPI, though its proactive cyber defence raises concerns about state intrusion. Collectively, these experiences highlight that effective governance requires not only legal innovation but also independent oversight and respect for fundamental rights. The lessons drawn here underscore the urgent need for harmonised frameworks that safeguard liberty while addressing the evolving risks of the digital age.

Bibliography

Case Law

Shreya Singhal v Union of India (2015) 5 SCC 1 (SC, India).

Reno v American Civil Liberties Union 521 US 844 (1997, US Supreme Court).

Legislation — India

• Information Technology Act 2000 (India).
• Information Technology (Amendment) Act 2008 (India).
• Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (India).
• Digital Personal Data Protection Act 2023 (India).

Legislation — Bangladesh

• Information and Communication Technology Act 2006 (Bangladesh).
• Digital Security Act 2018 (Bangladesh).
• Cyber Security Act 2023 (Bangladesh).
• Cyber Security Act (Amendment) 2025 (Bangladesh).
• Cyber Security Act (Amendment) 2026 (Bangladesh).
• Personal Data Protection Act 2026 (Bangladesh).

Legislation — United Kingdom

• Computer Misuse Act 1990 (UK).
• Investigatory Powers Act 2016 (UK).
• Online Safety Act 2023 (UK).
• Defamation Act 2013 (UK).
• Human Rights Act 1998 (UK).

Legislation — United States

• Computer Fraud and Abuse Act 1986 (US).
• Electronic Communications Privacy Act 1986 (US).
• Communications Decency Act 1996, s 230 (US).

Legislation — Japan

• Basic Act on Cybersecurity (Japan).
• Act on the Protection of Personal Information (APPI) (Japan).
• Unauthorized Computer Access Law (Japan).
• Active Cyber Defence Acts 2025 (Japan).
• Broadcast Law (Japan).
• Telecommunications Business Law (Japan).

International Instruments and Standards

• Convention on Cybercrime (Budapest Convention), ETS No 185, adopted 23 November 2001, entered into force 1 July 2004.
• Organisation for Economic Co-operation and Development (OECD), OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (OECD, 2013).
• European Union, General Data Protection Regulation (Regulation (EU) 2016/679, adopted 27 April 2016, entered into force 25 May 2018).
• United Nations, Guiding Principles on Business and Human Rights (UN Doc A/HRC/17/31, 21 March 2011).
• European Convention on Human Rights (ECHR), adopted 4 November 1950, entered into force 3 September 1953.

Secondary Sources

Books

• Lawrence Lessig, Code and Other Laws of Cyberspace (Basic Books, 1999).
• Jack Balkin, Cultural Software: A Theory of Ideology (Yale University Press, 1998).

Journal Articles

• Jack Balkin, “Free Speech in the Algorithmic Society” (2018) 51 UC Davis Law Review 1149.
• David Kaye, “Speech Police: The Global Struggle to Govern the Internet” (2019) Columbia Global Reports.

Edited Book Chapters

• David Feldman, “Freedom of Expression” in Jack Beatson and Yvonne Cripps (eds), Freedom under the Law (Oxford University Press, 2000).

Institutional Reports

• United Nations, Guiding Principles on Business and Human Rights (UN Doc A/HRC/17/31, 21 March 2011).
• Organisation for Economic Co-operation and Development (OECD), OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (OECD, 2013).

Note(S):

1. Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (India).

2. Digital Personal Data Protection Act 2023 (India).

3. Information and Communication Technology Act 2006 (Bangladesh).

4. Cyber Security Act (Amendment) 2025 (Bangladesh); Cyber Security Act (Amendment) 2026 (Bangladesh).

5. Personal Data Protection Act 2026 (Bangladesh).

6. US Constitution, Amendment I.

7. Communications Decency Act 1996, s 230 (US).

8. Online Safety Act 2023 (UK).

9. Act on the Protection of Personal Information (Japan).

10. Information Technology Act 2000, s 69A (India).

11. Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (India).

12. Digital Personal Data Protection Act 2023 (India).

13. OECD, OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (OECD, 2013).

14. General Data Protection Regulation (Regulation (EU) 2016/679, adopted 27 April 2016, entered into force 25 May 2018).

15. Shreya Singhal v Union of India (2015) 5 SCC 1 (SC, India).

16. Information and Communication Technology Act 2006 (Bangladesh).

17. Digital Security Act 2018 (Bangladesh).

18. Cyber Security Act 2023 (Bangladesh).

19. Cyber Security Act (Amendment) 2025 (Bangladesh).

20. Personal Data Protection Act 2026 (Bangladesh).

21. General Data Protection Regulation (Regulation (EU) 2016/679, adopted 27 April 2016, entered into force 25 May 2018).

22. OECD, OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (OECD, 2013).

23. Computer Misuse Act 1990 (UK).

24. Investigatory Powers Act 2016 (UK).

25. Online Safety Act 2023 (UK).

26. Ofcom, Broadcasting Code (Ofcom, 2017, updated 2021).

27. Defamation Act 2013 (UK).

28. Human Rights Act 1998 (UK).

29. European Convention on Human Rights (ECHR), adopted 4 November 1950, entered into force 3 September 1953.

30. Computer Fraud and Abuse Act 1986 (US).

31. Electronic Communications Privacy Act 1986 (US).

32. Communications Decency Act 1996, s 230 (US).

33. Reno v American Civil Liberties Union 521 US 844 (1997, US Supreme Court).

34. Federal Communications Commission (FCC), Broadcasting Regulations (FCC, various).

35. US Constitution, Amendment I.

36. Act on the Protection of Personal Information (APPI) (Japan).

37. OECD, OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (OECD, 2013); General Data Protection Regulation (Regulation (EU) 2016/679, adopted 27 April 2016, entered into force 25 May 2018).

38. Unauthorized Computer Access Law (Japan).

39. Unauthorized Computer Access Law (Japan).

40. Active Cyber Defence Acts 2025 (Japan).

41. Broadcast Law (Japan).

42. Telecommunications Business Law (Japan).

43. Shreya Singhal v Union of India (2015) 5 SCC 1 (SC, India).

44. Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (India).

45. Reno v American Civil Liberties Union 521 US 844 (1997, US Supreme Court).

46. Communications Decency Act 1996, s 230 (US).

47. Convention on Cybercrime (Budapest Convention), ETS No 185, adopted 23 November 2001, entered into force 1 July 2004.

48. United Nations, Guiding Principles on Business and Human Rights (UN Doc A/HRC/17/31, 21 March 2011).