Safeguarding the Right to Privacy in the Age of Artificial Intelligence

GS-II: Indian Constitution, Fundamental Rights, Right to Privacy, Governance

GS-III: Science and Technology, Artificial Intelligence, Cybersecurity, Data Protection

Introduction

• In 2017, the Supreme Court ruled that a person has a right to privacy under the Constitution.
• The existing legal protections for this right appear to be insufficient, particularly when viewed in the context of the global technological transformation driven by Artificial Intelligence (AI).

Privacy Coverage: Gaps in the Existing Legal Framework

• AI Regulation: Today, AI regulation is among the most often-talked-about topics for governments. However, as of yet, recommendations are general, unclear, and have created many more concerns.
• Potential of Artificial Intelligence: The Potential of Artificial Intelligence (AI) to enhance productivity and positively impact the quality of life for individuals is great.
• Impact of Sweeping Regulations: Any sweeping regulations or policies that are implemented without consideration will potentially hinder the development of innovative solutions and ultimately limit the ability to expand the economy.
• Need for Specific Areas of Reform: Specific areas can be addressed to improve protection of people’s constitutional rights and still allow the U.S. to compete in the AI race.
• Digital Personal Data Protection (DPDP) Act, 2023: This Act was enacted in 2023, and the DPDP Rules were issued in November 2025.
• Phased Implementation: Phased implementation of some of the provisions regarding consent and safety will not be effective until 2027.
• Earlier Legal Framework: Prior to the DPDP Act, the most relevant legal tool used to control and administer the use of individual’s private information was the Information Technology (IT) Act, 2000.

IT Act, 2000 and 2011 Rules

• Restriction on Export of Sensitive Personal Data: The Export of Sensitive Personal Data is generally restricted, as long as the recipient has provided an adequate degree of Data Protection in accordance with Indian Law.
• Conditions for Data Transfer: The data transfer was required to fulfill a valid legal agreement or was approved by the individual providing the data.
• Recording Adequacy: An assertion and claim were sufficient to record adequacy.
• Penalties for Unauthorized Disclosure: The maximum sentence of imprisonment that can be imposed as a criminal sanction for unauthorized disclosure is three years, and the maximum monetary penalty is ₹500,000.

Limitations of Earlier Rules

• Limited Coverage of Sensitive Data: The penalties apply only to those categories of sensitive personal data that are included on the Rules list (e.g., credit card number, financial, doctor visit, medical, health, sexual preference, orientation, fingerprint, biometrics).
• Exclusion of Other Personal Data: The Rules were inapplicable to personal data including but not limited to name, address, phone number, caste, religion, political affiliation, browsing history, social media usage, online and offline behaviors and institution affiliation.
• Public Data Scraping: The public scraping of data (e.g. social media) was not included in this policy either.

Use of Personal Data by Technology Companies

• India’s Digital Market: India is the largest market for Facebook and Instagram in the world.
• Use of User-Generated Data: Meta, Amazon, and Google are examples of major tech companies that utilize user-generated data to train artificial intelligence (AI) systems.

DPDP Act: Limitations in Protecting Sensitive Personal Data

• Publicly Accessible Information: The DPDP Act does not cover publicly accessible information or information obtained from a user’s publicly available parameter data (e.g., social media usage) like name, gender, sex, location, organization, image, video, etc.
• Inferred Data: This type of data may include emotional states, mobility patterns and behavioral tendencies.
• Absence of Data Categorisation: The Act does not separate personal data into categories, including sensitive personal data, similar to what the IT Act of 2000 did.
• Uniform Treatment of Data: All types of data, regardless of how they may seem (i.e. sensitive) will be grouped into the same category as other types of data (i.e. non-sensitive).
• Examples of Data: Therefore, data such as passwords, mental health issues, physical health issues, etc., will be grouped with data like name, marital status, city, shopping habits, etc.
• Regressive Approach to Privacy Protection: The DPDP Act seems to have a regressive approach to the protection of individual’s privacy. In particular, the DPDP Act does not provide more significant protections for those categories of information that were provided with higher levels of protection under previous laws.
• Misuse Risk: Personal data, which is non-sensitive, could disclose sensitive information about individuals if the data was collected under specific circumstances and analyzed with other variables.
• Need for Higher Protection: Higher levels of protection are needed for some types of data which can be used to infringe on an individual’s privacy directly, such as biometric information or passwords.

Training AI on Personal Data: Emerging Privacy Concerns

• No Specific Provisions: The DPDP Act does not mention nor discuss AI models and how they are trained using data.
• Reproduction of Training Data: One of the biggest concerns about how artificial intelligence (AI) models affect your personal information is that the same data that was used to train the AI model can be reproduced by the AI model.

Identification Through Anonymised Data

• Retrieval of Personal Information: Studies that are considered reliable show that if you provide an AI model with anonymous data, you may be able to retrieve the personal information the AI model remembers from when it was being trained.
• Identification and Profiling: This can be used to identify individuals and build their profiles.
• Extraction of Sensitive Information: Studies have also shown that different ways of extracting sensitive information about people can occur using generic public information through AI.
• Individual Privacy Risk: An AI model that used an individual’s data for training purposes may have had its training data converted into an anonymized dataset which is now legally compliant. However, this compliant dataset can still be used to obtain the individual’s personal information and create a profile of them without their permission.

Consent and Right to Object: Gaps in User Protection

• Lack of Earlier Right to Object: The Indian user does not have an earlier right or legal process to stop his or her data from being used to train AI.
• Delayed Consent Provisions: Companies do not have to fully comply with and obtain consent for their data processing needs until the DPDP consent provision goes into effect in 2024.
• Lack of Right to Oppose: Even once all substantive portions of the DPDP Act come into effect by May 2027, Indian users will not be able to oppose the training of AI models using their public data.

International Comparison – European Union

• Opt-Out Feature: Meta currently provides its users in the EU an opt-out feature.
• Right to Object: This allows users to object to their data being used in Meta’s AI training.

Right to Be Forgotten: Limitations under the DPDP Act

• Limitation of Applicability: Under the DPDP Act, the “right to be forgotten” is limited to those organizations who were granted access to the users’ personal data by the users.
• Unclear Scope: Whether the right extends to information derived from an analysis of the data is unclear.
• Research Exemption: The DPDP Act also allows an exemption to the right to process data for research, archive, or statistical purposes.
• Unclear Conditions: The conditions to be met for an exemption to apply have yet to be defined by the union government.
• AI Training and Research Exemption: This exemption applies to whether AI models can be trained on data from users. It’s unclear whether companies are using the training of these models as a way to enhance their services, which would then qualify as research under this exemption.
• Potential Risk: This could lead to a way for the same type of processing to avoid being bound by the Act.

Way Forward:

• Amendments to the DPDP Act: Amendments to the DPDP Act may help address the gaps identified.
• Protection of AI Training Data: The provisions of the DPDP Act must apply to data being used to train AI models.
• Right to Object to AI Training: Provide people with the ability to object to the use of their data for AI training.
• Protection of Publicly Collected Data: Implement protective measures for the use of data collected from the public, as well as any inferences made based on this data.
• Enhancing the Right to Erasure: The Right to Erasure should be enhanced so that it is the responsibility of businesses to notify individuals about each organization which has access to the individual’s personal information.
• Clarifying the Research Exemption: Clarify if the use of Artificial Intelligence (AI) for training purposes falls within the scope of the research exemption.
• Sensitive Data Category: Create an additional sensitive data category that includes more stringent requirements for how it is processed and used.
• Development vs. Privacy Trade-Offs: The balance between developing software, systems, applications and protecting user privacy is a constant struggle. Trade-offs exist, and how much a product develops or adopts privacy protection will be based upon what is considered more important to the developers.
• Avoiding Blanket Restrictions on AI: It would be a mistake to restrict data exports, nor should personal information be banned from AI training. This approach will only lead to further negative impacts on AI performance regarding inclusion, efficiency, discrimination, and bias toward the Indian population.

Conclusion:

• Public Concerns: The concerns of the people about this issue are not urgent. The concerns of the people about this issue have been documented, acknowledged, and recognized by both business organizations and government agencies.
• India as a Data Exporter: There are many different perspectives on how India can become a data exporter for AI training.
• Growing Application of AI: India will be a major center for the application of AI, as big businesses, small to medium-sized enterprises (SMEs), and non-governmental organizations are utilizing it in various industries.
• Need for Timely Action: The longer India takes to resolve the issues of lack of privacy protections, the less effective will be the constitutional rights of individuals.

UPSC Mains Practice Question

Q. The growing influence of artificial intelligence in today’s world is presenting a number of new threats to individuals’ right to privacy in India. In this context, discuss some of the shortcomings of the Digital Personal Data Protection Act, 2023, and provide suggestions on how to improve the state of data protection in India while not stifling the growth of technology.