• UGI USER
  • Sep 27, 2023
  • 17 Likes
  • 0 Comments

AI and data privacy law

Relevance

  • GS 2: Government Policies and Interventions for Development in various sectors and Issues arising out of their Design and Implementation.
  • Tags: #DataProtection #AIRegulation #PrivacyLaws #IndiaTech #DPDPAct #DataPrivacy #AIChallenges #Cybersecurity #DataEncryption #UPSC #CurrentAffairs #MintEditorial.

Why in the News?

The Digital Personal Data Protection (DPDP) Act of 2023 in India has significant implications for AI operations and data privacy. Balancing innovation and data protection is crucial.

Digital Personal Data Protection Act (DPDP) 2023

The law mandates AI systems to secure explicit user consent before data processing.

  • It requires AI systems to provide comprehensive multilingual notices to users.
  • The law enforces adherence to predefined data usage objectives, reducing indiscriminate data scraping.
  • These changes hold profound implications for the AI ecosystem, reshaping data access for training and development.

Understanding AI Data Acquisition and DPDP Impact

AI-driven enterprises employ multifaceted data acquisition processes, including personal data, from various sources.

  • This repository encompasses data from both user interactions and developers using open-source datasets to refine AI models.
  • AI in Healthcare: Take AI-based healthcare diagnostics, where patient data has been a valuable resource for effective outcomes.
  • Pre-DPDP Era: Before the DPDP Act, AI systems accessed patient data with fewer consent requirements, enhancing medical diagnosis.
  • Post-DPDP Impact: The DPDP Act now enforces strict consent and data handling norms, affecting AI’s access to patient records and impacting model training.

Impact of DPDP Act on Data Management and AI Operations in India

Reevaluation of Data Training Procedures

  • Mandated reevaluation of processes for training AI algorithms on personal data.
  • Requires strict adherence to specified data usage purposes, discouraging indiscriminate data mining.

Comprehensive Notices

  • AI systems must provide detailed notices in English and all official Indian languages.
  • Notices clarify precise intentions behind data processing, enhancing transparency.

Consent as a Cornerstone

  • Consent becomes a central element of data protection under the Act.
  • Demands unequivocal affirmative actions for consent and strict alignment with stated purposes, preventing unauthorized data diversions.

Verbal Consent for Minors

  • AI systems obligated to obtain verbal consent from parents or guardians for individuals under 18.
  • This hinders AI’s ability to use children’s data without explicit consent.

Age Threshold Consideration

  • The Act sets the age threshold at 18, which may not align with evolving technology landscapes and children’s maturity levels.

Balancing Child Safety and Engagement

  • Urges the need for a balanced approach, protecting children’s data while enabling responsible digital engagement.
  • Suggests potential adjustments to the age threshold, robust digital literacy and responsible online behavior initiatives.

Revisions in Data Usage: DPDP Act’s Impact on AI Handling

  • Shift from “Deemed Consent” to “Legitimate Uses”: The DPDP Act replaces the concept of “deemed consent” with “legitimate uses” for data processing.
  • Narrowed Definition: The Act narrows the definition of legitimate uses by removing “fair and reasonable purposes” and “public interest” grounds.
  • Implicit Consent: When information is willingly submitted and the data principal does not expressly object, data processing without explicit consent is permitted, enabling situations like the sharing of information for services.
  • Specified Legitimate Uses: The Act outlines legitimate uses, including state functions, state safeguarding, providing benefits, legal obligations, health emergencies, disasters, and employer requirements for employee data.

Comparison with GDPR

  • Unlike the GDPR, India’s DPDP Act lacks provisions for “performance of a contract” or “legitimate interests” as legal bases for data processing.
  • These omissions in Indian law may impact how AI systems handle data in India.
  • In the GDPR, these provisions offer flexibility in data processing for contractual obligations and legitimate purposes while ensuring data subject interests are upheld.
  • The DPDP Act in India changes how data can be used by focusing on “legitimate uses,” which is different from the GDPR’s rules.
  • However, it doesn’t have provisions for situations where data is needed for contracts (Performance of a contract) or when there’s a good reason. This could affect how AI systems operate in India.

Challenges for AI Systems under DPDP Act

  • Contract-Related Activities: AI systems relying on data for contracts may struggle with compliance. The absence of “performance-of-contract” as a legal basis may require explicit consent for every data use, potentially impacting user experience.
  • Reevaluating Data Processing: AI applications using data for “legitimate” purposes may need to reevaluate practices. Without a specific “legitimate interests” provision, they may face hurdles in responding quickly to business needs.
  • Deviation from Global Norms: The DPDP Act differs from global data protection norms, potentially necessitating adjustments in how AI systems operate in India and hindering their growth in the country.
  • Cybersecurity Concerns: While the Act emphasizes data handling, consent, and legitimate data use, it lacks a comprehensive framework for addressing cybersecurity and data breach prevention.
  • Need for Cybersecurity Provisions: In the face of growing data breaches and cyber risks in the digital age, precise requirements and standards relating to data encryption and safeguards against illegal data mining are crucial.

Balancing Data Protection and Innovation in India

  • Innovation and Data Protection: Innovation is essential for AI’s potential but must be balanced with data protection to prevent privacy breaches and data mishandling.
  • Unchecked Innovation Risks: Unregulated innovation can unknowingly lead to privacy breaches and data mismanagement.
  • Risk-Based AI Frameworks: Implementing risk-based AI frameworks is crucial. These frameworks can identify and mitigate potential risks in AI applications, promoting responsible and ethical innovation.
  • Ensuring Responsible Innovation: Risk-based frameworks help ensure that innovation proceeds while safeguarding individual privacy and data integrity, striking a balance in the evolving AI landscape.

Unlocking AI’s Potential in India

AI can revolutionize industries, enhance efficiency, and improve lives, representing the next frontier in technology. India should consider revisiting DPDP Act provisions to enable effective AI operation while safeguarding data privacy.

India must provide an atmosphere that fosters innovation and avoid unintentionally hindering the development of future technologies like AI. Striking a balance between data privacy and innovation is crucial to keep India at the forefront of global technological advancements. Realizing AI’s Full Potential: By doing so, India can harness AI’s full potential, fostering growth and progress in the country.

General Data Protection Regulation (GDPR)

· GDPR is a comprehensive data protection regulation enforced across the European Union (EU) and the European Economic Area (EEA) since May 25, 2018.

· It grants individuals increased control over their personal data, including the right to access, rectify, and erase their data.

· Data Processing Rules: Organizations must ensure lawful, transparent, and limited processing of personal data and adhere to principles of data protection by design and by default.

· Accountability and Penalties: GDPR imposes strict accountability requirements on data controllers and processors, with severe fines for non-compliance.

· Cross-Border Data Transfer: It facilitates data transfers between EU/EEA countries and third countries through mechanisms like Standard Contractual Clauses (SCCs).

· Data Protection Officers: Certain organizations must appoint Data Protection Officers to oversee compliance.

· Notification of Data Breaches: GDPR mandates timely reporting of data breaches to supervisory authorities and affected individuals.

· Consent: Organizations must obtain clear and informed consent for data processing, with the ability for individuals to withdraw consent.

· Privacy Impact Assessments: Conducting assessments for high-risk processing activities is required.

· Global Impact: GDPR’s influence extends beyond the EU, impacting organizations worldwide that process EU residents’ data.

Source: Livemint

Mains Question

Discuss the significance of the Digital Personal Data Protection (DPDP) Act of 2023 in the context of data governance in India. How the DPDP Act mandates changes in the operational mechanisms of AI systems in India?