Yes, there is need that DPDP Act may have to be tweaked to develop AI models but at the same time, this is an opportunity to regulate AI models so as to ensure that only responsible AI models are launched in the market. Let me start with a layperson’s concept about AI and then come to its legal aspects.
Rajiv Malhotra in his book Artificial Intelligence and the Future of Power (2021, Rupa Publications) explains rudimentary concept of AI in the following words, “Two foundational concepts of AI … are machine learning and big data. Machine learning is the use of diverse experiences to train the algorithms and build models that perform actions considered intelligent. Big data refers to massive data sets – enormous collections of examples – that are used to train machines”. Apparently, AI models need data to evolve themselves as useful tools. Simultaneously, India has put regulatory control over Indian data by enacting Digital Personal Data Protection Act, 2023. This was necessary. Just as Indian wealth cannot be allowed to be drained out of India, Indian data which has its own economic worth, cannot be drained out India.
The law through DPDP Act, 2023 has put an overarching principle that personal data can processed “only in accordance the provisions of this Act and for a lawful purpose … for certain legitimate use.” Mark the word “only”.
The expression “lawful purpose” in Section 4 has been explained to mean “any purpose which is not expressly forbidden by law.” The Act through Section 7 also illustrates “Certain legitimate uses”, which are, (a) specified purpose for which the Data Principal has provides her data, (b) State functions undertaken to perform public services or welfarebenefits, (c) security related functions of the State,
Rajiv Malhotra in his book Artificial Intelligence and the Future of Power (2021, Rupa Publications) explains rudimentary concept of AI in the following words, “Two foundational concepts of AI … are machine learning and big data. Machine learning is the use of diverse experiences to train the algorithms and build models that perform actions considered intelligent. Big data refers to massive data sets – enormous collections of examples – that are used to train machines”. Apparently, AI models need data to evolve themselves as useful tools. Simultaneously, India has put regulatory control over Indian data by enacting Digital Personal Data Protection Act, 2023. This was necessary. Just as Indian wealth cannot be allowed to be drained out of India, Indian data which has its own economic worth, cannot be drained out India.
The law through DPDP Act, 2023 has put an overarching principle that personal data can processed “only in accordance the provisions of this Act and for a lawful purpose … for certain legitimate use.” Mark the word “only”.
The expression “lawful purpose” in Section 4 has been explained to mean “any purpose which is not expressly forbidden by law.” The Act through Section 7 also illustrates “Certain legitimate uses”, which are, (a) specified purpose for which the Data Principal has provides her data, (b) State functions undertaken to perform public services or welfarebenefits, (c) security related functions of the State,
(d) compulsory disclosure of personal information for the purpose such as census operation, (e) judicial order, (f) medical emergency in individual cases, (g) urgent response required in case of health emergency at mass level, (h) any other disaster or breakdown of health disaster, and (i) corporate confidentiality needed to protect business interests.
The above list is fairly elaborate but it is not clear to me whether it is to be treated as exhaustive or illustrative because, as stated above, the marginal note of Section 7 uses the word “Certain” which implies that there can be other uses also which might be legitimate. But use of data for developing AI models does not squarely fit into any of uses specifically described in Section 7. My reading of the law is that AI developers cannot use personal data as a matter of course. They need permission.
Another important provision in the DPDP Act is Section 10 which places additional obligations on Significant Data Fiduciary, depending on (a) volume and sensitivity of personal data processed, (b) risk to the rights of Data Principal, (c) potential impact on sovereignty and integrity of India, (d) risk to electoral democracy, (e) security of the State, and (f) public order. These are the safeguards to prevent potential damages at mass level.
My view is that AI is a technology which is both boon as well as bane. It can turn out to be risky also. Section 10 can be one of the tools in the hands of the Government to put some regulatory control over irresponsible development of AI models. Section 10 is only a partial measure but otherwise regulation of AI calls for full-fledged legislation just as it has been done for the other risky technologies like locomotives, automobiles, aircrafts, nuclear power, and certain medical technologies. The purpose is that it subserves common good.
The above list is fairly elaborate but it is not clear to me whether it is to be treated as exhaustive or illustrative because, as stated above, the marginal note of Section 7 uses the word “Certain” which implies that there can be other uses also which might be legitimate. But use of data for developing AI models does not squarely fit into any of uses specifically described in Section 7. My reading of the law is that AI developers cannot use personal data as a matter of course. They need permission.
Another important provision in the DPDP Act is Section 10 which places additional obligations on Significant Data Fiduciary, depending on (a) volume and sensitivity of personal data processed, (b) risk to the rights of Data Principal, (c) potential impact on sovereignty and integrity of India, (d) risk to electoral democracy, (e) security of the State, and (f) public order. These are the safeguards to prevent potential damages at mass level.
My view is that AI is a technology which is both boon as well as bane. It can turn out to be risky also. Section 10 can be one of the tools in the hands of the Government to put some regulatory control over irresponsible development of AI models. Section 10 is only a partial measure but otherwise regulation of AI calls for full-fledged legislation just as it has been done for the other risky technologies like locomotives, automobiles, aircrafts, nuclear power, and certain medical technologies. The purpose is that it subserves common good.
Click here for PDF download