The Future of AI: Legal Challenges in the Era of the Digital Personal Data Protection Act of 2023

Artificial intelligence (AI) is changing the world in unprecedented ways. From healthcare to education, entertainment to e-commerce, AI is creating new possibilities and opportunities for innovation and growth. But AI also poses significant challenges to data privacy because it often relies on the collection, processing, and analysis of vast amounts of personal data.

Personal data is any information associated with an identified or identifiable individual, such as name, email, location, biometrics, health records, preferences, behavior, etc. Data privacy is an individual's right to control how their data is used and shared by others, and to protect it from unauthorized access, misuse, or harm.

As organizations increasingly adopt AI systems, they will find themselves at the crossroads of innovation and regulation, struggling to balance technological advancements with stringent Indian data privacy laws, namely the Digital Personal Data Protection Act, 2023 (DPDPA).

The DPDPA imposes various requirements and restrictions on how companies can collect, process, store, transfer and disclose personal data, and also grants data subjects, or individuals, certain rights, such as the right to access, correct or delete their data.

AI systems thrive on data: they learn, evolve, and improve by analyzing vast amounts of information, including personal data. This reliance on data is inherently at odds with the Personal Data Protection Act, which was enacted to protect individual privacy. While the DPDPA aims to ensure that personal data is used in a fair, transparent, and lawful manner, it also poses significant challenges for companies that want to harness the potential of AI.

AI often involves complex, automated and opaque data processing activities that may be incompatible with the principles and obligations of the Personal Data Protection Act. The DPDPA imposes strict limitations on how personal data can be collected, processed and stored, which may be at odds with the data-intensive nature of AI.

The main challenges that businesses may face in complying with the DPDPA when using personal data for AI processing purposes include:

Lack of transparency

One of the core principles of the DPDPA is transparency: organizations must inform individuals in clear and plain language how their data is being processed. However, many AI systems, especially those based on deep learning, operate as “black boxes,” making it difficult to clearly explain their processing and decision-making processes.

For the processing of personal data to be lawful, companies need to provide data subjects with clear and comprehensive information about the nature, scope and purposes of the processing, as well as the potential risks and benefits of AI, in clear, plain language, in a concise, understandable and easily accessible manner – no easy task and providing the required level of transparency may prove difficult.

Data Minimization Requirements

The DPDPA advocates for data minimization, meaning that organizations should only collect and use the personal data necessary for a specific purpose. On the other hand, AI often requires large datasets to function effectively and to enhance its learning and predictive capabilities, creating friction between the need to minimize the collection of personal data and the desire to harness the power of big data.

Striking a balance between collecting enough data for AI capabilities and adhering to the principle of data minimization is a big challenge. Organizations need to clearly define and limit the scope of data collection that could hinder the effectiveness of AI models.

Consent and Purpose Limitation

One of the main challenges companies face when using personal data for AI processing is obtaining valid consent from data subjects. Under the DPDPA, consent is the primary legal basis or lawful purpose of processing personal data, meaning that the data subject has given their informed, specific and free consent to the processing.

Obtaining explicit consent for data use and ensuring personal data is only used for specified purposes are fundamental aspects of the DPDPA. AI applications frequently involve the use of secondary data, where data collected for one purpose is reused for another, often without the data subject's explicit consent.

This is a concern under the DPDPA because companies can only use data for purposes for which consent was originally obtained. Additionally, AI often involves complex, dynamic, and unpredictable data processing activities that cannot be fully understood or predicted by data subjects or the data trustees themselves.

Additionally, the DPDPA provisions require companies to seek separate consent for specific purposes. So, if an individual's personal data needs to be processed for AI purposes, companies may be required to seek separate, specific consent. Blanket or pre-checked consent for multiple or unrelated purposes may not be permitted under the DPDPA. Seeking such specific consent may prove difficult.

Data Security and Confidentiality

Another challenge companies may face when using personal data for AI is data security and confidentiality, which are essential for the trust and confidence of data subjects and data trustees as they impact the protection and storage of personal data.

Data security and confidentiality are also important for compliance and responsibility for personal data processing because they impact the prevention and mitigation of personal data leaks and data incidents. However, data security and confidentiality for AI is not always easy or effective because AI often involves complex, distributed, and interconnected data processing activities that may not be secure or confidential. For example, AI may require large and diverse datasets that may not be encrypted, anonymized, or pseudonymized, may perform data processing that may not be authorized, authenticated, or audited, or may produce results that are not encrypted, anonymized, or pseudonymized.

The DPDPA requires companies to implement appropriate technical and organizational measures and reasonable security safeguards to protect personal data. To mitigate privacy risks, companies often turn to anonymization and pseudonymization of data. While these techniques help protect personal data, they can also hinder the effectiveness of AI systems. Anonymized data can lose detailed information that AI algorithms need to make accurate predictions, leading to a trade-off between privacy and performance.

Data Subject Rights

The DPDPA gives individuals the right to access their data, request correction, and request deletion of their data (right to be forgotten). Implementing these rights in AI systems can be technically complex. Continuously learning AI models that adapt based on new data can make it difficult to accurately delete or correct data without compromising the integrity of the model. Failure to honor access and erasure requests can lead to legal non-compliance and significant operational challenges.

The DPDPA requires organizations to delete personal data when the purpose for which it was collected is no longer fulfilled or when the data subject withdraws consent. Therefore, a short retention period may impact the performance of AI and machine learning technologies, while a long retention period may violate the provisions of the DPDPA.

Continuous Compliance and Adaptation

The regulatory environment can be dynamic with evolving guidelines, case law, and new best practices. Organizations need to stay on top of changes in personal data protection laws and continually adapt their AI systems to remain compliant. This requires ongoing investment in compliance tools, regular training of staff, and close collaboration with legal and regulatory experts to navigate the complex intersection of AI and the DPDPA.

Conclusion

Artificial intelligence and data privacy are two of the most important and influential topics in the modern world. They pose significant opportunities and challenges for companies that want to process personal data for AI purposes or applications. Companies need to find a balance between the benefits of AI and the risks to data privacy, and adopt a proactive and responsible approach to ensure that their AI systems comply with personal data protection laws and respect the rights and expectations of data subjects.