How AI Training Models Could Compromise Privacy, Pg6

Key Highlights:

• The Supreme Court of India upheld the right to privacy as a constitutional right in 2017.
• The Digital Personal Data Protection (DPDP) Act, 2023, along with its rules notified in November 2025, is India's current legal framework for data protection.
• Key provisions of the DPDP Act related to consent and safety are being implemented in phases, with some becoming effective only in May 2027.
• The DPDP Act does not explicitly address the use of data for training Artificial Intelligence (AI) models, nor does it create a specific category for sensitive personal data, unlike the previous IT Act, 2000.
• AI models can potentially reveal personal details from "anonymised" training data, posing a significant privacy risk.
• Indian users currently lack a legal mechanism to object to their public data being used for AI training, a right available to users in the EU.

Data Protection.jpg

Detailed Insights:

• The DPDP Act, 2023 replaced the Information Technology (IT) Act, 2000, and its 2011 Rules, which previously regulated personal data, primarily focusing on "sensitive personal data".
• Under the IT Act, 2000, "sensitive personal data" included categories like financial data, medical details, and biometric information, with criminal penalties for unauthorized disclosure.
• The DPDP Act treats all personal data uniformly, without a distinct category for sensitive data, which critics argue may dilute protection for highly sensitive information like passwords or health conditions.
• The Act does not apply to publicly available data or information inferred from public sources like social media activity, which can include emotions, mobility, and behavioral patterns.
• Studies indicate that AI models can "regurgitate" training data, allowing the extraction of personal details even from supposedly anonymized datasets.
• The "right to be forgotten" under the DPDP Act is limited to data for which the user provided consent and does not clearly extend to inferred information or data processed for research exemptions.
• The ambiguity regarding whether AI model training falls under the "research, archival, or statistical purposes" exemption could allow such processing to bypass the Act's obligations.
• Amendments are suggested to the DPDP Act to include AI training data, provide a right to object to its use, and strengthen protections for publicly scraped and inferred data.

Key Concepts Involved:

• Right to Privacy: A fundamental constitutional right in India, affirmed by the Supreme Court in 2017.
• Digital Personal Data Protection (DPDP) Act, 2023: India's comprehensive law governing the processing of digital personal data.
• Information Technology (IT) Act, 2000: The previous primary legislation in India dealing with cybercrime and electronic commerce, which also contained provisions for data protection.
• Sensitive Personal Data: Specific categories of personal data that, if compromised, can cause significant harm to an individual, often requiring higher levels of protection.
• Right to be Forgotten: The right of individuals to request the erasure or delisting of their personal data under certain conditions.