Deciphering The Data Dilemma - Regulating Artificial Intelligence Under Data Protection Law
Author: LawSphereX
Category: Technology, Cyber & Privacy
Published:
Updated:
DECIPHERING THE DATA DILEMMA: REGULATING
ARTIFICIAL INTELLIGENCE UNDER DATA PROTECTION LAW Amit Raghuwanshi, Lloyd Law College, Greater Noida Aditya Gupta, Lloyd Law College, Greater Noida
ABSTRACT
This essay seeks to demonstrate intricate interplay between Artificial Intelligence and data protection regulations, with a specific focus on how India's recently enacted Digital Personal Data Protection Act of 2023 impacts the development and use of Artificial Intelligence in the country. It also aims to examine the challenges posed by Artificial Intelligence to data privacy, encompassing issues such as automated decision-making, notice and consent mechanisms, transparency, and the Right to be forgotten. Moreover, it highlights the limitations of the Digital Personal Data Protection in adequately addressing these challenges, urging for a more robust framework that ensures accountability and safeguards against potential harm. Centre to the debate is the necessity for data Fiduciaries to assume greater responsibility in the field of Artificial Intelligence technologies.
The essay underlines the importance of conducting thorough Data Protection Impact Assessments for Artificial Intelligence systems, emphasising the need to alleviate risks such as bias and data misuse. It advocates for a comprehensive approach that balances the vitality of data privacy with the need for technological advancement, recognizing the critical role of effective regulation in achieving this equilibrium. This can be elaborated through the call for a harmonious integration of data protection principles with the development and deployment of Artificial Intelligence technologies. It emphasises the need to rectify legal frameworks with technological advancements to ensure that the Rights of individuals are protected in the rapidly evolving digital landscape, while also fostering innovation and progress for the betterment of society.
I.
INTRODUCTION
In our ever-evolving world, human ingenuity knows no bounds. At the heart of this progress lies Artificial Intelligence, a driving force behind innovation. However, the real magic lies in effective regulation, ensuring that AI's boundless potential can be harnessed while safeguarding privacy and ethics. The global AI market hit 36. 55 billion in 2022! It's expected to grow at an incredible 37. 3% annually from 2023 to 2030, reaching a staggering ,811. 8 billion by 2030! 1 Similar to the revolutionary impact of the steam engine or electricity in history, AI is reshaping our world, society, and industries. 2 Artificial intelligence has the potential to encompass a broad range of technologies. The term “artificial intelligence” (hereinafter referred as ‘AI’) describes the broad goal of empowering “computer systems to perform tasks that normally require human intelligence.
”3 Artificial intelligence can replicate specific functions of the human mind, such as problem-solving and language interactions. 4 AI operates by blending vast amounts of data with intelligent algorithms, allowing the software to learn from patterns. 5 Like any tool, AI can be wielded for beneficial and malicious purposes. However, alongside these opportunities lie significant challenges and potential pitfalls, including ensuring safety, establishing clear liability, safeguarding data privacy, shoring up security measures, mitigating bias, and preventing discrimination. Data protection law regulates personal data processing to safeguard informational privacy, recognized as a fundamental Right in the Indian Constitution. 6 Data protection is gaining significance and India has enacted comprehensive legislation on data protection7.
Previously, the committee of experts on a data protection framework for India, led by Justice B. N. 1Rashi Maheshwari and Aashika Jain, ‘Top AI Statistics and Trends’, (Forbes Advisor, 2024) updated 6 February, 2024.
2 European Commission, Artificial Intelligence for Europe (Com No 237 final, 2018).
3 English Oxford Living Dictionaries, "Artificial Intelligence"
accessed 29 April 2024.
4 Xianhong Hu, Bhanu Neupane, Prateek Sibal, and others, Steering AI and advanced ICTs for knowledge
societies: a Rights, Openness, Access, and Multi-stakeholder Perspective (1st edn, UNESCO Series on Internet Freedom, 2019). 5 Ananya Mohapatra, ‘Artificial Intelligence and Privacy of Digital Consumers’ (2020) 24 (10) SUPREMO AMICUS accessed 27 April, 2024.
6 Justice K.S. Puttaswamy & Anr. v Union of India AIR 2017 SC 4161.
7 The Digital Personal Data Protection Act 2023.
Srikrishna, laid out a robust data protection regime in his report. 8 The proposal came with a draft of data protection legislation known as the Personal Data Protection Bill, 2018 (hereinafter referred as ‘PDP Bill, 2018’). 9 The PDP Bill, 2018 underwent revisions and was presented to Parliament with significant changes as the Personal Data Protection Bill, 2019 (PDP Bill, 2019). 10 The PDP Bill, 2019 was referred to a Joint Parliamentary Committee (JPC) for its recommendations. 11. Following this, the JPC issued its report and suggested the Data Protection Bill, 2021 by amending the PDP Bill, 2019. Subsequently, a new draft data protection framework emerged, known as the Digital Personal Data Protection Bill, 2022. 12 was released for public comment as mandated by the pre-legislative consultation process.
Finally, an updated version of the Digital Personal Data Protection Bill, 2022 has become law in India and is titled the Digital Personal Data Protection Act, 202313 (hereinafter the act or DPDP). Within the mesmerising realm of artificial intelligence lies a profound truth: while its potential knows no bounds, safeguarding our privacy demands a vigilant interplay of innovation and regulation. II.
PERSONAL DATA AND DATA PRIVACY IN THE TECHNOLOGICAL
WORLD OF A.I.
Privacy is defined as an individual's Rightful claim to decide how much they want to share their data and to have control over when, where, and how they communicate with others. In essence, it entails the Right to withdraw or participate as one chooses. It also involves the individual's Right to manage the spread of information about themselves; essentially, it's their personal possession. Technological advancements enable intrusion on privacy by both state and non-state actors through surveillance, profiling, and data processing, often justified for counter- 8 Ministry of Electronics and Information Technology, Justice B.N. Srikrishna Report, ‘A Free and Fair Digital Economy Protecting Privacy, Empowering Indians’ accessed on 11 April, 2024.
9 The Personal Data Protection Bill (2018).
10 Anurag Vaishnav, ‘The Personal Data Protection Bill, 2019
How it differs from the draft Bill’, accessed 27 April 2024. 11Lok Sabha Report, The Joint Committee on the Personal Data Protection Bill, 2019 (16 December 2021).
12 Personal Data Protection Bill (2022) (India).
13 Digital Personal Data Protection Act (2023) (India).
terrorism and public safety. Ambiguity in the law arises regarding whether profiling inferences qualify as personal data. AI uses available data for profiling, a process that involves drawing conclusions to potentially identify individuals. 14 For example, in distribution channels, there are producers, distributors, and consumers, while aggregators like Amazon, Uber, and Swiggy play a significant role. Aggregators are online platforms that consolidate multiple service providers under a single brand, such as Amazon or Uber. 15 They gather consumer data to provide intent-based marketing, customising products according to individual interests and browsing habits. This approach, facilitated by AI, facilitates rapid delivery and broadens the consumer base, albeit raising privacy concerns.
16 Data privacy, also known as "information privacy," is the principle advocating that individuals should have authority over their data, encompassing the capacity to dictate how organisations gather, store, and utilise their information. 17In the era of AI, safeguarding informational privacy encounters complex hurdles due to the intrinsic traits of information, exhibiting three fundamental attributes: it is non-rivalrous, imperceptible, and recombinant. 18 Invisible information refers to data privacy invasions that are challenging to detect because AI often operates using "black-box" algorithms. ,19 This opacity can arise from machine-learning techniques that are not interpretable. 20 Indeed, these techniques can be highly complex, making them challenging for us to fully grasp. Consequently, information may be accessed, stored, and disseminated without detection.
Moreover, its capability to move at the speed of light further enhances the invisibility of data access, leading to the notion that "information collection can be the swiftest theft of all. "21 14 Giovanni Sartor, The impact on General Data Protection Regulation (GDPR) on artificial intelligence (STOA, June 2020). 15 Ashok Vashist, ‘The Aggregator model- rise, challenges, and scope of this approach in India’ First Post, (New Delhi, 3 January 2017). 16 Anurag Vaishnav, ‘The Personal Data Protection Bill, 2019: How it differs from the draft Bill’ PRS accessed 27 April, 2024.
17 Matthew Kosinski and Amber Forrest, ‘What is Data Privacy?’[2023] IBM accessed 4 May 2024.
18 Christina P. Moniodis, ‘Moving from Nixon to NASA
Privacy's Second Strand — A Right to Informational Privacy’ (2012) 15 (1) YJoLT. accessed 4 May 2024. 19 Yavar Bathaee, ‘The Artificial Intelligence Black Box And The Failure Of Intent And Causation’ (2018)
31 (2) HJLT 890.
20 Vikas Hassija, Vinay Chamola, Atmesh Mahapatra and others, ‘Interpreting Black-Box Models: A Review on Explainable Artificial Intelligence’ (2024) 16 Cognitive Computation 45–74.
21 K.S. Puttaswamy (Privacy-9J.) v. Union of India, [2017] 10 SCC 1(India).
III.
PROBLEMS ASSOCIATED WITH THE LAWS OF DATA PROTECTION AND
AI.
(i) RIGHT AGAINST AUTOMATED DECISION MAKING: Unlike the General Data Protection Regulation (hereinafter referred as GDPR), the DPDP lacks a provision for the Right against automated decision-making and profiling. Under the GDPR, data subjects (referred to as data principals) are granted the Right to avoid decisions solely based on automated processing or profiling if such decisions have legal or significant effects. 22 Take e-recruiting as an example where AI is utilised. In this scenario, data subjects hold the Right to receive information regarding automated decision-making processes, including insights into the rationale behind decisions and their potential consequences. 23 In the European Union (EU), data subjects also possess the Right to request human intervention and the Right to challenge decisions made using AI.
24 In e-recruiting powered by AI, individuals have the Right to request a human review of decisions made by AI. In contrast, India’s Bill mandates that data principals must be informed about the fairness of the algorithm or method used for processing personal data. 25 The DPDP no longer includes this provision. Consequently, India's DPDP lacks key Rights such as the ability to challenge decisions made by AI, the Right to seek human intervention in AI-driven decisions, and the Right to avoid being subjected to automated decisions, including profiling. (ii) NOTICE AND CONSENT: Pursuant to the Act, the data fiduciary is obligated to provide the data principal with notice about the personal data processed and its purposes before or at the time of collection. 26 Further, the act includes consent as a legal basis for processing personal data.
27 Consent must meet certain criteria; it should be freely given, informed, specific, clear, unconditional, unambiguous, and capable of being withdrawn, as outlined in the act. 28 Notice and consent mechanisms prove impractical in the context of Big Data analytics. This is
22 General Data Protection Regulation (GDPR) 679/2016 Regulation of European Union [2016], art 22.
23 ibid, arts 13,14.
24 ibid.
25 Personal Data Protection Bill (2021).
26 Digital Personal Data Protection Act 2023 s 5.
27 Digital Personal Data Protection Act 2023 s 4.
28 Digital Personal Data Protection Act 2023 s 6.
particularly evident in cases such as Big Data analytics being utilised to draw correlations, such as between individuals' lifestyles and creditworthiness. 29 Providing notice about processing purposes during personal data collection is challenging due to unforeseeable correlations. Moreover, with behaviour learned rather than programmed, the lack of clarity about decisionmaking creates a perception of the system as a "black box". 30 Deep learning models typically operate as black boxes, correlating vast amounts of data to generate outputs. This process is often challenging for data scientists, programmers, and users to interpret. 31 Consent cannot be considered valid when the analysis conducted by AI is opaque in nature. 32 AI systems, unlike humans, lack common sense and ethical judgement, resulting in unpredictability and unreliability in real-world scenarios.
33 Personal data must also be processed fairly and reasonably while ensuring privacy. 34 However, the utilisation of AI poses a challenge to the purpose limitation principle by processing data without always specifying a purpose and by enabling data to be repurposed for multiple, sometimes unknown purposes. 35 The ability to combine data collected for various purposes raises concerns about extensive citizen profiling. However, requiring user consent for data collection and sharing empowers individuals with autonomy and control over their information. (iii) TRANSPARENCY : The utilisation of AI poses a challenge to the purpose limitation principle by processing data without always specifying a purpose and by enabling data to be repurposed for multiple, sometimes unknown purposes.
36 In contrast to the Bill, the DPDP does not mandate providing information about the "fairness of algorithm or method used for processing personal data. "37 The DPDP lacks transparency provisions for AI, making it unclear to data principals how their 29 Information Commissioner’s Office, Big data, artificial intelligence, machine learning and data protection accessed 7 May, 2024. 30 Bengio Y, 'Deep Learning of Representations: Looking Forward' in Dediu A, Martín-Vide C, Mitkov R, and Truthe B (eds), *Statistical Language and Speech Processing: First International Conference* (Springer 2013) pp 1-137. 31 Wigmore I, ‘Black box AI’ accessed 29 April 2024.
32 ibid.
33 ibid.
34 ibid.
35 Lilian Mitrou, ‘Data Protection, Artificial Intelligence and Cognitive Services
Is the General Data Protection Regulation (GDPR) ‘Artificial Intelligence-Proof’?’ (2019) SSRN accessed 28 April 2024.
36 Digital Personal Data Protection Act 2023 s 5.
37 ibid.
data is processed. Transparency is challenging due to the "black box" effect of AI, which refers to its inherent opacity. 38 Furthermore, the logic behind machine reasoning is challenging to articulate in human terms. 39Additionally, tracing the outcomes of AI can be challenging. 40 Explaining the workings of unsupervised learning (a type of AI), is challenging due to the absence of data labels and relationships that could elucidate the underlying processes. 41 A case was brought before the UK Information Commissioner’s Office involving the Royal Free NHS Foundation Trust, where individuals were unaware that 1. 6 million patients' data was shared with Google DeepMind for use with AI. 42 This situation really prompts us to question just how transparent AI's utilization truly is, doesn't it?
(iv) RIGHT TO BE FORGOTTEN : According to the Bill, Right to be Forgotten mandates personal data must be limited in processing and disclosure when an individual withdraws consent to the analysing of personal data. 43 The Right can clash with the functioning of AI. In theory, if an individual withdraws consent but the AI persists in its operations based on previously learned behaviours, it could violate data protection laws. 44 The DPDP notably omits an express provision for the 'Right to be forgotten'. However, the Right to erasure is outlined in Section 12, which enables the data principal to request the erasure of their data. Section 12 mandates that the data fiduciary must erase the data "unless retention of the same is necessary for the specified purpose" or for a lawful purpose.
However, if AI forgets the data 38 Information Commissioner’s Office, Big data, artificial intelligence, machine learning and data protection accessed 7 May, 2024. 39 Lilian Mitrou, ‘Data Protection, Artificial Intelligence and Cognitive Services: Is the General Data Protection Regulation (GDPR) ‘Artificial Intelligence-Proof’? ’ (2019) SSRN. accessed 28 April 2024.
40 ibid.
41 Humerick, Matthew, ‘Taking AI Personally
How the E.U. Must Learn to Balance the Interests of Personal Data Privacy & Artificial Intelligence’ (2018) 34 (4) CHTLJ. 42 Elizabeth Denham, ‘Provision of patient data to DeepMind’ (Information Commissioner's Office, 3 July 2017) accessed on
4 May, 2024 .
43 Personal Data Protection Bill 2021 cl 20.
44 Humerick, Matthew, ‘Taking AI Personally
How the E. U. Must Learn to Balance the Interests of Personal Data Privacy & Artificial Intelligence’ (2018) 34 (4) CHTLJ. and the insights it has gained from it by erasing the data, it could impact the AI's functionality. 45 Indeed, this could pose challenges for the optimal functioning of AI. 46and this could ultimately impact Data Quality. (v) COLLECTION LIMITATION : While the DPDP does not explicitly acknowledge the collection limitation principle, it stipulates in Section 6 that consent must be provided for a specified purpose, and such consent must be restricted to data necessary for that purpose. In contrast, the Bill, which had recognized the principle of collection limitation, mandated the collection of only data necessary for processing purposes.
47 However, AI poses a challenge to collection limitation because it's often difficult to predict which data will be relevant for the AI. 48 This complicates the task of restricting the quantity of data gathered for AI training. IV.
LIABILITY AND COMPENSATION : RIGHTS OF VICTIM INVOLVED
AI can cause harm due to the operator, data fiduciary or manufacturer’s negligence. Without AI’s personhood recognition, human operators bear fiduciary duties. Till date we haven’t seen the legal recognition of AI as a person49. So, operators will be responsible for AI’s actions and liable for any harm caused. One proposed solution to the issue of AI accountability assigns responsibility to the human actors involved in its creation and operation, such as programmers, manufacturers, and operators, in cases where the AI breaches its intended function. AI developers/operators can be sued for harm caused by AI, if there was negligence/failure to take precautions.
This is similar to product liability for faulty products Data fiduciary, as operator of AI oversees it’s operations and can be held liable for its contraventions50 as the actions of the responsible officers are directly linked to the actions of the AI or company which operate AI. 51 Further, Girdhari Lal Gupta v. D. N. Mehta,52 observes that the “person in-charge and 45 Lilian Mitrou, ‘Data Protection, Artificial Intelligence and Cognitive Services: Is the General Data Protection Regulation (GDPR) ‘Artificial Intelligence-Proof’? ’ (2019) SSRN accessed 28 April 2024.
46 ibid.
47 Personal Data Protection Bill 2021 cl 6.
48 Lilian Mitrou, ‘Data Protection, Artificial Intelligence and Cognitive Services
Is the General Data Protection Regulation (GDPR) ‘Artificial Intelligence-Proof’?’, (2019) SSRN. accessed 28 April 2024.
49 Indian Penal Code 1860 s 11.
50 Dilip Hiraramni v Bank of Baroda 2022 SCC OnLine SC 579.
51 Iridium India Telecom Ltd. v Motorola Inc & Ors. (2011) 1 Supreme Court Cases 74.
52 Girdhari Lal Gupta v D. N. Mehta & Anr. (1971) 3 Supreme Court Cases 189.
responsible officers having overall control of the day-to-day business of the company would be held liable,” as failing to take appropriate action with due diligence. 53 From this we can also say that person in- charge of company( i. e. Data Fiduciary) operating AI would be held liable for harm caused by AI. To improve data governance in AI, responsibility should shift from individuals to data collectors and users, who must be held accountable for data handling. Processors should be liable for foreseeable harm, encouraging greater caution. This will reduce reliance on notice and inferred consent, easing the burden on individuals and focusing on meaningful data decisions. 54 Data protection law applies to the action of a data fiduciary, who can be the processor or controller. European55 and Russian56 laws have outlawed running information without approval from the person involved.
57 The DPDP act too does not allow processing without consent of the data principal. 58 However, some sections of this act contain exceptions for and other such organs where personal data relating to a private individual is being processed based on previous consent59. The state’s procession of personal data for benefit, service, licence, permit or certificate also overrides individual consent by including these exemptions in its statute. 60 These exemptions to process data without consent can cause harm to the data principal. After the breach of data or harm caused during the processing of data, who will be responsible for that harm or data breach? The DPDP act doesn’t provide a remedy for the same. The other big issue is regarding the compensation to the victims of data breach.
The DPDP act does not talk about compensating the victims after the breach of their personal data by the data fiduciary. It only talks about the imposition of penalty61 on Data Fiduciaries or the person who controls the data in the condition of breach of data by the Data Protection Board of India which left victims (i. e. Data Principal) vulnerable. Whereas the compensation clauses were mentioned
53 Avnish Bajaj v State (NCT of Delhi) 2004 SCC onLine Del 1160.
54 Fred H. Cate, ‘Big Data, Consent, and the Future of Data Protection’ in Cassidy R. Sugimoto, Hamid R. Ekbia, Michael Mattioli (eds), Big Data Is Not a Monolith (The MIT Press, 2016). 55 Council Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, of 27 April 2016.
56 Russian Federal Law on Personal Data [2006] N 152-03.
57 Aleksei Gudkov, ‘Fiduciary Relationship with Artificial Intelligence Systems’, (2020) 41 Liverpool Law Review 251 - 273.
58 The Digital Data Protection Act 2023 s 4.
59 The Digital Data Protection Act 2023 s 7.
60 ibid.
61 The Digital Data Protection Act 2023 s 33.
in the previous legislations and reports, such as Section 43A of IT Act, 2000 and Section 64 of draft bill, 201962 and also in Justice B.N. Srikrishna report63. Also, GDPR which is the data protection legislation of the European Union provides a compensation clause under Article
82.64 By not providing proper remedy in the DPDP act to the victims violates their Right to
privacy65 as well as the Right to get compensation. A well known Latin maxim, ‘Ubi jus ibi remedium’ which means that where there is a legal Right there is remedy too.66 From this maxim it is clear that the data principal who has the Right to data safety and protection then he/she should have the corresponding remedy too. So, we can say that the government should provide the compensation clause in the DPDP Act. V.
CONCLUSION
AND THE WAY FORWARD Since India has enacted data protection legislation, the potential challenges presented by AI need to be considered. One possible solution is to hold data Fiduciaries accountable.67 According to the Bill, significant data Fiduciaries68 must conduct a Data Protection Impact Assessment (DPIA) before using new technologies or processing data with potential significant harm.69 However, such a provision that requires carrying a DPIA for using new technologies is missing in the DPDP. A DPIA should be required when AI is used70 because the use of AI systems carries a risk to the Rights of the data principal. Studies suggest that the use of AI may lead to discrimination.71 AI can also be used to make evaluative decisions about an individual which could lead to the denial of a benefit.72 As per the Bill, a DPIA includes an assessment of potential harm to data principles and
62 Personal Data Protection Bill 2019 s 64.
63 Ministry of Electronics and Information Technology, Justice B.N. Srikrishna Report, ‘A Free and Fair Digital Economy Protecting Privacy, Empowering Indians’ accessed on 11 April, 2024.
64 General Data Protection Regulation (GDPR) 679/2016 Regulation of European Union [2016], art 82.
65 Maneka Gandhi v Union Of India (1978) 1 SCC 248.
66 Union Carbide Corporation v Union of India (1989) 2 SCC 540.
67 Personal Data Protection Bill 2021 cl 10.
68 The Digital Data Protection Act 2023 s 10.
69 Personal Data Protection Bill 2021 cl 27.
70 Robert Walters and Matthew Coghlan, ‘Data Protection and Artificial Intelligence Law: Europe Australia Singapore - An Actual or Perceived Dichotomy?’ (Feb. 18 2020) SSRN accessed 2 May, 2024. 71 Frederik Zuiderveen Borgesius ‘Discrimination, Artificial Intelligence and Algorithmic Decision-Making’ (Council of Europe, 2018) accessed 29 April 2024.
72 Personal Data Protection Bill 2021 cl 3 (23).
measures for mitigating, minimising, and managing risks. 73 A DPIA involves systematically describing processing, identifying risks, and planning mitigation measures. It includes detailing data flows, processing stages, and effects on individuals. Risks are categorized by likelihood and severity, including discrimination and impacts on Rights. Mitigation should be integrated early and the DPIA regularly reviewed. 74 Data Fiduciaries must implement security safeguards75 under the DPDP to prevent data misuse, unauthorised access, disclosure, and modification,76 especially when they use AI. The DPDP should clarify the fiduciary nature of the relationship between data fiduciary and data principal, including their obligations. 77 It is also unaddressed whether there is an additional duty of care to be undertaken by the data Fiduciaries.
78 Thus, a duty of care to protect privacy79 can be provided especially when AI is used. This is important because the individual may not be in a position to understand complicated algorithms or the consequences of their use. 80 To prevent bias in AI, there is need to ensure transparency in the decision-making process and assess attributes' weightage81, and then Check outcomes for bias against any attribute and maintain data quality by ensuring representativeness of input data. 82 A safeguard can be provided that risks of significant harm must be avoided while repurposing and explicit consent must be taken for action directed to individuals. 83 To reconcile the Right
73 Personal Data Protection Bill 2021 cl 27.
74 Simon Reader, 'Data Protection Impact Assessments and AI' (Information Commissioner’s Office, Oct. 23, 2019) accessed 29 April 2024.
75 The Digital Data Protection Act 2023, s 8.
76 Personal Data Protection Bill 2021 cl 24.
77Smitha Krishna Prasad, 'Information Fiduciaries and India’s Data Protection Law' (Data Catalyst, Sept. 2019) accessed 29 April, 2024.
78 ibid.
79 Matt Bartlett, ‘Beyond Privacy
Protecting Data Interests in the Age of Artificial Intelligence’ (2021) 3 Law, Tech & Hum 96.
80 ibid.
81 Varun Ramdas, Priyesh Mishra and Aditi Chaturvedi, ‘Handbook on Data Protection and Privacy for
Developers of Artificial Intelligence (AI) in India: Practical Guidelines for Responsible Development for AI’ (2021) GIZ 15.
82 ibid.
83 Ministry of Electronics and Information Technology, Justice B. N. Srikrishna Report, ‘A Free and Fair Digital Economy Protecting Privacy, Empowering Indians’ accessed on 11 April, 2024. to be forgotten with AI, the possible solution is to isolate or delete strands of AI’s learning. 84 But, isolation of learning is not possible in the case of AI such as neural networks. 85 Thus, the possible solution is for the Right to be forgotten to allow retention of information up to the point the Right has been requested. 86 There is also a need to include a compensation clause in the DPDP act if there is violation of Rights of data principal. Which is the important facet of the Right to remedy. While data protection is essential, there is also a need to ensure that the development of AI technology is not hindered. AI technology has potential benefits that can lead to the progress of society.
We need to fill these cracks in the house where data is stored and protected so that justice can be delivered and data can be properly used for betterment and efficiency in welfare schemes by the government as the people of India are the real worth of India and their data should be of utmost importance. 84 Robert Walters and Matthew Coghlan, ‘Data Protection and Artificial Intelligence Law: Europe Australia Singapore - An Actual or Perceived Dichotomy? ’ (2020) SSRN accessed 5 May 2024. 85 Humerick, Matthew, ‘Taking AI Personally: How the E. U. Must Learn to Balance the Interests of Personal Data Privacy & Artificial Intelligence’ (2018) 34 (4) CHTLJ accessed 16 May, 2018.
86 ibid.