AI training processes can compromise personal data privacy

Context

Artificial Intelligence (AI) uses large amounts of data to learn and improve. But, when this data includes personal information, it can threaten an individual’s privacy and freedom .In 2017, the Supreme Court recognised the Right to Privacy as a Fundamental Right under Article 21 in the Justice K.S. Puttaswamy v. Union of India judgment. Although the Digital Personal Data Protection (DPDP) Act, 2023 provides a framework to protect personal data, it needs to address new privacy risks arising from AI.

Evolution of India’s Data Protection Framework

1. Earlier Legal Framework: Before the DPDP Act, personal data was mainly protected under the Information Technology Act, 2000, and its 2011 Rules.
2. Protection of Sensitive Data: The 2011 Rules covered personal information such as bank details, medical records, sexual orientation and biometric information.
3. However,  information relating to caste, religion, political views, browsing history and social media activities did not receive similar protection under the earlier framework.
4. DPDP Act, 2023: The Act, along with the Rules notified in November 2025, provides a wider framework for protecting digital personal data.

Limitations of the DPDP Act in Addressing AI-related Risks

1. No Separate Category for Sensitive Data: The Act does not create a separate category for sensitive personal information. As a result, information such as passwords, health records and biometric details is not treated as a distinct category from names, marital status and shopping preferences.
2. Limited Protection for Publicly Available Data: Certain publicly available personal information is excluded from the Act. However, such information can become sensitive when collected and analysed together by AI.
3. Use of Personal Data by Technology Companies: Companies such as Meta, Google and Amazon collect large amounts of user information, which may be used to develop and train AI models.
4. Risk of Combining Information: AI can combine small pieces of information from different sources to reveal details about a person’s identity, behaviour and personal life.

Threats Posed by AI Training on Privacy

A. Risk of Storing and Revealing Personal Information

1. Data Memorisation: AI models may remember some information from their training data and reproduce it when users ask certain questions.
2. Identification of Individuals: AI can sometimes identify people by connecting information from different datasets, even when the original data has been anonymised.
3. Revealing Sensitive Information: AI can use publicly available information to identify a person’s behaviour, location patterns, emotional condition and personal relationships.
4. Limits of Anonymisation: Removing names and other identifying details may not be enough to protect privacy because AI can connect different pieces of information to identify an individual.

B. Lack of Effective Consent

1. Unclear Rules for AI Training: The DPDP Act does not clearly explain how personal information can be used to train AI models.
2. Delayed Implementation: Several important provisions of the Act are scheduled to come into effect in phases, with some taking effect in May 2027.
3. Limited Right to Object: Individuals may not have an effective way to prevent their publicly available personal information from being used for AI training.
4. Example from Europe: Meta provides users in the European Union with an option to object to certain uses of their personal information for AI training.

C. Right to Erasure and Research Exemption

1. Difficulty in Deleting AI-generated Information: The DPDP Act provides a right to seek deletion of personal data. However, it is unclear how this right will apply to information about individuals generated through AI analysis.
2. Research Exemption: The Act allows certain exemptions for data processing related to research, archiving and statistical purposes.
3. Possibility of Misuse: If commercial AI training is treated as research, companies may use this exemption to avoid some data protection requirements.

Other Challenges in Regulating AI and Privacy

1. Rapid Technological Changes: AI technology is developing faster than existing laws and regulations.
2. Lack of Awareness: People may not know how their personal information is collected and used to train AI models.
3. Cross-border Data Use: AI companies may collect and process data across different countries, making it difficult to enforce national laws.
4. Misuse of Personal Profiles: AI-generated profiles may influence decisions relating to jobs, loans, insurance and access to services.
5. Balancing Innovation and Privacy: Very strict rules may discourage AI research and investment, while weak rules can lead to misuse of personal information.

Way Forward

A. Strengthening the DPDP Framework

1. Protect AI Training Data: Ensure personal data used for AI training is legally protected.
2. Right to Object: Allow individuals to object to the use of their data for AI development.
3. Regulate Public Data: Set rules for the commercial use of publicly available personal information.
4. Protect Sensitive Data: Provide stronger safeguards for health, financial and biometric information.
5. Strengthen Erasure Rights: Clarify deletion of personal data, including AI-generated information.
6. Clarify Research Exemptions: Prevent misuse of research exemptions for commercial AI training.

B. Balancing Innovation with Privacy

1. Balanced Regulation: Protect privacy without restricting AI innovation unnecessarily.
2. Responsible AI: Promote transparent, safe and accountable AI systems.
3. Use Data Diversity: Develop AI systems that reflect India’s linguistic and cultural diversity.
4. Prevent Discrimination: Reduce bias and unfair outcomes in AI-based decisions.
5. Effective Monitoring: Monitor how companies collect, store and use personal data.

Conclusion

The DPDP Act, 2023, provides an important foundation for protecting personal information. However, the growing use of AI creates new risks, such as the misuse of publicly available data, identification of individuals and the disclosure of sensitive information.

India must develop a balanced AI governance framework that protects the right to privacy while encouraging innovation. Technology should improve people’s lives without compromising their constitutional rights and individual freedom.

FAQs

Q1. Why is the Right to Privacy important in the age of AI?

Ans: It protects individuals from the misuse of their personal information through data collection, monitoring and AI-based analysis.

Q2. Which judgment recognised privacy as a Fundamental Right in India?

Ans: The Justice K.S. Puttaswamy v. Union of India judgment (2017), under Article 21.

Q3. How can AI threaten personal privacy?

Ans: AI can remember and reveal personal information, identify individuals from different datasets and predict sensitive details about them.

Q4. Why can publicly available information create privacy risks?

Ans: AI can combine information from different sources to reveal personal details that may not be visible from individual pieces of information.

Q5. What is data re-identification?

Ans: It is the process of identifying a person by connecting anonymised information with other available data.

Q6. What is the Right to Erasure?

Ans: It allows individuals to seek deletion of their personal data, subject to the conditions and exceptions provided by law.