HOW AI TRAINING MODELS COULD COMPROMISE PRIVACY

03 Nov 2026

Tags: Science & Technology   Emerging Tech   Robotics

Source: The Hindu

Context: Constitutional right to privacy – Recognised as a Fundamental Right under Article 21 by the Supreme Court in the Justice K.S. Puttaswamy v. Union of India (2017) judgment.

• Existing privacy laws have gaps in addressing risks arising from AI-based data collection, processing, inference and model training.
• India needs to balance AI innovation and economic growth with the protection of citizens' constitutional right to privacy.

Gaps in India's Data Protection Framework

• Earlier Legal Framework: IT Act, 2000 and 2011 Rules
  • Before the DPDP Act, the IT Act, 2000, along with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, was the principal framework governing personal data protection.
  • Scope of protection: Primarily covered specified sensitive personal data such as financial information, medical records, sexual orientation and biometric information.
  • Cross-border data transfer: Permitted subject to the recipient ensuring an adequate level of data protection and the transfer being necessary for a lawful contract or based on the individual's consent.
  • Penalties: Unauthorised disclosure of sensitive personal data attracted imprisonment up to three years or a fine up to ₹5 lakh.
  • Major limitation: Ordinary personal information such as names, addresses, phone numbers, caste, religion, political affiliations, browsing history, social media activity and behavioural patterns remained outside the specific protection framework.
  • Publicly scraped data: Information collected from publicly accessible sources, including social media platforms, was also outside its coverage.
• Digital Personal Data Protection (DPDP) Act, 2023
  • Current framework: DPDP Act, 2023, became India's general-purpose legislation for regulating the processing of digital personal data; its Rules were notified in November 2025.
  • Phased implementation: Important provisions relating to consent and data protection are scheduled to become effective in 2027.
  • Limited coverage: The Act does not cover publicly available personal data or information inferred from publicly available data, including social media activity.
  • No separate sensitive-data category: Unlike the earlier IT Rules, it does not create a distinct category for sensitive personal data.
  • Consequently, highly sensitive information such as passwords and mental or physical health conditions is placed in the same broad category as names, marital status, city and shopping preferences.
  • Privacy concern: Publicly available information and seemingly ordinary data can be combined and analysed to infer sensitive attributes such as emotions, mobility patterns and behavioural characteristics.
  • However, certain information, particularly biometrics and passwords, can cause serious privacy violations even without further inference and therefore requires stronger protection.

Privacy Risks Arising from AI Training

• Use of Personal Data in AI Training
  • Technology companies such as Meta, Amazon and Google use user-generated data to train AI models.
  • India is the world's largest market for Facebook and Instagram, making the privacy implications of large-scale data collection particularly significant.
• Regurgitation and Extraction of Personal Information
  • Data regurgitation: AI models may reproduce personal information memorised during their training.
  • Studies have demonstrated that even anonymised datasets can be queried to extract personal details retained by AI models, potentially identifying individuals and enabling profiling.
  • AI techniques can also extract sensitive information by analysing seemingly generic, publicly available information.
  • Thus, data that has been anonymised and made legally compliant may still expose individuals to identification and profiling if it was previously used to train AI models.
• Absence of User Consent and Right to Object
  • Indian users historically lacked an effective legal mechanism to prevent their personal data from being used for AI training.
  • Due to the phased implementation of the DPDP Act, companies are not yet required to fully comply with its substantive consent obligations.
  • Even after the substantive provisions become effective in May 2027, users will not have an explicit right to object to AI training using their publicly available personal data.
  • International comparison: Meta provides users in the European Union an opt-out mechanism to object to the use of their data for AI training.
• Limitations of the Right to Erasure
  • Right to erasure: Under the DPDP Act, individuals can seek erasure of personal data for which they had previously given consent, subject to applicable legal requirements.
  • It remains unclear whether this right extends to information inferred through the analysis of such data.
  • The Act also exempts processing for research, archival and statistical purposes, subject to conditions prescribed by the Central Government.
  • AI model training may potentially be presented as research aimed at improving service delivery, creating ambiguity regarding whether such activities can claim this exemption and escape certain obligations under the Act.

Measures Required to Strengthen Privacy Protection

• Extend regulatory coverage: Explicitly apply DPDP protections to personal data used for AI model training, including publicly scraped data and information inferred from it.
• Right to object: Provide individuals with the right to object to the use of their personal data for AI training.
• Strengthen right to erasure: Place responsibility on companies to inform users about every entity holding their personal data and strengthen mechanisms for its deletion.
• Clarify research exemption: Specify whether AI model training automatically qualifies as research or must satisfy defined conditions to claim exemption.
• Create a sensitive-data category: Introduce stricter standards for processing highly sensitive information such as biometrics, passwords and health-related data.
• Regulatory approach: Address these gaps through legislative amendments, notification of rules and judicial interpretation rather than imposing blanket restrictions on AI development.

Balancing AI Development and Privacy Protection

• Avoid blanket restrictions: Preventing data exports or completely prohibiting the use of personal information in AI training could negatively affect AI development.
• Inclusive AI development: Indian data can improve the representation of India's population in AI models and help reduce exclusion, inefficiency, discrimination and bias.
• India as an AI use-case hub: AI is increasingly being deployed by large corporations, MSMEs and non-profit organisations across sectors.
• Urgency of reform: Delaying privacy safeguards could progressively weaken the effective enjoyment of the constitutional right to privacy.

Relevant Constitutional and Legal Provisions

• Article 21: Protection of life and personal liberty; the Supreme Court recognised privacy as a Fundamental Right under this Article.
• Justice K.S. Puttaswamy Judgment (2017): Recognised privacy as an intrinsic part of life and personal liberty and established the constitutional foundation for data protection.
• DPDP Act, 2023: Provides the statutory framework for processing digital personal data and protecting individuals' privacy.
• IT Act, 2000: Earlier legal framework addressing electronic transactions, cyber offences and certain aspects of data protection.