Digital Personal Data Protection: Update This Law To The Age Of Al

India should consider revisiting some of its provisions to enable more effective AI operations without compromising privacy

- PRIYANKA CHATURVEDI & JAMEELA SAHIBA

The Digital Personal Data Protection (DPDP) Act of 2023 marks a pivotal moment in India's data governance, one that will significantly influence the trajectory of artificial intelligence (AI). With its focus on personal data processing, this law will have AI systems deployed to obtain explicit user consent, deliver comprehensive multilingual notices and adhere to predefined data usage objectives, thereby curtailing indiscriminate data scraping practices. This transformation carries profound implications for the AI ecosystem, given its fundamental reliance on data for training and progression.

It is important to understand the intricate mechanisms by which AI systems operate, particularly in the context of data acquisition to train their models. Contemporary Al-using enterprises engage in a multifaceted process of data gathering that spans a spectrum of sources, with a significant focus on personal data. This repository encompasses data not only from users who interact with these systems, responding to prompts and giving inputs, but also from developers who refine AI models with extensive open-source data-sets. Let's understand this better with the help of an example. Take the use of AI for healthcare diagnostics. Before the DPDP Act, AI-driven healthcare systems could access extensive patient data for diagnostics, often without stringent consent requirements, leading to effective medical outcomes. Now with the law coming into force, strict consent and data handling norms will be enforced, impacting Al's access to patient records and thereby also impacting the effective training of its models.