Greatest gift to humankind or its biggest threat

The exponential rise of the use and economic potential of artificial intelligence has made it a subject of front-rank legal importance. In a world driven by information and a growing awareness among consumers that they need to demand more control over their information, there is a strong need for legal reform and regulation in this space.

It is evident that the digitisation of modern trade and communications allows for, and indeed may require the large-scale processing of data by organisations and governments. Many countries, including India, are tying development and economic progress to greater digitisation and integration of online systems. Regulators in India have taken notice of this and are making efforts to control AI in a sympathetic way while at the same time preserving consumer privacy.

Although not yet in effect, the Digital Personal Data Protection Act, 2023 (DPDPA), is expected to come into force in a phased manner in the second half of 2024. While the DPDPA does not explicitly regulate AI, it will impose obligations on organisations that use personal data. These obligations are broad and extend to companies that employ personal data in conjunction with AI. Such entities may, for instance, train their AI models, personalise product offerings, carry out targeted advertising or identify trends in consumer behaviour. Consequently, market players will undoubtedly have to factor in compliance with the new law when it comes into force if they wish to continue to use and explore AI models.

Specifically, the DPDPA will hold organisations responsible for ensuring the completeness, accuracy, and consistency of personal data that is likely to be used to make a decision that affects the individual to whom the data pertains. It also prohibits tracking children, sending them targeted advertisements, monitoring their behaviour, or processing their data in a manner that may be detrimental to their well-being. The DPDPA will empower the government to impose additional obligations on certain kinds of organisations based on an assessment of factors such as the volume and sensitivity of personal data processed by them and the risk to individual rights.

At the same time, the DPDPA will offer wide exemptions that some may argue are incompatible with the core principles of privacy. For example, it entirely exempts from its purview personal data that is made publicly available by individuals themselves or someone else under a legal obligation. What “publicly available data” means is presently unclear and the government may prescribe rules or issue clarifications that help narrow the scope of this exemption. However, as of now, such a classification may allow companies to employ privacy-invasive technologies, especially entities that depend on harvesting data, and will further general data mining and scraping practices.

There also exists a patchwork of white papers, draft guidelines, policies, reports, and recommendations relating to AI that have been issued by regulatory bodies. They make suggestions such as implementing multi-tiered review processes that involve human decision-makers at each level to evaluate AI decisions, regular audits and assessments of all AI systems to reduce the risks related to privacy, individual bias and security. There are also recommendations to introduce algorithmic auditing to promote the ethical application of AI.

Regulators are also putting increasing pressure on intermediaries and platforms that roll out AI products or use any form of AI-enabled tools to ensure that their algorithms do not deliver biased or discriminatory results. They have also recommended that users accept, by way of consent pop-ups, that they are aware of the inherent unreliability and nature of the output that AI may produce. Through an advisory issued in March 2024, it appears that the government is considering an approval mechanism before private companies make AI models, large language models and generative AI tools available to the public.

As AI revolutionises industries, issues such as data protection and privacy, algorithmic bias, accountability, and transparency have become focal points in the debate over AI regulation. Given the melange of existing laws, regulators should focus on clear legislation to ensure a proper balance between innovation and privacy.

Mathew Chacko is a partner, Aadya Misra is a counsel, Ada Shaharbanu is a senior associate and Ritika Acharya is an associate at Spice Route Legal.