Public data loophole: Is transparency missing from the DPDPA framework ?

Transparency is one among the fundamental principles of India’s data protection framework, reflected in Digital Personal data protection act, 2023, which places obligation on data fiduciaries concerning notice, processing, and accountability.

Yet, the treatment of publicly available data under section 3(c)(ii) raises an important question:

Does public availability of individual’s personal data diminish her/his expectation of transparency regarding the subsequent use of their personal data?

➢ The Public data exclusion rule

Section 3(c)(ii) of DPDPA says the act is not applicable to any data made or caused to me made publicly available by Data principal or any other person who is under an obligation under any law for the time being in force. 

Consider an individual who publicly posts their name, address, photograph, professional history, and educational qualifications online. The information may have been shared for professional networking or communication. 

A data fiduciary may subsequently collect this “publicly available” information, combine it with information from other sources, and use it or analytics, profiling, and AI-related purposes.

An individual might be aware that the information is publicly available, but he/she might not necessarily know;

• Why is that data collected?

• Where was it obtained from?

• How is it subsequently processed?

This is where transparency concerns arise.

➢ Transparency beyond public disclosure

A person may publish a professional profile expecting it to be viewed by recruiters, colleagues, and clients. That does not necessarily mean, it to be aggregated with other information from various sources and processed for a completely different purpose. 

The real issue is not whether publicly available data should be unusable, but whether public availability should eliminate transparency regarding subsequent processing?

Public availability does not mean an individual has no visibility into subsequent data journey.

➢ How transparency model is imbibed into EU’s GDPR

Under the EU’s GDPR, the transparency rule is deeply integrated, absorbed, and woven into the framework. 

GDPR has a useful contrast with DPDPA, under article 14(2)(f) to ensure fair and transparent processing, it mandates data controller to disclose whether the data came from “publicly accessible sources”.

However, this does not mean that the use of publicly available information requires consent. A controller can rely on a lawful basis under article 6, including legitimate interests under 6(1)(f), where relevant requirements are satisfied.

Hence, the disparity is;

➢ DPDPA: publicly available data -> excluded under section 3(c)(ii)

➢ GDPR: Publicly available data -> remain regulated -> mandatory to disclose the origin.

➢ The AI Dimension

The gap is more significant in AI era.

The processing likely operate as:

Information available in public source -> automated collection -> Aggregation and analysis -> Profiling and Inference.

It becomes very easy for AI systems to combine information from professional websites, social media platforms, and other public sources to construct a detailed profile of an individual.

The individual may have publicly disclosed piece of information, but no visibility into the profile generated from it. 

➢ Conclusion

In an AI era it is seamless for an information to move form a public webpage to a dataset > from dataset to algorithm > and from algorithm to create a inferred profile > without the individual necessarily knowing that this journey has occurred. 

Hence, the real gap is not an access to public data or processing publicly data but the visibility into what happens to it afterwards.