The implementation of the DIGITAL PERSONAL DATA PROTECTION ACT of 2023 marks a significant inflection point in the Indian legislative landscape regarding privacy and technology. While the government framed the legislation as a robust framework for personal data security, legal scholars and privacy advocates are increasingly debating whether the statute inadvertently incentivizes a regime of data maximisation rather than the intended minimization. The current discourse, highlighted in recent legal analysis, suggests that the ambiguity surrounding key definitions may empower data fiduciaries to retain more information than is strictly necessary for their stated purposes.
At the heart of this tension lies the fundamental concept of purpose limitation. Under the statute, data fiduciaries are expected to process personal data only for lawful purposes. However, the legislation provides broad exemptions for the state and utilizes flexible definitions regarding what constitutes legitimate use. Legal experts argue that these provisions create a loophole where entities might collect extensive datasets under the guise of broad service optimization or security requirements. By failing to impose a strictly defined necessity test, the framework shifts the burden away from data minimisation, which is the gold standard in privacy laws like the European Union GENERAL DATA PROTECTION REGULATION.
The statute introduces the role of the DATA PROTECTION BOARD OF INDIA, a regulatory body tasked with enforcement. Critics point out that without stringent rules defining the threshold for data deletion and retention, the board faces a difficult task in curbing excessive data collection. The concern is that companies and government entities may choose to store information indefinitely to maximize the training potential of AI models or to enhance predictive analytics. This effectively transforms personal data from a liability into a strategic asset that entities are reluctant to purge.
As India navigates this new regulatory climate, the role of judicial oversight becomes paramount. The judiciary will likely be the arbiter of whether the current regime adheres to the principles of proportionality established in the landmark K.S. PUTTASWAMY V. UNION OF INDIA case. That ruling recognized the right to privacy as a fundamental right, implying that any encroachment, including data collection, must be balanced and necessary. If the DPDP ACT is interpreted to allow unrestrained data collection, it may face constitutional challenges in the coming years.