\n<\/p>\n
Introduction <\/i><\/b><\/em><\/strong><\/p>\n The increasing level of dependence on technology has led to consumer data being used as currency for digital platforms. Platforms such as Instagram, WhatsApp and Google which are legally called \u201cData Fiduciaries\u201d process user data in a myriad of ways ranging from targeted advertising<\/u><\/a>\u00a0to training Artificial Intelligence<\/u><\/a>. The nexus between collection of data and revenue generation for tech giants continues to be an opaque area. However, with new laws in place i.e. the Digital Data Protection Act 2023<\/u><\/a>\u00a0and Digital Data Protection Rules 2025<\/u><\/a>, the question that arises is whether these laws are sufficient to protect people\u2019s privacy in a whirlwind of digital chaos?<\/p>\n In this context, in February of this year, the Supreme Court strongly criticized<\/u><\/a>\u00a0WhatsApp and Meta regarding their privacy policy. This appeal arises from the National Company Law Appellate Tribunal\u2019s (NCLAT<\/b><\/strong>) order that upheld the Rs. 213.14 Cr penalty imposed by Competition Commission of India (CCI<\/b><\/strong>). Justice Bagchi and the Chief Justice pressed Meta on tracking consumer behaviour that leads to data monetization through targeted advertising.<\/p>\n The Government has begun phased implementation<\/u><\/a>\u00a0of India\u2019s new digital data protection framework. The substantive provisions of the DPDP Act and DPDP Rules will come into force by May 2027. The central mechanism of this framework is user consent, whereby users are termed as \u201cData Principals\u201d. This article examines the capability of the consent regime in protecting privacy. The insufficiency of consent as a mechanism and the complexity of data processing in contemporary times is also analyzed.<\/p>\n Background and history<\/i><\/b><\/em><\/strong><\/p>\n The historic judgement delivered in Justice K.S. Puttaswamy v Union of India<\/u><\/a>\u00a0(Puttaswamy<\/i><\/b><\/em><\/strong>) recognized privacy as a fundamental human right under the constitution of India. The Court held that privacy is inseparable from liberty. After this ruling, the Government of India constituted<\/u><\/a>\u00a0the B.N. Srikrishna Committee of experts to examine issues related to data protection. \u00a0After initial deliberation, the committee released a White Paper on Data Protection framework for India<\/u><\/a>\u00a0(White Paper<\/b><\/strong>) identifying certain main themes for fair processing of data. The principal areas were identified as: treating consent as a pre-condition for data processing and classification of data into personal data and sensitive personal data such as caste, religion, sexual orientation of the individual. The committee recommended that more protection should be given to sensitive personal data.<\/p>\n Eventually the Committee\u2019s recommendations were used to draft the \u00a0Personal Data Protection Bill, 2019<\/u><\/a>\u00a0(PDPB, 2019<\/b><\/strong>) which subsequently led to the formation of the Data Protection Bill, 2021<\/u><\/a>\u00a0(DPB<\/b><\/strong>). However, the DPB, 2021 was withdrawn by the Minister for Communications and Information Technology, Ashwini Vaishnaw on 03 August 2022. A year later, on 07 August 2023, the Digital Personal Data Protection Bill, 2023 (DPDPB, 2023<\/b><\/strong>) was passed. The Bill was approved<\/u><\/a>\u00a0by the President of India and became law as the Digital Personal Data Protection Act, 2023 (DPDP Act<\/b><\/strong>) on 11 August 2023.<\/p>\n Processing of digital personal data<\/i><\/b><\/em><\/strong><\/p>\n The DPDP Act is concerned with the \u201cprocessing of digital personal data\u201d, which means performing a set of operations on personal data such as collecting, sharing, using, etc. according to s.3 r\/w s.2(x) of the Act. Anything that can be traced to you or can be used to identify you is your\u00a0<\/b><\/strong>personal data.<\/p>\n DPDP act is a protectionist legislation based on a notice-and-consent mechanism with one caveat. It does not apply to data that is willingly shared by people for instance, social media posts or publicly available data. This is a broad-exemption at the very outset of this legislation. It can have devastating effects<\/u><\/a>\u00a0on individuals\u2019 privacy in the age where people\u2019s online data is used for AI training.<\/p>\n The DPDP act does not make any categorization between different kinds of personal data, unlike the European Union\u2019s General Data Protection Regulation<\/u><\/a>\u00a0(GDPR) which classifies data into General Personal Data and Sensitive Personal Data. This classification offers high levels of protection to sensitive personal data that includes racial or ethnic origin, political opinions, religious beliefs, genetic and medical data, sexual orientation, etc. The lack of classification in the Indian framework puts marginalized communities at risk, depriving them of remedies, apart from approaching the Data Protection Board India.\u00a0Data collected for employment purposes or sexual orientation collected via dating apps can be used<\/u><\/a>\u00a0to discriminate against individuals. Facebook was previously criticised<\/u><\/a>\u00a0for allowing advertisers to target and exclude users on the basis of their caste, religion and economic status. Professor Philip Howard, Director of the Oxford Internet Institute, warns that<\/u><\/a>\u00a0public opinion is constantly being shaped by \u201ccomputational propaganda\u201d targeting and using data relating to political beliefs of people. The lack of categorization of data increases this risk. As digital marketing and targeting schemes are opaque, users are left in the dark as to which personal data is being used how and when.<\/p>\n Consent <\/i><\/b><\/em><\/strong><\/p>\n Data processing can be done in two manners u\/s 4<\/u><\/a>\u00a0and 5<\/u><\/a>, primarily through consent and secondly, if the state requires data to be processed for legitimate uses. All data should be processed for only a \u201clawful purpose\u201d.<\/p>\n Data Fiduciaries have to obtain consent from the Data principals via a notice. Section 5<\/u><\/a>\u00a0provides guidelines to be followed while administering a notice for obtaining consent. It must be in simple and clear language that informs the user of the purposes for the collection of personal data, procedure for withdrawal of consent, grievance redressal mechanism, and\u00a0complaint mechanism.<\/p>\n The phrase \u201clawful purpose\u201d is determined by the Act as anything that is not forbidden by the law. This is a negative formulation<\/u><\/a>, meaning fairness of the law is to be understood by what it is not. By defining lawful purpose negatively, Section 4(2) creates a presumption of lawfulness. Unless a specific law expressly forbids a purpose, that purpose is considered lawful for data processing.<\/p>\n Consent under the DPDP framework must be free, specific, informed, unconditional and unambiguous with a clear affirmative action as defined u\/s 6<\/u><\/a>\u00a0of the act. The validity of consent obtained from a Data Principal exists only for the specific period of time and for the specific purpose for which it was given. This implies that authorities cannot rely on \u201cbundled consent<\/u><\/a>\u201d and infringement by over-reaching authority in the interpretation of consent can constitute an infringement.<\/p>\n A right under this section also covers the right to withdraw consent, after which any processing of data would be illegal. Moreover, the burden of proof lies on the Data Fiduciary that the consent was obtained legally. This is a significant consumer protection measure where individuals are relieved from the burden of proving a breach of their privacy.\u00a0This section is the bedrock for all the procedural requirements of obtaining consent. Such heavy reliance on consent implies that Data Principals will act as informed users. And only after careful consideration would they autonomously provide their consent. Both the GDPR and DPDP frameworks require consent to be the main factor to decide legality.<\/p>\n McDonald and Cranor have estimated<\/u><\/a>\u00a0that if data subjects were to read all the privacy policies presented to them, it would take them 244 h annually. This means that the effectiveness of consent as a safeguard against unauthorised data disclosure is reduced, because it is overused.<\/p>\n Research suggests<\/u><\/a>\u00a0that the current legal framework of consent is based upon the idea of autonomous authorization. This has led to \u201cconsent desensitization\u201d and \u201cconsent fatigue\u201d stemming from an overload of information. The current legal policy is ineffective as users see consent requirements as a barrier to get past to gain access. The issue of information overload is exacerbated by the fact that data subjects are often confronted with consent decisions while they are involved in a completely different decision-making process. For example, the decision to give consent is often exercised while searching for new jeans. Privacy protection then becomes a trade-off between instant gratification versus the abstract risks associated with misuse or abuse of personal data, which are often not well understood, if at all.<\/p>\n Consent-based mechanisms are necessary but not sufficient<\/u><\/a>\u00a0at this time in history. There are compelling reasons to provide protections beyond consent in both promoting individual rights around privacy and collective, welfarist goals. This takes us to exploring alternatives in data protection to consent-based mechanisms.<\/p>\n However, consent is the most substantial safeguard that an average user has today. Loopholes in the consent mechanism must be understood before exploring the realm of alternative data protection.<\/p>\n Exceptions to consent. <\/i><\/b><\/em><\/strong><\/p>\n There are different kinds of exceptions u\/s 7<\/u><\/a>, and 17<\/u><\/a>\u00a0where the notice and consent principles do not apply. The exception of \u201ccertain legitimate uses\u201d u\/s 7 has two criteria that exclude Data Fiduciaries from obtaining consent. First is voluntary information provided for a specific purpose. Second is information needed for state instrumentalities to perform their functions. These functions can range from providing subsidies, legal obligations, medical emergencies, etc.<\/p>\n One exception that catches the eye u\/s 7 and 17 is the authority given to central government to exempt any state agency on the grounds of sovereignty, integrity of India, public order, and security of the State. These grounds effectually limit the scope of the Act as they grant unquestioned discretion to the executive to suspend privacy protections. This section\u00a0<\/i><\/em>permits<\/u><\/a>\u00a0blanket immunities to the State without requiring a demonstrable nexus between the exempted activity and the stated objective.<\/p>\n Implying a complete disregard of the \u00a0proportionality test<\/u><\/a>\u00a0laid out in Puttaswamy<\/i><\/b><\/em><\/strong>. Sovereignty and integrity of the nation are broad and vague terms which can be used by the state to dispense with data security<\/u><\/a>\u00a0of individuals. It is a disproportionate measure based upon discretion that shifts the Act\u2019s balance towards state surveillance. Broad exemptions under the grounds of state security, render Data principals mere subjects without autonomy and participation in maintaining their digital privacy.<\/p>\n The Supreme Court in Anuradha Bhasin v. Union of India<\/i><\/u><\/em><\/a>\u00a0<\/i><\/b><\/em><\/strong>has explicitly warned against excessive use of \u201cnational security\u201d to justify overarching violations on fundamental rights, holding that national security cannot justify disproportionate restrictions. The Court in Manohar Lal Sharma v. Union of India<\/i><\/u><\/em><\/a>\u00a0stated that the \u201cmere invocation of national security by the State does not render the Court a mute spectator<\/i><\/em>\u201d.\u00a0Holding that protection of citizens\u2019 rights must be paramount and that surveillance technologies cannot be allowed to function without constraints.<\/p>\n The DPDP Act, while undoubtedly essential in addressing contemporary privacy challenges, strays into the realm of excessive discretion. These powers are further amplified, with the lack of effective checks and balances upon the government\u2019s conduct.<\/p>\n Institutional framework<\/i><\/b><\/em><\/strong><\/p>\n The consent regime under the DPDP Act is only as strong as the body tasked with enforcing it. That body is the Data Protection Board of India (DPB) established u\/s 18<\/u><\/a>\u00a0of the Act. It is the primary adjudicatory authority empowered to receive complaints, conduct inquiries and also impose penalties in cases of breach. However, the board\u2019s design raises serious questions about whether it can function as independently as it should.<\/p>\n The structural problem begins with appointments. The Board\u2019s Chairperson and Members are appointed<\/u><\/a>\u00a0by the Central Government, on the recommendation of a Selection Committee that is itself constituted by the Central Government. The Act has given unchecked powers to the Executives to appoint the chairperson and members of the DPBI, thus diluting<\/u><\/a>\u00a0the independence of the Board. This stands in sharp contrast to the independence requirements built into GDPR-equivalent supervisory authorities, where Article 52<\/u><\/a>\u00a0explicitly mandates that supervisory authorities act with \u201ccomplete independence\u201d and member states are prohibited from influencing their decisions. A set of Writ Petitions challenging<\/u><\/a>\u00a0the constitutionality of DPDPA are currently pending before the Supreme Court. One of the core issues is lack of institutional independence of the DPB.<\/p>\n There is also the concept of a \u201cConsent Manager\u201d\u00a0<\/b><\/strong>introduced within S. 6(7) to 6(9). Consent Managers are registered with the Data Protection Board. They can enable the Data Principal to give, manage, and withdraw her consent. They are in a fiduciary relationship with the Data Principal. \u00a0Only a company<\/u><\/a>\u00a0can be a consent manager that has a net worth of more than Rs. 2 Cr. \u00a0It is not clear why the threshold of Rs. 2 Cr. has been specified. Effectually, only established commercial entities can afford this role which raises an immediate question about whose interests will such entities prioritize.<\/p>\n Conclusion<\/i><\/b><\/em><\/strong><\/p>\n Over-reliance on consent and vague, broad exemptions to it are two extreme ends of the rope that cannot achieve data privacy meaningfully. Data breaches can have devastating effects when they result in exposing sensitive information which can lead to stigmatization of a person in society.<\/p>\n