“I know a lot about artificial intelligence, but not as much as it knows about me”, a well-known comment by the notable academician, Dave Waters eloquently captures the timeless struggle for supremacy between man and machine. Artificial Intelligence (AI), at its broadest level, is a branch of computer science that replaces human involvement in the tasks ordinarily performed by humans. Apart from storage of data, experts have argued that virtual intelligence has become integral in realizing the true value of the colossal data sets being generated, momently. 

As per a 2018 article in Forbes, about 2.5 quintillion bytes of data is generated every day[1]. Further, Seagate UK has predicted that by the year 2025, there will be 175 zettabytes of data in the global datasphere.[2] A host of factors including the expansion of cellular technologies, internet accessibility and affordability etc. has exploded the data landscape. With the unprecedented rate of data creation, storage of this data has posed significant challenges for economies. Considering the fact that most of the political, social, and economic decision making across the globe is incumbent on the data of the masses, governments and enterprises are rapidly moving towards the AI ecosystem.

The relevance of AI in the eyes of the Indian Government is evinced through the various initiatives undertaken in the last few years. In the year 2017, the Union Ministry of Commerce and Industry set up an Artificial Intelligence Task with a view to ‘embed AI in our Economic, Political and Legal thought processes so that there is systemic capability to support the goal of India becoming one of the leaders of AI-rich economies’.[3] Other ancillary organizations of the  government such as the Niti Aayog have teamed up with tech giants including Google to effectively integrate AI into the Indian landscape.

As AI runs on both historical and contemporary data, issues pertaining to data accuracy, systemic bias, transparency, and accountability etc. have gained cogent momentum in the last decade. The biggest concern for the governments and stakeholders across the globe remains the threat posed by this stimulated form of intelligence on individual privacy. AI based systems are capable of making unique and meaningful inferences, classifications, and categorizations of raw data. The sophisticated algorithmic techniques used to conduct data profiling, significantly have encroached and pushed against the boundaries of privacy and anonymity. The concept of privacy has witnessed historical evolution since the inception of the internet. As the globe pivots on the path of digital transformation and creation of diverse digital assets, institutional and corporate surveillance have shed light on the notion of privacy and its legal protection.

India today is at a critical juncture in the digital stratosphere. The Personal Data Protection (PDP) Bill, 2019[4] is yet to be enacted into law.

In the absence of a sui generis law in India regulation of data, there are  several piecemeal legislative and judicial for the protection of personal data. Section 43A of the Information and Technology Act, 2000 (IT Act)  penalizes “cyber contraventions” which attract civil prosecution under section 43 (a) to (h) and “Cyber Offences” which attracts criminal action under section 63 to 74 of the IT Act.

Apart from these,  various intellectual property laws in India cast accountability with respect to use of computer applications, data sets, algorithms etc. Under Section 2(o) of the Copyright Act, 1957, both the “source” as well as “object” code are protected under the realm of literally works. Further, the developer of the AI application is recognized as the author of the work under the above-mentioned Act, and is thus, accorded accountability. Similarly, while computer inventions are per se barred from protection under Section 3(k) of the Patents Act, 1970, the said provision is undergoing a dynamic judicially-evolved expansion.  The Delhi High Court in a 2020 judgement[5] asserted that an invention which demonstrates a ”technical effect‟ or “technical contribution‟ is patentable, even though it may be based on a computer program. 

India also has a large number of sectoral laws, aimed at providing regulating AI based applications. For example, the security markets regulator of India, namely the Security Exchange Board of India (SEBI), developed guidelines on algorithmic decision-making for investors looking to get into wealth management and algorithmic trading. However, none of these laws reflect the deeper challenges posed by machine dictated decision making.

Currently in India, the Personal Data Protection Bill, 2019 (PDP Bill),  is being considered by the Indian Parliament, which contains provisions that will likely apply to the use and processing of personal data by AI systems. The data protection principles relating to notice and consent, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability will likely apply to the use of personal data by AI systems. While these provisions may provide limited protection, they once again do not fully reflect and address the dynamic landscape created by AI.  Notions of consent, for instance, seem obsolete in the realm of the nature and behaviour of algorithms. Additionally, given that AI systems rely significantly on anonymised personal data, a large number of provisions of the PDB Bill will not apply to the data sets created  and inferred through AI. Given that AI systems can be used to re-identify anonymised data, the limitation of the PDP Bill in granting the same level of oversight to anonymised data may prove fatal to the objective of the Bill.

Another unfortunate inclusion in the PDB Bill is Clause 40, which states that the Data Protection Authority (DPA) shall create a sandbox for “encouraging innovation in artificial intelligence, machine-learning or any other emerging technology in the public interest”. The entities which will be included under the sandbox regime will be excluded from complying with the provisions of the Bill. Given that the legislative intent of the Bill is to provide data subjects with the ability to own decision making pertaining to their data, the sandbox provision may be antithesis to this aim.

The dubious terrain of the AI landscape has led to the inception of complex social, legal, and ethical ramifications. The new digital world order commands nations to move away from their traditionalist regulatory approaches. The future of AI in any nation will depend on the legal landscape of privacy. India, particularly, is being closely monitored by the global data stakeholders, as it moves towards its own specified data protection regulation.