Privacy Beyond Data: Do We Have a Right to Control What Technology Sees About Us?

Abstract

Today’s artificial intelligence systems do not only gather what we give out, but also extract what we conceal. From the speed of typing to political judgements from surfing behaviours, computational systems develop intimate profiles of people from harmless data alone. The article says that current data protection law, including India’s Digital Personal Data Protection Act, 2023, is structurally unable to deal with this inferential dimension of privacy because it is built around the idea of ‘personal data’ that a person provides, not inferences that an algorithm derives. Drawing on Justice K.S. Puttaswamy’s acknowledgement of informational self-determination, the paper argues that a constitutional right to control algorithmic conclusions, distinct from the right to control raw data, is both theoretically justified and practically needed.

I. The Inference Problem

Suppose there are two facts about you: that you visited a certain website, and that your phone battery was at 13% when you did so. Neither fact tells an observer very much. But give them to a machine-learning system along with a hundred similar data points – the time of day, the duration, the next site visited, the news you read before going to sleep – and, with documented accuracy, it can infer your political leanings, your emotional state, your likelihood of defaulting on a loan, and your susceptibility to particular forms of advertising or persuasion.

This is the inference problem at the heart of modern privacy law, and it is a problem that the current legal structures were not designed to solve. The GDPR, the DPDP Act and almost every other data protection law in the world rest on a deceptively simple model: personal data is information that a person provides or that identifies them; data subjects have rights over that information; data controllers must process it lawfully, for specified purposes and no longer than necessary. The model assumes that the data that enters the system is the key point of concern for privacy.

But for today’s most capable artificial intelligence (AI) systems, the data that feeds into the system is mainly incidental. What matters is what the system deletes. And the law has essentially nothing to say about derived inferences – what it knows about you that you never told it, what it predicts about you that you can’t verify or contest, and what it infers about you that may be flat-out false but is being acted upon anyway.

II. Puttaswamy And Informational Self Determination

India’s constitutional architecture offers more substantial resources for tackling the inference problem than is widely appreciated. In Justice K.S. Puttaswamy (Retd.) & Anr. v. Union of India & Ors., (2017) 10 SCC 1 Justice D.Y. Chandrachud in his concurring opinion articulated a right to ‘informational self-determination’—the right of every individual to control the dissemination of information about themselves—as a constitutionally protected dimension of the right to privacy under Article 21. The notion is partly based on the German Federal Constitutional Court’s famous 1983 decision concerning the Census Act (Volkszählungsurteil, BVerfGE 65, 1), but it exceeds the right to exclude physical intrusion into one’s house or communications by far. It includes the right to create one’s own information footprint in the world.

The key question, which Puttaswamy identifies but does not answer, is whether informational self-determination includes control over conclusions from information that one has disclosed. If I submit my location data with a navigation app, do I lose any right to object to conclusions about my religion from my trips to places of worship? My bank has my transaction history, but does my authorisation to that processing include a creditworthiness inference based on the emotional vocabulary of my text messages?

Even if the verdict does not state it explicitly, Puttaswamy’s reasoning points to a ‘no’ answer. Informational self-determination is the right of the individual to govern the circulation and use of the information about himself. Even if we assume that consent was given for each individual input of data, a system that takes information given for one purpose and utilises it to make intimate conclusions for a totally different purpose, violates the purpose-limitation principle at the heart of Puttaswamy’s paradigm.

III. What Data Protection Law Covers—and What It Doesn’t:

A. What is the DPDP Act 2023, all about?

India’s first comprehensive regulatory regime for data protection, the Digital Personal Data Protection Act, 2023. Its architecture is the standard one: personal data must be processed for specified purposes with the consent of the data principal; data fiduciaries must adopt security safeguards; data principals have the rights of access, correction and erasure; and penalties are prescribed for noncompliance. 

Section 4 of the DPDP Act states that personal data can only be handled for a lawful purpose and with the permission of the data subject or other statutory grounds. Section 6 demands consent to be free, particular, informed, unconditional and unequivocal. These laws, on their face, provide effective protection against the most blatant privacy violations: the unlawful processing of obviously sensitive information.

B. The Structural Gap: Inferences Are Not Personal Data

The difference is when we use the Act on algorithmically obtained findings. The DPDP Act defines ‘personal data’ as ‘any data on an individual who is identifiable by or in relation to such data’. The definition encompasses information that identifies or relates to an identified individual. But an inference drawn from aggregated anonymised data – a forecast about the kind of voter you are, or the kind of borrower you will be – does not necessarily involve personal data in the legal sense.

More specifically, the Act regulates the collecting and processing of the inputs, but not the generation of the output. If a corporation has lawfully collected your browsing history with your consent, it has fulfilled its legal requirements under the Act. That the same company then uses that history to make an inference about your mental health status—and sells that inference to an insurer—is not clearly caught by any provision of the Act, because the inference itself is not personal data you gave; it is the company’s own intellectual output derived from data you gave.

Crucially, the DPDP Act also leaves out rights to automated decision-making. Unlike Article 22 of the EU’s GDPR that provides persons with the right to not be the subject of a decision based exclusively on automated processing (including profiling) that has legal or similarly substantial repercussions, there is no corresponding provision in the DPDP Act. There is no right to object to automated decisions, no access to an explanation of algorithmic outputs and no right to human review of automated conclusions in India’s statute.

Existing Law: What it Covers and What it Misses

1. Covered (DPDP Act 2023): Collection of personal data with consent; purpose limitation for some processing; access, correction and deletion of data provided; penalties for data breaches.

2. Not covered: Inferences from data; automated decision-making rights (no Art. 22 GDPR equivalent); profiling outputs; explanations for algorithmic conclusions; right to reject AI-derived characterisations.

3. Exempted (Section 17): State processing for national security, sovereignty and public order - the widest category of inferential monitoring by the most powerful actor.

4. What is missing completely: No right to be forgotten for algorithmic profiles No right to data transfer No independent regulator (Data Protection Board is executive appointed)

IV. The Why Inferential Privacy Is More Important Than Data Privacy

The consequences of this gap are not hypothetical. In 2021, the Consumer Unity & Trust Society reported on incidents where Indian fintech lenders judged creditworthiness based on signals such as social media activity, contact lists and smartphone information — none of which the borrower meaningfully consented to be used in credit evaluation. In the criminal justice arena, surveillance analytics businesses have sold systems to Indian police forces that promise to forecast criminal recidivism or to identify ‘anti-social elements’ on the basis of aggregated digital behavioural data. They are not subject to any statute requiring their disclosure and hence their accuracy, bias features, and accountability methods are unknown.

The political situation is particularly severe in its constitutional character. An inference that a person is likely to vote for a particular party, or has sympathies with a particular political or religious movement, derived from their online behaviour, without any explicit statement on their part, is precisely the type of intimate political information that the state has historically used as a basis for targeting dissent. The right to political privacy, the freedom to form political beliefs without the state building a political profile from one's digital imprint, is an essential dimension of the right to privacy, no less than any other.

Shoshana Zuboff introduced the phrase ‘behavioural futures markets’ when she wrote The Age of Surveillance Capitalism (2019) to capture a business model in which assumptions about future behaviour are commodified and sold. Her primary point – that the mining of human experience as raw material for behavioural prediction represents an unparalleled assault on human autonomy – speaks directly to the constitutional ideals laid out by Puttaswamy. At the heart of the right to privacy is the right to be the author of one’s own story. Unchecked algorithmic inference passes that authorship through to the system.

V. Toward a Constitutional Right to Inferential Privacy

What might a right to control algorithmic judgements like in practice? The Puttaswamy framework and comparative constitutional jurisprudence yield three principles.

First, purpose limitation should cover inferred data, not just provided data. Consent to the gathering of location data for navigation purposes cannot be transferred to a political profile formed from such data. The purpose-limitation principle shall apply both at the input stage and at the output stage of the algorithmic processing.

Second, persons should have a right to explanation and contestation. Any major decision that affects a person’s legal, financial or service entitlement, and that is made or informed by an algorithmic inference, should come with a meaningful explanation of the basis for the inference, and a real opportunity to contest its accuracy. This involves not only access to the data input, but also disclosure of the logic of the model, to the extent that such disclosure is technically feasible.

Third, sensitive inferences should be regarded as sensitive data. Making assumptions about a person's religion, political beliefs, sexual orientation or mental health is just as delicate as actually revealing such things. Currently, inferences are not covered by the DPDP Act’s restrictions on sensitive personal data, which are already weaker than their GDPR equivalents. They have to.

VI. Conclusion

We’re living in an age where the most powerful knowledge about individuals isn’t the facts they reveal, but the inferences that robots make. The constitutional framework of India, as supplied by Puttaswamy’s acknowledgement of informational self-determination, lays the normative ground for a right to govern those inferences. Under the DPDP Act, India’s statute legislation does not give that constitutional right any practical reality, by systematically excluding any rights of automated decision-making, inferential data governance and independent regulatory monitoring.

The current DPDP Act does not show the legislative ambition required to bridge this gap. But the constitutional case for such legislation is not simply available, it is, post Puttaswamy, compellingly strong. A democracy that permits the unfettered deduction and utilisation of what they can infer about us from our digital behaviour, but that recognises the right to control what others can know about us from what we share, has protected the letter of informational self-determination but sacrificed its spirit.