The Big Data and Right to Privacy Conundrum

I. Introduction

Privacy during this this era of Big data and automated decision-making is difficult to be conceptualized. The terms artificial intelligence, Big data, and machine learning have reshaped the concept of privacy in this modern technological world. The usage of algorithms in this era of technology has affected our lives much further than we can comprehend. Undoubtedly, Big data provides numerous opportunities for the world economy in various sectors ranging from medical services, marketing research to national security. On the opposite hand, the extraordinary rewards of Big data analysis are decreased by the concerns over data privacy and protection. We stand on the sting of a technological revolution led by artificial intelligence which can deeply alter the manner we exist, work, or relate to at least one another. Privacy activists are afraid that the development of the algorithmic ecosystem will capsize the relationships between government, business, and individuals, and can end in digital dictatorship ultimately resulting in a state of anarchy. It is pertinent to note that during this age of Big data, the right to privacy has become a crucial issue as personal data is often collected and operated in the new-fangled economy. Finding the right equilibrium among privacy risks and Big data benefits may very well be the biggest public policy challenge of our time². It calls for momentous choices to be made between weighty policy concerns such as scientific research, public health, national security, law enforcement, and efficient use of resources, on the one hand, and individuals’ rights to privacy, fairness, equality, and freedom of speech, on the other hand³. It requires deciding whether efforts to cure fatal disease or eviscerate terrorism are worth subjecting human individuality to omniscient surveillance and algorithmic decision making⁴. In order to better understand how the “Big data” phenomena affect an individual's privacy and social lives; we need to comprehend the notions involved.

II. Definition and evolution of big data

Put simply, Big data is larger, more complex data sets, especially from new data sources. These data sets are so large in number that conventional data processing technologies fail to handle the data processing. But these huge volumes of data can be used to address business complications that you wouldn’t have been able to tackle before. Big data is data that contains a greater variety arriving in increasing volumes and with ever-higher velocity. This is known as the three Vs⁵. Later studies pointed out that the definition of 3Vs is insufficient to explain the Big data we face now. Thus, veracity, validity, value, variability, venue, vocabulary, and vagueness were added to make some complement explanations of Big data. The Big data is diverse in nature. E.g., Big data can be audio, video, location etc. To ensure Big data privacy, various mechanisms have been developed in recent years. At present, the total amount of data in the world is 59 zettabytes⁶. That is set to rise steeply to 149 zettabytes by 2024⁷. To put that in perspective, 59 zettabytes is equivalent to 59 trillion gigabytes. The need to process these progressively larger (and unstructured) data sets is how traditional data analysis transformed into ‘Big data’ in the last decade.

Organizations capture data in numerous ways from many sources. Some collection methods are highly technical, while others are more rational (although these processes often employ sophisticated software). Individual data can be accessed in multiple ways. E.g., by directly asking individuals acting as customers, by tracking them indirectly, and by attaching other sources of individuals data to your data. Businesses are proficient at drawing all types of data from nearly everywhere possible. The most apparent sources are from the user's activity on the web portals and social media platforms, but there are some more fascinating methods at work as well. One instance is location-based advertising, which uses tracking technologies such as a laptop or computer’s IP address to build a customized data silhouette. This information is used to target users' devices with bespoke advertising of their interest. In addition to the collection of information for their internal business purposes, organisations also exchange the personal information if individuals with other third-party companies. Once collected, this personal information is frequently shifting hands in a data bank of its own.

III. Big data and its relationship with privacy

Considering that the term “privacy” has very lately got its inception in this digital world, it is difficult to be understood in a theoretical sense. There is a plethora of privacy concerns that Big data analytics and their storing needs to take care of. Individuals have a scarce understanding of how privacy breaches impact individuals as well as their social interaction. There is a dearth of transparency regarding privacy policies or the indicative analytics that is applied by the websites for their users. Incorrect data or analytics consequences may be shared with the data centers, making it problematic for individuals to make changes through a due process. It is possible to envisage personal behaviors, originally meant to be personal, using Big data analytics. There is a discrepancy between the websites claimed policies and the concrete controls made accessible to individuals and websites often have a financial benefit to beat around the bush. There currently exist data privacy laws that are not in line with the current technology and which no longer comply with the spirit of original charters or treaties in preventing breaches of data privacy. Government surveillance agencies have violated basic expectations of privacy in the absence of any restrictions to unregulated interference, and Big data has brought a new scale of encroachment and ability not expected by previous regulations.

IV. Indian government initiatives and related privacy concerns

(A) Aadhaar Programme

The Aadhaar program, the so-called world’s largest biometric ID system launched in 2009 is an initiative of the Unique Identification Authority of India (UIDAI) that aims to give every resident in India a unique, biometrically-verifiable identification number. This would help the government deliver services to targeted beneficiaries by providing them unique identity numbers in the form of the biometric Aadhaar card. As of September 2020, a total of 1,263,581,829 Aadhaar numbers have been generated by UIDAI⁸. In what follows, we will focus on the technical and legal characteristics of Aadhaar programme.

Technological systems have been given a key role in the UIDAI infrastructure. The database of Aadhar is stored in a centralized server. The Aadhaar authentication ecosystem is capable of handling tens of millions of authentications daily, and can be scaled up further as per the demand.⁹ UIDAI also mentions that they have put inadequate systems in placed to ensure security and protection of the personal data.

On its website, the UIDAI declares, "we want to expose all publishable public information via a ‘Data Portal’ where all data is exposed in machine-readable formats. This portal allows third-party developers to develop Web 2.0 applications based on this data.”¹⁰ Allowing the third party to avail residents’ data is a potentially risky step. Further, the government wants to expose “publishable public information”. However, it is not clear what authorities mean by “publishable public information.” It is not clear what is publishable and what is not? In terms of the partnership model, it states, “the UIDAI approach leverages the existing infrastructure of government and private agencies across India.” Again the UIDAI is allowing ‘private agencies’ to develop mechanisms to “leverage existing infrastructure of government.” In addition, the Authority will collaborate with different third-party agencies from private and public sector who will further process Aadhaar applications they will also aid the government to check for the authentication of identity of individuals.

UIDAI states that “biometric information will not be shared with anyone, nor it will be displayed publicly, except for purposes specified by regulations”¹¹. Further, the statement elaborates that the Authority shall ensure that an equilibrium is created between the data collected from residents and the purpose for which it used. The Authority will also enter into contracts with Registrars to ensure the confidentiality of the information they collect and store."¹² Firstly, the assertion and the explanation of the assertion are completely clashing with each other. Secondly, the issue is how the authority is going to make an equilibrium between ‘data privacy and purpose limitation’ which has no clarity. Further, it declares, "the agencies may store information of the residents if they are authorized to do to enroll citizens for Aadhaar number." Thus, 'private agencies can store and access sensitive personal data of the individuals. Furthermore, unlike most of the global websites, which has a privacy policy elaborating on the processing of personal data UIDAI has posted a random document in the guise of privacy that does not mention anything about the manner of use of personal data of individuals leading to confusion and ambiguity.

On the one hand, residents are being communicated that intention of Aadhaar programme is easy to provision of state assistance schemes. However, Section in the 33(2) of the Aadhar Act, one can observe that government agencies may be provided with permission to access the Big data database through Aadhaar platform. There is no clarity as to why government agencies need to be given access rights to the database if the intention is to support the easy provision of state assistance schemes.

Indian residents have also given assurance that sensitive personal information stored in the database is well protected from a security standpoint and unapproachable for any purpose other than validation. In the part VI of the Aadhar Act, ‘protection of information’ under the ‘security and confidentiality of information’ in the statute, it states, “The Authority shall ensure the security of identity information and authentication records of individuals.”¹³ Later, in Section 29(2) of the same statute, the lawmakers makes substantial exclusions and authorizes the authority to easily access personal information. The Act offers no provisions where a party may appeal if the individual’s privacy rights have encroached. Therefore, it provides a chance to misuse Aadhaar database, which subsequently results in a threat to an individual’s basic fundamental right- right to privacy.

(B) Central Monitoring System

The Central Monitoring System (CMS) came into media coverage in 2013; however, it was approved by the Cabinet Committee on Security (CCS) on 16th June 2011 and the pilot project was completed by 30th September 2011. The idea of having such a system to supervise all kinds of communications channels in the nation and having a centralized storage of such huge data was first planned in 2009 subsequently after the 2008 Mumbai terrorist attacks.

The draft Rule 419B under Section 5(2) of the Indian Telegraph Act, 1885¹⁴, permits for the exposure of “message related information” or Call Data Records (CDR) to Indian government. Call Data Records, also known as Call Detail Records, comprises of data that defines a telecommunication transaction, but excludes the contents of that particular transaction. This implies that ‘Call Data Records’ will comprise of data such as phone number of individuals, total period of calls, etc. This kind of data can only be given on a national level via orders by the Secretary to the Government of India in the Ministry of Home Affairs, while on the state level, orders can only be given by the Secretary to the state government in charge of the home department. Unfortunately, Section 5(2) does not specify very little information about the names of agencies that will have access to the system, which may allow scrutiny and the legal values that must be adhered to capture numerous data.

It is also ambiguous how an individual's data that is scrutinized and collected through the authorized is being used. It appears that it is a mass surveillance tool that collects an enormous amount of data daily. This raises eyebrows concerning its probable ill-use and consequent abuse of India’s right to privacy and other human rights. Before implementation of the CMS system, government agencies handling security were mandated to approach the telecom operators to capture calls or messages of suspected individuals but at the moment, it is included by default into the licensing process. Since CMS was formed lacking parliamentary consent, or without any public consultation the government should assemble a complete public discussion about the proposed use of the system before going on any further.

India may factually be the largest democracy in the world, but it lacks codified privacy legislation in force that recognizes the right to privacy and which guarantees data protection and safeguards individuals from the potentially unlawful intervention of their communications. It is also pertinent to note that India is also carrying out a chiefly unfettered surveillance system. Therefore, it is the need of the hour that India passes the Personal Data Protection Bill and establishes a codified privacy law.

(C) Smart City Mission

A ‘smart city’ is well-defined as an urban area, which is extremely advanced in terms of overall infrastructure, sustainable real estate, communications, essential public service, and market feasibility¹⁵. In the year 2014, the Indian government had broadcasted strategies to build 100 smart cities across the nation considering the move towards urban transformation due to the massive inflow of migrants from towns. In 2015, the Indian government issued the ‘Smart City Mission Statement and Guidelines’. The idea of Smart Cities Mission is to “drive comprehensive physical, institutional, social, and economic infrastructure development”¹⁶

Exploring smart cities offer sensors monitoring water system, usage of clean energy, screens traffic flows, and installs security cameras to make inhabitants’ life relaxed. Each smart city in India creates enormous volumes of data and sends that data straight to city officers. Mobile applications that aid people circumnavigate traffic and vote will be developed to balance the services presented. The city administrators store, analyse, and transmit the data on regular basis to other branches and third-party agencies to scrutinize services and gain different services. Therefore, Big data and data algorithms undoubtedly play a vital role in such a revolution, in which case different information and communication technology tools taken from third parties will act as mediators for the collection and storage of data.

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ¹⁷deal with the accountability regarding personal and sensitive data security and protection; and as it applies to ‘body corporates’¹⁸ and digital data. Therefore, it can be inferred that any agency collecting and using Big data for the smart cities in India would fall under the exception of the scope of these rules. This issue points out the absence and needs for a suitable regulatory framework to deal with probable privacy issues in smart cities of India.

(D) Digital India Program

The Digital India programme is a flagship campaign of the Government of India with a vision to transform India into a digitally empowered society and knowledge economy¹⁹. The programme was launched on July 1, 2015 to ensure the availability of government amenities to citizens by electronic means and by improving online infrastructure and growing Internet connectivity.

The programme has nine separate pillars. Out of these nine pillars, two of them i.e., e-Governance and e-Kranti are directly linked with Aadhaar platform and present massive potential to use Big data algorithms. These two pillars plan for the restructuring of governance via digital technology and enable the delivery of services via electronic means. In the Digital India programme, the use of integrated systems and the arrangement of developing technologies like a cloud would be undertaken to improve the delivery of Indian Government services to citizens of India. The majority of the schemes of this particular initiative doesn't have a privacy policy in place to inform citizens about the manner of processing their personal data. While general guidelines may be adhered to in each scheme, no specific privacy guidelines are followed in these schemes. These schemes do not recognize the breach of privacy that users are exposed to. There is a complete absence of security measures in some of the schemes, while the remaining ones have taken some limited actions to protect privacy of individuals. Though some schemes have elaborate privacy policies, measures are taken by UIDAI²⁰ while dealing with electronic health records ²¹and the eSign scheme for Aadhaar²². There is an absence of any particular policy for the protection and privacy of personal information post access of such information that has been approved to UIDAI or any other external third-party agency. This implies a massive electronic collection of data from people and processing common standards for the exchange of data within the schemes, and possible distribution of personal data will be involved profoundly in this programme of the government.

V. Indian constitution and privacy

Under the Indian constitution, Article 21 is a comprehensive provision i.e., “No person shall be deprived of his life or personal liberty except according to procedure established by law.”²³The said provision has under its aegis, included the right to privacy. The Supreme Court of India has asserted that Article 21 of the Indian Constitution is the core of the Fundamental Rights. It is now recognized as a fundamental right by the apex court of India. In fact, it is established by the recent judgement of Justice K. S. Puttaswamy v. Union of India²⁴ that privacy is a necessary condition for the meaningful exercise of other guaranteed freedoms.

In the case of Selvi v. State of Karnataka²⁵, the Supreme Court held that “an involuntary subjection of a person to narco analysis, polygraph examination, and BEAP tests violates the right to privacy." It is noted that even with the enlarged scope of Article 21 of the Constitution covering right to privacy, yet any individual's privacy is still limited due to the lack of proper policy and framework. Unfortunately, government organisations and individuals involved in the processing of personal information are not covered under these regulations. Organisations, including corporate firms and association of individuals, are only governed by these regulations.²⁶

Even though India does not have a codified law in force concerning data privacy yet, certain aspects of data protection in the context of digital technology are covered under the Information Technology Act of 2000 and the Reasonable Security Practices and Procedures and Sensitive Personal Data or Information Rules of 2011 (‘Data Protection Regulation’). The vital restriction of the Data Protection Regulation is that ‘personal information’ is confined to information capable of recognizing a specific individual. Cases like the internet of things are not covered by these regulations. The restricted scope of sensitive personal information is an added limitation. As technology like the internet of things, enables abundant data collection, other sensitive personal information such as location and activity among others should be included under the scope of these data protection regulations.

The Personal Data Protection Bill (herein referred to as the "PDPB") is soon expected to become India's privacy law after receiving a green signal from the Parliament. The PDPB Bill is an almost mirror image of Europe's General Data Protection Regulation (commonly known as the "GDPR"). The Bill largely does restrict the consequences of automated decisions, especially by permitting people to control their personal information and its use. In particular, the PDPB Bill gives individuals a limited right to access, rectify, and delete their personal information. In fact, the Bill takes cognizance of profiling of people by automated processing and to some extent permits people to restrict such automated processing by profiling. Despite including such beneficial provisions, the Bill provides very limited protection against the harms caused due to automated profiling and decision-making, allowing the data protection authority of India to stipulate certain additional safeguards against profiling for only a particular category of personal information considered by the authorities to be sensitive.

VI. Global regulations around big data

In recent years, businesses and governments in different nations have guaranteed to advance big-data-based surveillance technologies and make arrangements for the strict management of digital technologies for public and national security. At the global level, cross-border transfers of personal information, the dependency of the increasingly global economy, have become a demanding concern for private organisations and government authorities.

(A) Europe

The two main essentials of General Data Protection Regulation (GDPR are the purpose limitation principle- the requirement of specific purpose and the compatible use restricts the practice of Big data analytics. This is so because most of the time when gathering and analysing data, the methods involved are such that neither the collecting organisation nor the individual (data subject) has considered at the time of collection. The core principle of GDPR pertaining to data minimisation that mandates personal data to be kept no longer than necessary places restrictions on the practice of Big data. This is because Big data analytics provides an opportunity to keep personal data for an unforeseen future. When Big data analytic is engaged, data from numerous sources fails to differentiate between general categories and special categories of personal data. This makes it problematic for Big data analytics to access and process all data in accordance with the GDPR.

(B) China

Several articles in China's recent Cybersecurity Law pertain to data collection and privacy protection. However, they take a state-centric approach, expanding the government's direct involvement in companies' operations. Missing in this approach is any support for an independent privacy watchdog or support for independent civil society organisations. For now, regulations on data protection remain largely domain-specific, such as those relating to telecommunications and online banking, which are issued by different ministries or local governments. The lack of a legal framework on privacy protection has led to open disputes over who has access to user data. Due to void in the current legal framework, disputes between companies over user data access will likely continue. A review of major Chinese big-data-related policy initiatives shows that many of those policies reflect special interest from Chinese authorities, its public security forces in particular, in potentially using data-driven analytic technologies for more effective and extensive surveillance and social control.

(C) United States (US)

Big data is regulated at a federal level and is done via different state laws. In United States, federal regulation of Big data is undertaken through numerous statutes. Privacy regulations come in the form of distinct laws and agency regulations. Most of the states in US have their regulations around personal data including Big data. Some of the most well-known privacy laws are Health Insurance Portability and Accountability Act (HIPPA). This law protects health information and controls the type of health data that can be released. Similarly, the Family Educational Rights and Privacy Act (FERPA) controls the privacy records of students in institutes. This act also places restrictions on personal data that can be collected and processed by third parties.

While federal statutes like HIPPA and FERPA regulate certain types of personal data, federal law surrounding Big data goes further than just collection. Big data is affected by state privacy laws, especially privacy laws to directly address online disclosures and record keeping. One example of a state privacy law is California’s Online Protection Privacy Act (CalOPPA), which requires internet site to offer clear privacy rights statements and allows users to recognize how their information will be used.

VII. Conclusion

In general, as individuals, we will intend to live our life without any unnecessary intrusion and will unconsciously, argue against the alarming effect of any tyrannical automated decision-making based on Big data analytics implemented by private organisations and government bodies. If we are conscious of the issue, we should be able to develop machineries and technologies to safeguard privacy and engaged with the individuals transparently while using Big data systems or analytics.

Big data, undoubtedly provides a plethora of benefits to the private and public actors to analyse various factors and provide services to the society with ease and make better decisions. However, only an insignificant percentage of data is analysed by the organisations. Despite the many benefits and fruits that we reap from Big data analytics, processing personal information using these algorithmic techniques poses serious risks to privacy. As new purposes of Big data processing continue to increase and even if the government plans to establish a regulatory framework for data privacy and protection in India, it needs to ensure that the framework is versatile enough to keep pace with evolving technologies in the era of Big data. In terms of healthcare services as well, more efficient privacy techniques need to be developed. The pressure is on the government to build a data protection law not just for the sake of applying them for processing personal information using Big data analytics but they also need to give a thought about how to apply them innovatively suiting the everchanging digital evolution trends. Also with the swift expansion of Internet of Things (IoT), there are heaps of concerns when IoT and Big data combine; the size of personal data is immense but at the same time the data are evolved from various data sources inherently possessing different types and forms of representation. This poses novel privacy concerns and open research questions. In the absence of a detailed data protection framework and with the increasing need for data collection and processing, the inadequate safeguards provided by the existing laws like Information Technology Act and Data Protection Regulations make it even more difficult to shield data privacy of individuals. These concerns are specifically apparent in the conventional manner of privacy policy implementation, the prerequisite of consent and notice, and the additional requirement for giving the individuals a choice to opt-out. Therefore, it is very evident that the problems of privacy and data protection concerning Big data be immediately taken into consideration and a comprehensive data protection framework, in line with the modern technological developments concerning processing of personal data using Big data analytics, be brought into force by the Indian government as the right to privacy is certainly inevitable.

*****