By Varunavi Bangia

In an era defined by the rapid proliferation of Big Data, inferential analytics, and artificial intelligence, the traditional pillars of data protection are cracking. For decades, legal frameworks across the globe have anchored themselves to a singular, narrow concept: informed consent for the collection of personally identifiable information. However, as technological capabilities outpace regulatory scrutiny, this foundational approach is becoming increasingly obsolete. We are moving toward a future where our privacy is not just threatened by the misuse of specific data points, but by the systemic categorisation of our very existence.

The Mirage of Anonymisation and the Data Economy

The current regulatory architecture is built upon a binary distinction: data that can identify a natural person and data that cannot. Under this regime, once data is anonymised, aggregated, or generalised, it essentially exits the domain of data protection. This is a critical oversight. In the modern data economy, the value of information is no longer solely derived from individual personal data, but from "knowledge discovery"—the ability to draw deep, often invasive inferences about individuals based on their inclusion in specific datasets.

Scholars describe this phenomenon as the "deindividualisation of the person." Rather than treating a user as a unique individual with distinct characteristics, algorithms treat them as a data point within a cluster. By cross-referencing massive, diverse streams of information, corporations and governments can build profiles so complete and invasive that they often predict individual behavior better than the individuals themselves. Even when data is technically anonymised, the sheer volume of available information allows for sophisticated re-identification, rendering the "anonymised" label a legal fiction.

The Mechanics of Categorical Discrimination

The most consequential harm arising from these practices is not necessarily the loss of privacy in the traditional sense, but the application of inferential data for discriminatory purposes. When an algorithm determines that an individual belongs to a group susceptible to a specific health condition, a specific financial risk, or a particular social behavior, the impact is tangible.

Consider the real-world implications: an individual could be denied insurance, barred from specific employment opportunities, or subjected to social stigmatisation based on a group profile. Often, this happens entirely without the individual’s knowledge, as they are never informed that their treatment is the result of a "categorisation" rather than an individual merit assessment. Because current laws focus almost exclusively on personally identifiable information, this entire class of profiling—which relies on aggregated, non-personal, or inferred data—remains largely unregulated.

The Regulatory Gap: Why Current Bills Fall Short

The Data Protection Bill 2021, like many of its predecessors, attempts to address profiling but ultimately falls into the same trap: it limits its scope to the processing of "personal data." By doing so, it effectively provides a loophole for companies to build pervasive profiles using anonymised or non-personal data.

There is an urgent need to redefine "personal data" not by the nature of the data collected, but by the nature of the inferences drawn. If an inference is used to identify, categorize, or impact an individual or a group, it should fall under the protective umbrella of data law. The current dichotomy between "personal" and "non-personal" data—where the former is protected and the latter is treated as an economic resource—is a false one. In reality, these two categories are inextricably linked in the age of big data.

Moving Beyond the Individual: The Case for Collective Privacy

To address these harms, we must fundamentally shift our conception of the right to privacy from an individual-centric model to one that incorporates group-based protections.

1. The Nature of Generated Groups

Traditional group rights models often rely on the existence of established communities with shared loyalties. However, digital profiling often creates "groups" of people who have no prior connection to one another. These clusters are formed based on perceived behavioural patterns. A regulatory framework must recognise these "generated groups" as subjects of privacy. The violation of a group’s privacy, through invasive profiling, should be actionable as a direct consequence of an individual’s membership in that group.

2. Categorical Privacy

As an alternative to traditional collective rights, we should adopt the concept of "categorical privacy." This approach suggests that even if data has been processed to the point where it can no longer identify an individual, if the data retains identifiers of group identity that lead to discriminatory outcomes, it must be protected. This moves the focus from confidentiality—keeping secrets private—to protection against harm—preventing discriminatory social surveillance.

3. Ex-Ante Accountability

Regulators must move away from the "notice and consent" paradigm and toward a model of "hard accountability." This includes:

• Algorithmic Impact Assessments: Before deploying profiling technologies, entities should be required to conduct rigorous audits to test for bias, discrimination, and ethical consequences.
• Regulatory Oversight: Developing the capability to audit algorithmic decision-making, ensuring that companies cannot hide behind the "black box" of proprietary technology to escape liability for discriminatory outcomes.

Jurisprudential Foundations in India

The Indian constitutional framework, particularly the landmark Puttaswamy v. Union of India judgment, provides the theoretical basis for this shift. The plurality opinion by Justice Chandrachud recognised that privacy is an essential expression of individual identity. The Court further acknowledged the dangers of aggregation, noting that information which may appear harmless in isolation can, when combined, create a detailed profile that invades an individual’s dignity.

Despite these warnings from the judiciary, the legislative process—including the Srikrishna Committee Report and the various iterations of the Data Protection Bill—has failed to internalise the risks posed by big data analytics. While the government has correctly identified the need to regulate non-personal data, it has largely viewed it through the lens of economic potential rather than social protection.

Implications and The Path Forward

The path forward requires a re-evaluation of how we regulate the digital economy. We must abandon the idea that privacy protection is a hurdle to economic growth. Instead, we must view robust, group-aware data protections as a necessary infrastructure for a fair digital society.

If we continue to view privacy as a purely individual right, we are essentially leaving our citizens vulnerable to mass-scale discrimination by algorithms they cannot see, challenge, or control. The goal of the next generation of data legislation must be to ensure that the power to aggregate and analyse data does not become a power to systematically disadvantage the vulnerable.

The challenges posed by inferential analytics are not merely technical; they are deeply political and ethical. As we move toward a more digitised society, our legal frameworks must be as sophisticated as the technologies they seek to govern. We need to create a landscape where "hard accountability" is the standard, and where the dignity of the individual is protected, even when they are being viewed through the lens of a group.

Note: This research was supported by an unrestricted scholarship pursuant to the Facebook India Tech Scholars Program 2021-2022. The work was conducted under the research mentorship of Software Freedom Law Center and without any oversight from Meta. The views expressed herein are those of the author and are not necessarily those of Meta or the Software Freedom Law Center.

References Summary:

• Vedder, A. (1999). KDD: The challenge to individualism.
• Rubinstein, I. S. (2013). Big Data: The End of Privacy or a New Beginning?
• Justice KS Puttaswamy and Anr v. Union of India and Ors (2017).
• Mantelero, A. (2017). From Group Privacy to Collective Privacy.
• Data Protection Bill, 2021 (Relevant Sections 2 & 3).