By Varunavi Bangia

Introduction: The Regulatory Lag

In the digital age, technology has outpaced the law. While innovations drive global progress, they simultaneously create a vacuum in legal oversight, leaving individuals vulnerable to threats that traditional statutes were never designed to mitigate. At the heart of this issue is a fundamental misunderstanding of the modern data economy. Currently, data protection frameworks globally are anchored in the principle of "informed consent"—the idea that if an individual agrees to data collection, their privacy is secured.

However, the reality of big data, inferential analytics, and knowledge discovery has rendered this "consent-first" model obsolete. Modern data practices do not merely monetize raw personal information; they synthesize vast, disparate datasets to create invasive, predictive profiles. This evolution has triggered what scholars call the "de-individualization" of the person—a shift where individuals are no longer treated based on their unique traits, but are instead reduced to members of categories, often without their knowledge or control.

The Anatomy of the Problem: Beyond Personally Identifiable Information

The core challenge in current legislation, including the various iterations of India’s Data Protection Bills, lies in the narrow conceptualization of "personal data." Regulations typically define personal data as information relating to a natural person who is directly or indirectly identifiable. This definition creates a massive regulatory blind spot: once data is anonymized or aggregated, it falls outside the purview of protection.

The Myth of Anonymization

Corporations and governments frequently argue that anonymized data is safe. However, in the age of big data, this is a fallacy. Anonymized datasets can be cross-referenced with other streams of information to enable re-identification. Moreover, even when identification does not occur, the impact of the data remains deeply personal.

For instance, an algorithm may categorize an individual as being "susceptible to a specific chronic disease." Even if that individual is never "identified" by name in the dataset, the categorization can lead to the denial of insurance, stigmatization, or employment discrimination. In these scenarios, the harm is real, yet the individual is left without legal recourse because the underlying data is categorized as "non-personal" or "anonymized."

The Inferential Gap

Current definitions of profiling under proposed laws like the Data Protection Bill 2021 are similarly restricted. They limit the scope of "profiling" to the processing of personal data. Yet, profiling is increasingly performed using data that is not—and was never—personally identifiable. By tethering protection to the "personal" nature of the input data rather than the "discriminatory" nature of the output (the inference), regulators have left an entire class of systemic abuse unregulated.

Chronology of a Regulatory Failure

The disconnect between law and technology has been a persistent theme in legal discourse over the last decade.

• 2012–2017 (The Foundation): The landmark Justice K.S. Puttaswamy v. Union of India ruling acknowledged that privacy is an essential component of human identity. Crucially, the Supreme Court recognized the dangers of data aggregation, noting that information innocuous in isolation can become invasive when combined into a digital profile.
• 2018 (The Srikrishna Committee): Despite the clear warnings from the Supreme Court regarding big data and knowledge discovery, the Srikrishna Committee Report—and subsequent parliamentary deliberations—largely failed to bridge the gap between traditional privacy and the realities of algorithmic profiling.
• 2019–2021 (The Legislative Impasse): While the government began recognizing "non-personal data" as an economic resource, the regulatory framework remained bifurcated. Personal data was viewed through a privacy lens, while non-personal data was viewed through an economic lens. This binary classification ignored the fact that non-personal data is the primary fuel for the group-based discrimination that modern algorithms facilitate.
• Present Day: The continued focus on individual-centric consent models in the face of mass-scale inferential analytics suggests that legislative bodies are still struggling to account for the "collective" nature of modern privacy harms.

Supporting Data: The Case for Collective Privacy

The shift in the data economy is not just quantitative—it is qualitative. Entities now actively "create" groups by clustering individuals based on shared, often perceived, behavioral patterns.

Categorizing Data

To move forward, we must abandon the binary of "personal vs. non-personal." A more effective taxonomy would be:

1. Human Non-Personal Data: Data that, while appearing anonymized, can be used to identify a person or a group. This should, by law, be re-classified as "personal data."
2. Non-Human Non-Personal Data: Data that is truly devoid of human characteristics (e.g., weather patterns, traffic flow) and remains so throughout its lifecycle.

The Jurisprudential Basis

The theoretical framework for protecting groups already exists within Indian jurisprudence. In Navtej Johar v. Union of India, the courts reaffirmed the identity-based protection of privacy. If an individual has a right to privacy based on their identity, that right must logically extend to their membership in a group that is being targeted by algorithmic bias.

Official Responses and Stances

Regulators have historically treated personal data as the sole subject of privacy laws, while viewing non-personal data as an "untapped economic resource." This has created a false dichotomy where privacy is often presented as being in conflict with economic development.

The Joint Parliamentary Committee (JPC) has acknowledged the need to regulate non-personal data, yet their proposals often miss the nuances of how such data is used to profile individuals. By failing to regulate the use of this data in creating group profiles, the government has essentially provided a loophole for entities to bypass privacy obligations simply by stripping data of direct identifiers before processing it.

Implications: The Need for "Categorical Privacy"

To prevent the rise of a society governed by algorithmic discrimination, we must implement a new paradigm: Categorical Privacy.

1. Redefining Collective Rights

We must stop treating privacy as a purely individualistic right. Instead, it should be viewed as a collective right that protects individuals from the consequences of being part of an "algorithmic group." This right is not about the "ontological status" of the group, but about the harm caused to individuals when they are targeted based on group characteristics.

2. Prioritizing Ex-Ante Accountability

We need to move beyond "notice and consent" to "hard accountability." This includes:

• Algorithmic Impact Assessments: Before deploying a profiling algorithm, organizations must conduct audits that go beyond security to evaluate the social and ethical consequences, specifically looking for bias.
• Auditability: Regulators must have the power to demand transparency in how algorithms arrive at decisions. If an algorithm systematically discriminates against a specific group, the entity behind it must be held liable, regardless of whether they used "anonymized" data.
• Incentive Restructuring: Governments should create disincentives for the wrongful use of aggregation technologies, effectively making the cost of discriminatory profiling higher than the profit derived from it.

Conclusion

The current trajectory of data regulation is insufficient. By clinging to the individual as the only unit of analysis, we are leaving millions of people exposed to the invisible, discriminatory consequences of mass-scale profiling.

The path forward requires a shift in the regulatory mindset. We must recognize that in a world of big data, the collective is just as important as the individual. Privacy, in the 21st century, must be understood as a defense against the systemic power of those who control the algorithms. Until we treat inferential data as a potential instrument of harm—and regulate it accordingly—the fundamental promise of privacy will remain a broken one.

Disclaimer: This research was supported by the Facebook India Tech Scholars Program 2021-2022. The work was conducted under the mentorship of the Software Freedom Law Center and does not reflect the oversight or official views of Meta.