Privacy safety not data-use regulation

Concerns have been raised that the Digital Personal Data Protection Bill, which was passed in Lok Sabha by voice vote on Monday, does not address the regulation of generative AI. Such concern may be misplaced as the nature of privacy protection is distinct from that governing use of data collected from consumers. The first deals with giving consumers rights to data they share with business and government. Privacy protection requires rules for collection, storage and deletion of individuals' data. The second stage involves ensuring data is not used to subvert individual choice. Here, the need is to ensure access, transparency and accountability for the deployment of machine learning (ML) systems.

The two sets of rules will have to work in concert to avoid errors of judgement. AI can amplify biases in large data sets and reach erroneous conclusions that may be damaging for business and governance. Algorithms are proprietary, and seeking disclosure requires incursion into intellectual property, something India has traditionally not put much value in. Likewise, the human-machine interaction in decision-making is case-specific. Human accountability for machine-assisted decisions also needs a separate set of guidelines. These rules will also have to cater to technologies further down the pipeline, such as quantum computing, with even more scope for disruption than AI.

But data protection legislation on its own is inadequate to deal with the current state of technology. Generative AI is facing legal challenges over copyright infringement. This is one example why the regulatory architecture has to deal with ownership of data at all levels of processing. Medical breakthroughs based on population-wide data would, for instance, require some ceding of ownership alongside defined protocols on how AI will process it. India has taken a considerable amount of time to draw up privacy protection. Similar delay over making AI responsible would lend credence to worries that regulation is behind the curve. It should begin the process of drafting rules immediately.