NOTES AND COMMENTS Regulating Artificial Intelligence under Data Protection Law: Challenges and Solutions for India

Abstract

As India moves toward enacting a comprehensive data protection legislation, it becomes essential to examine the possible application of India’s proposed data protection law to the use of Artificial Intelligence (AI). The various challenges posed by AI to data protection principles and data principals’ rights need to be examined. The need for data maximisation in the use of AI challenges the principle of collection limitation. The difficulty in anticipating the processing purposes of AI challenges the principle of purpose limitation. With a brief introduction to AI and data protection law in India, the paper examines the compatibility of various data protection provisions under India’s Digital Personal Data Protection Act, 2023 with AI. The paper also provides recommendations for data protection regulation of AI. The paper proposes the need to hold data fiduciaries accountable using Data Protection Impact Assessments, Codes of Practice and Security Measures. Besides, there is a need to define the fiduciary duty of care between the data principal and data fiduciary. There is a need recognize data protection by design and default and the Right against automated decision making. Technical solutions need to be explored, but at the same time, AI must not be over-regulated. Lastly, there is a need for flexibly interpreting the provisions of the proposed data protection law.