The 'legitimate' excuse of assumed consent

Time of India

8 hours ago

By Priyam Sharma
Imagine being curled up on your sofa, giggling while watching cat memes on social media, and then suddenly seeing a post of yourself by your nutritionist. Highlighted in bright yellow and green are your name, health issues, and the weight loss they claim to have caused with '
best results
' (because you chose to eat greens, but that's another story). In disbelief, you check the post: your picture zoomed in, the unblurred before-and-after version, your name and health details served up like a rationalised
bhel puri
to the
janta janaardhan
, all so they can trust and choose this nutritionist, the self-acclaimed people transformer. When confronted, this nutritionist says the most cliché thing ever: '
Oh, I thought you were okay with sharing. This post was meant to inspire others
.'
Think of a gym trainer proudly posting your before-after transformation shots and your abs, or a hospital showcasing your recovery story on their Instagram handle all without expressly asking if you were okay with it. From fitness apps flaunting user weight-loss journeys to clinics broadcasting patient recoveries, the line between consent and assumption blurs dangerously under this broad notion of '
legitimate use
.'
While Indian law has been fairly clear on this point for years, the Information Technology Act, 2000 and its rules explicitly state that no body corporate (a term broad enough to include firms, sole proprietors, partnerships and others engaged in commercial or professional activities) can share such
sensitive personal data
without
explicit consent
, failing which it attracts liability under Section 43A. This right also flows from the broader right to life and personal liberty under Article 21 of the Constitution, as reaffirmed by the Supreme Court in K. Puttaswamy vs Union of India (2017) 10 SCC 1, which recognised privacy as a fundamental right.
But does the new Digital
Personal Data Protection
Act, 2023 (DPDP Act), enacted to build a robust data protection framework for India's digital ecosystem, offer equally airtight safeguards? Section 6 of the DPDP Act certainly appears to do so: it requires that consent must be '
free, specific, informed, unconditional and unambiguous
,' underlining that it cannot simply be presumed.
However, Section 7(a) then steps in and introduces a potential grey area. It states that when a person has voluntarily provided their personal data to a
data fiduciary
and has not indicated that they do not consent to its use, the data fiduciary may process it, so long as it is reasonably expected for that purpose.
But here lies the catch: Section 7 itself carries the heading '
Certain Legitimate Uses
,' but the actual text of 7(a) does not define the phrase '
legitimate uses
' leaving much to interpretation. What it effectively means is that a data fiduciary can process such voluntarily given data without seeking fresh explicit consent, provided it's for the purpose it was reasonably expected for, and the individual did not expressly object. This creates room for contrasting interpretations: some might argue that once someone has shared their data and hasn't said '
don't use it
,' the door could be interpreted as wide open particularly in the absence of clear statutory safeguards or regulatory guidance on what constitutes '
reasonable expectation
.' Others would insist that the individual remains the sole decider of what they have explicitly consented to, knowingly or unknowingly, and that silence or ignorance cannot morph into blanket consent for any kind of processing under Section 7(a).
Meanwhile, sub-sections (b) to (i) of Section 7 are considerably more specific:
(b) deals with situations where a person disclosed data to avail benefits like subsidies from the State,(c) allows sharing for performance by the State or in the interest of sovereignty and security,while (d) to (i) cover compliance with laws and judgments, responding to medical emergencies, providing medical treatment, employment-related uses, and safeguarding the employer.
The scope of Section 7(a), therefore, must necessarily be analysed case by case, considering the facts and the clear intent of the person providing the data. In the earlier example, the person's disclosure of medical history was strictly for obtaining a health plan it can hardly be stretched to justify broadcasting it on social media.
Because tomorrow, it might not just be your weight. It could be your genome, your mental health history, or the trail of everywhere you've been.
Is that really the future of consent we are comfortable with?
(The author is an advocate practising before the Bombay High Court, with prior experience at Crawford Bayley & Co. and Cyril Amarchand Mangaldas. Views expressed are personal.)