Data privacy in the age of chatbots

DPDP's consent framework may struggle to keep pace with GenAI platforms, given their global architecture and rapidly evolving data models

- RISHI RAJ

IN HIS LATEST book, Nexus: A Brief History of Information Networks from the Stone Age to AI, Yuval Noah Harari has shared an interesting insight from Geoffrey Hinton, a former vice president and engineering fellow at Google and widely regarded as the godfather of artificial intelligence (AI), which in hindsight appears to be quite strategic.

Hinton says that Google's decades of offering free services to users was never really about altruism. It was simply about one thing: data.

Fast forward to the present times, and you will realise the boast wasn't empty and what that data has provided not only to Google but to all big tech firms today. The government is close to releasing the rules governing the Digital Personal Data Protection Act (DPDP), enacted in 2023, which is seen as a landmark legislation aimed at safeguarding individual privacy and regulating the opaque usage of personal data by corporations and platforms. The question is whether the efforts through DPDPwould succeed in checking or curbing this practice, especiallywith the rise of generative AI (GenAI) platforms like ChatGPT, Gemini, and others.

Let's examine. The DPDP Act basically aims to establish a structured framework for how personal data is collected, processed, and protected. It mandates that organisations, termed data fiduciaries under the law, obtain informed, specific, and explicit consent from data principals (users) before processing their data. The law enshrines rights around data access, correction, deletion, grievance redress, and imposes rigorous accountability on entities handling sensitive data. Further,