IAMAI seeks exemption for AI firms from certain data privacy rules in using publicly available personal data

The Internet and Mobile Association of India (IAMAI) has made a significant request to the central government, advocating for a relaxation of legal constraints surrounding the use of publicly available personal data for AI model training and refinement. In a statement issued on Thursday, the IAMAI expressed concern that the existing data protection regulations hinder AI firms from confirming whether the personal data they utilize was genuinely shared with consent. According to the Digital Personal Data Protection Act of 2023 (DPDP Act), companies are obligated to verify if personal data was voluntarily provided. However, the IAMAI highlighted that public information is frequently re-shared without the original user's approval. A common scenario occurs when data is initially posted to meet a legal requirement and is subsequently republished by others, complicating the process of obtaining user consent for each individual data point. In light of these challenges, the IAMAI suggested that the government consider exempting data fiduciaries from the DPDP Act's stipulations when they are using personal data exclusively for the purpose of training or fine-tuning AI models. The association also conveyed its concerns to the Ministry of Electronics and Information Technology (MeitY), pointing out that unclear elements within the DPDP Act could pose practical obstacles for AI developers, particularly those handling extensive datasets. The IAMAI warned that imposing strict regulations on access to publicly available personal data could lead to considerable compliance costs, hinder innovation, and unfairly impact startups and smaller companies that are striving to develop AI technologies. The DPDP Act represents India's comprehensive effort to establish data privacy standards, aiming to balance individual rights to personal data protection with the necessity for lawful data processing. It mandates accountability for data fiduciaries in the event of breaches and requires the implementation of suitable technical and organizational safeguards.