Feeding too much of sensitive data into ChatGPT is going to have its ramifications

Dr. Pavan Duggal, Expert in Cyberlaw and e-commerce law- Supreme Court of India    

“We are all connected with data. A lot of new developments are taking place in the area of data. Many of us are using ChatGPT nowadays. So, the next time ChatGPT gives you data and you put that as your own, what kind of ramifications could that have for you? A certain company wanted to get some sales programs and proposals and tasked the sales team to do so. The sales team uploaded the complete corporate data on to ChatGPT, got the stuff back and cut and pasted it back into the company's account. Little did they realize that they were actually giving so much of corporate data out there, and which is bound to create its own legal issues and challenges. So, in this context, when I talked about data protection, I mean a different ballgame altogether. Around 12,000 SBI employees’ sensitive personal data has been leaked on telegram channels and it still is available. It's not normal data but sensitive personal data. Prime Minister Narendra Modi recently announced that the Indian data protection law is now going to be a great leaping step forward because it's going to help increase India's reputation globally. The monsoon session is coming in and the new Digital Personal Data Protection (DPDP) bill 2023 is listed to be passed. This particular bill has got a distinctive journey. In the last five to six years, we have been deliberating various options and drafts of this bill, and now we have reached at a reasonable level of maturity and how we ought to go forward. The final draft of the digital PDP bill 2023 is still not out in the public domain. So,it's hard to really comment on the exact parameters of this bill till such time the exact draft is going to be out.”  
 

My knowledge is again going to be limited to what's happening in the public domain. I take you back to 2018 when the government had appointed Justice Srikrishna committee; the committee had come up with a report and had come up with a personal data protection bill draft in 2018. From those days till 2023, it’s been a long journey. The last version that we know about is the draft digital personal data protection bill 2022. For the first time, a very expansive definition has been given data principal - who's the data principal, it's any individual about whom the personal data relates to, and also includes a child below the age of 18 years, while also including the parent and even the lawful guardian. For the first time they wanted to define what personal data is and this personal data is any data about an individual which is identifiable by or in relation to such data. So, it is anything, which identifies a particular individual who gets within the parameters of personal data.  

Now for the first time, this particular law is going to actually stipulate data fiduciaries - whether you are within India, or whether you are outside India, to provide data principals with the notice and to set a couple of things like what personal data is about to be collected and the purpose for which this personal data has been collected and will be processed. This has to be provided either on or before the exact moment when you are requesting the data principals of the proceedings. So, in India, we are all from the joint family setup, we love to share information and in this ecosystem for the first time the law is saying that my consent will have to be taken and this content will have to be very crucial. If you don't comply with this, just tighten your belts and be prepared for fines ranging from 150 crore rupees to 500 crore rupees per contravention.”