The Account Aggregator system has implemented most data protection principles directly into code. With one exception - use limitation. A recent paper offers a technical solution to this problem through sharding and confidential multiparty compute.

In the rush to embed AI into their practice, most law firms have not realised how disruptive this could be to the way in which the business of law has traditionally operated. If we replace junior lawyers with AI that can do their work, how will we train the senior lawyers we need?

The individual agency that privacy laws offer were designed for a time before networked privacy. As a result we cannot just rely on laws and regulations to protect our data but need to do considerable additional work to secure it.

As we rely more and more on AI for information it is almost inevitable that companies will try to game the answer these AI chatbots provide to ensure that information favourable to them bubbles to the top. This has already begun to happen and it is only a matter of time before AI optimisation replaces SEO.

The decision to ban the use of camera traps in private estates is typical of the kind of reflexive over-reach our government officials often resort to. In this instance, not only is there little legal substance behind the order, the long-term consequences are misaligned with the objective.

The question of what is to be done with personal data in the course of an M&A transaction is always complicated. It becomes even more so when the data in question is highly sensitive genetic information that was collected for a specific purpose. We need to think through these issues as the Indian law comes into force.

We have built our data protection laws on the edifice of consent. As a result, they are based on constructs that are derived from contractual frameworks. While this may have been acceptable in the early days of privacy law, the harms they need to protect against today are perhaps more effectively dealt with under tort law. We need to re-think consent.

While data protection laws are, for the most part, domestically focussed, when personal data has to move across border they need to work well with each other. But before that can happen, countries need to agree on the principles of interoperability.

AI really comes into its own when we need customised solutions at scale. If we can identify use cases in which human intervention is simply not practical given the complexity and diversity of outcomes, AI might just be able to offer a way out. Such as, for instance, to provide bespoke education outcomes.

India’s latest DPI focuses on leveraging non-financial data. By offering API-based access to a number of different data sources it will give lenders additional ways in which to evaluate the credit-worthiness of potential borrowers.