Rethinking AI In Indian Courts: The DPDP Challenge And The Future Of Digital Justice

While regulating the use of AI is much required, there appears to be incoherence between the DPDP Act and the draft AI Regulation introduced by the Supreme Court. The DPDP Act itself creates a wide exemption for courts and tribunals where processing is necessary for judicial, quasi-judicial, regulatory or supervisory functions. As such, in so far as AI Regulations refer to the principles outlined under DPDP, this will not be fully applicable to judicial processing cases as most of the DPDP obligations notice, consent, access, correction, erasure and grievance rights do not apply in such instances. This leads to a regulatory dissonance as the AI framework seeks data protection rigor, but the overarching privacy regime carves overly sweeping functional exemptions from judicial scrutiny.

Open courts and privacy must be balanced carefully

Difficulties arise in navigating the system and realising the potential violation of right to privacy. Regulation 10 rightly provides for ‘Data protection and Privacy’, maintaining that purpose limitation, data minimisation and data privacy shall be governed by DPDP Act. However, it is questionable as to who will be the ‘Data Fiduciary’ and the process of enforcement of the duties of such data fiduciary in accordance with the DPDP Act. According to the Act, “Data Fiduciary” means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data. In the case of use of AI in judicial process, there is involvement of multiple heads including advocates, court officers and judges. This leaves room for more complexity in identifying the data fiduciary and the potential data breach. A provision under the regulation clearly identifying the data fiduciary could ideally resolve some complexity that may possibly arise.

Contrasting Regulatory Authorities

There appears to be conflict in the provisions regarding the regulatory authority: as for the aspects falling under the DPDP Act, the role of Data Protection Officers and Data Protection Boards is critical and the Boards under the Section 33 of the DPDP Act are empowered to impose monetary penalties extending up to 250 Crores depending upon the severity of the offence; as for the violation of the Regulation for Use of AI, the AI Committee or the concerned courts as the case may be (under Regulation 52 and 53) will decide the remedial measures. Adding to this is Section 39 of the DPDP Act, which imposes Bar of Jurisdiction of courts on the matters falling under the DPDP Act. This gives rise to challenges in the regulatory ambit that the Data Protection Board and the AI Committees/ Courts have.

DPDP rights may be weakened by judicial exemptions

Additionally, the regulations have made an attempt to highlight the permissible use and prohibition of use of AI under Regulation 19 and 20 respectively. Regulation 20 specifically highlights strict prohibition of AI in certain court proceedings, calling it out as absolute and non-derogable in the absence of giving sufficient remedial measures of instances of violations of those guidelines. Regulation 21 has empowered the AI Committee established under the Regulation to direct remedial measures without providing sufficient parameters for determination of such violations and suggesting the upper cap of the remedy to be suspension of relevant AI system. In this context, it appears that there is a gap from intent to letter of the regulation.

Data collected in court for adjudication should not automatically become data for training AI systems

Demurrals can also be witnessed in the provisions relating to data integrity under Regulation 14, suggesting that the AI systems have to be trained to ensure accuracy and avoid bias. It is practically difficult to train the AI models without feeding it the large scale information. The algorithmically developed model will not be able to generate outputs based on any reasoning. In the judicial realm, there are myriad social issues that exists in multiple folds, which the AI system need to be trained for. For instance, the facts of a particular case, the background of the parties involved and the various legislative frameworks that have been referred to. The infiltration in this data has the potential to encroach on the privacy rights of the individuals without their knowledge. In the absence of a overall AI regulating legislation, the multiplicity of these issues is hard to be resolved.

Conclusion

While the initiative of the Supreme Court is welcoming to the technologically growing world, it is utmost essential to draft such frameworks with precautions, ensuring the larger impact on the deprived classes and security to the basic rights ensured under the Constitution of India. The real challenge is not whether courts should use AI, but whether judicial AI can be made compatible with India’s emerging privacy framework. There is, however, a constitutional tension here: that is the very institution engaging with some of the most sensitive personal data may operate in a way that is fully beyond the traditional data protection rights. Thus the final AI Regulations must not only be DPDP compliant in form, but should also design a separate judicial data protection architecture. In the absence of this, AI-based courts could enhance efficiency but at the cost of privacy, dignity, due process and trust, which overrides the ideals of a Viksit Bharat.