This post, analysing the legal viability of human implants in the Indian context, is authored by Tanusha Tyagi and Anabhra Chatterjee, fourth-year students from Vivekananda Institute of Professional Studies, GGSIPU, New Delhi
Microchipping: The Shackles of Technology?
“Technology is a useful servant but a dangerous master.”
—Christian Lous Lange, Historian
It appears that people are figuring out methods to disrupt their lives in the midst of attempting to make them easier. Nowadays, us humans leave more digital footprint than our carbon footprint. As technology develops, we voluntarily divulge more and more personal information, which proves to be fatal in this ever-advancing world. Rapid technological development is a two-edged sword, which necessitates lawmakers to strike a delicate balance between privacy, data protection, autonomy, and accessibility. With the continuing proliferation of implantable computing technologies for a variety of applications, interest in exploring the incipient technical, psychological, legal, ethical and social issues of human ICT implant devices has grown.[i]
A human microchip implant is typically an identifying integrated circuit device or RFID (Radio-Frequency Identification) transponder encased in silicate glass and implanted in the body of a human being. This type of subdermal implant usually contains a unique ID number that can be linked to information contained in an external database, such as personal identification, law enforcement, medical history, medications, allergies, and contact information. One primary issue with such chips is the uncertainty of how much more advanced they will become in the future and how much personal private information they will collect. Secondly, there are issues with the security of data – whether the information is secure and whether a person could be tracked using the microchips. These chips are sometimes called ‘an extension of the internet of things’ (IoT), meaning it is a way to exchange data.
This article will examine why microchipping individuals is a privacy infringement that has grave repercussions because the wide range of private information collected about them over time can be accessed with a snap of the fingers. Furthermore, we aim to analyse how the existing laws with the proper intent may prove to be adequate for this new technological advancement.
Human Microchipping and Uberveillance : The Crippling Dimensions of Privacy
The Apex Court has often reaffirmed that Article 21 is to be interpreted expansively. With the growing technological age, the dimensions of privacy have been changing. In KS Puttaswamy the court observed, the right to life and personal liberty are inextricably linked with the protection of one’s right to privacy. Under Article 21 and as a part of the freedoms guaranteed by Part III (fundamental rights) of the Constitution, the sphere of privacy includes a right to protect one‘s identity, meaning that all information about a person is fundamentally their own, and they are free to communicate or retain it for themselves. This core of informational privacy, thus, is a right to autonomy and self-determination in respect of one‘s personal data.
Health data is one of the most sensitive types of personal data, and the impact of a data breach can have grave consequences.[i] Human implants collect data automatically and constantly from sensors implanted in human subjects which is not the case with other devices. The chip in these implants can access functions of the body which can render intimate private emotions, biological bodily functions and healthcare data vulnerable and best online casino india at the mercy of a third party, waiting to be leaked or misused. The end-user and data subject do not have the freedom to leave the device at home. Thus, these devices form a particularly sensitive part of the private sphere of the users, demanding high data protection standards. In India data gathering practices are usually opaque, mired in complex privacy forms that are unintelligible, thus leading to practices that users have little control over.
Protection of sensitive personal data or information is currently governed by the SPDI rules as well as IT Act, 2000. SPDI Rules provide a narrow definition of “sensitive personal data or information”, leaving out several categories of personal data from its protective remit.[ii] According to a strict interpretation of Section 43A of the IT Act, its responsibilities do not apply to the government and can be superseded by way of contract. Due to a lack of adjudicatory authorities, the execution of the IT Act and SPDI Rules has also encountered difficulties. Furthermore, the Data Protection Bill, 2019 (“DPB”) was introduced with the promise of safeguarding the rights of the citizens, however, due to its inadequacy to serve the purpose it never became an act. The scrapping of the DPB may turn out to be a blessing in disguise as legislators can now take on data protection with a futuristic strategy that balances citizens’ privacy rights without impeding the development of ever-advancing technology.
To remove any potential for ambiguity, specific provisions regarding human microchipping must be added to the previously existing laws and rules. The current framework will make it easy for governments, companies or the police to electronically ‘frisk’ citizens via chip readers placed in public places. Provisions can be introduced in the existing laws under which the companies and state agencies have to adopt a ‘privacy-by-design’ approach, under which the individual has a clear set of opt-out options, wherein the processing of personal data entails giving individuals complete control over data privacy.
Chain of Command: An Incumbent ‘Act’?
Caveat Venditor imposes a duty on the sellers to provide high-quality products for the consumers. Therefore, standardised quality becomes crucial when injecting a microchip into a person’s body. Thus, a regulatory authority with in-depth expertise is essential to oversee that the medical and ethical standards for the production of the chip are upheld.
The Medical Devices Rules, 2017 which were made under section 12(1) and section 33(1) of the Drugs and Cosmetics Act, 1940 have proved to be effective legislation to bring under the fold of the act ‘medical devices’ which are used in the healthcare framework of the country. Both drugs and few notified medical devices are now regulated by the Central Drugs Standard Control Organisation (CDSCO) under the health ministry. However, there still lacks a clear legislation for regulating all kinds of medical devices. In 2019, the Niti Aayog suggested regulations for medical devices and an independent regulator for the sector. Patients who experience harm from defective medical implants and gadgets would be allowed to seek compensation from the device’s importer or maker under the proposed regulatory system. The ministry did not see the need for a completely independent legislation for the same and therefore, this idea was never put into motion. However, in order to maintain the core of the proposed legislation by the Niti Aayog, an explicit addition of the term ‘devices’ into the Drugs and Cosmetics Act can impose the quality control standards that are desired for medical as well as the upcoming microchips which can be seen as technological devices implanted into the human body.
Conclusion
The microchip implants will definitely prove to be a huge technological leap, but without the right kind of legislative preparedness, this can lead to more problems than solutions. In recent years, whenever our country was faced with a legal blindspot the legislators have often opted for a new legislation with the aim to curb the issue at hand. However, with the continued additions of legislations, complicated legal jargon has somewhere lost the objective of enacting laws. Thus, in order to address the issue of the microchip implants, it is suggested that the existing laws are amended and the prevailing legal principles are interpreted broadly to bring the implants under these laws. This will enable the judiciary with wide powers to carry out judicial activism in order to interpret the laws best suited for the social, political, economical and technological fabric of the country. The Indian legal system is based on the power of judicial activism, which transforms the Indian Constitution into a living document.
[i] Carmen Camara and others ‘Security and privacy issues in implantable medical devices: A comprehensive survey’ (2015) 55 Journal of Biomedical Informatics 272-289.
[ii] Graham Greenleaf, India – Confusion Raj with Outsourcing in Asian Data Privacy Laws: Trade and Human Rights Perspectives (Oxford University Press, 2017) at p. 415.
[i] Mark Gasson, Eleni Kosta and Diana Bowman (ed.), Human ICT Implants: Technical, Legal and Ethical Considerations (TMC Asser Press, 2012).