Privacy Vs. Property: Reconciling DPDP Erasure With Database Copyright In India
Jaynam Shah, B.Com & LL.B., SVKM’s Jitendra Chauhan College of Law, University of Mumbai
Adv Sanika Kurlekar, B.Com & LL.B., Padmashree Dr DY Patil University
ABSTRACT
The emergence of the digital economy has rendered structured databases valuable business assets for companies active in industries like finance, healthcare, retail, technology and research. Computer databases and compilations are classified under the category of 'literary works' in India's copyright regime in case of the necessary originality of selection or arrangement. Further, the DPDP Act 2023 provides statutory rights and duties regarding the processing of personal data records, including consent withdrawal and erasure. Thus, the relationship between the two legal regimes poses an interesting legal and commercial question of what would happen to the usefulness and value of a database in case of the illegality of further processing or erasure of the personal-data records in it. In this article, it is argued that the problem is not one of the direct destruction of the copyright by data protection law, because copyright arises from the originality of selection or arrangement of the records in the database, while DPDP Act regulates processing of the personal data records. However, deletion might change the structure, completeness, analytic utility and economic value of the database. While Section 38 of DPDP Act provides the rule of conflict with other laws, there is no detailed statutory framework dealing with the intellectual property issues, contractual considerations, valuation issues, and technical implications of database thinning. The article thus outlines ways that include privacy-enabled database design, consent mechanism and data lineage system, contractual arrangements in data-driven transactions, anonymization standards, and improvements to research and archival aspects.
Keywords: DPDP Act 2023, database copyright, consent withdrawal, erasure, personal data, Section 38, Section 8(7), Section 12, anonymisation, data assets.
