Shadow Profiles And The Right To Be Forgotten: A Gap In India’s DPDPA
- IJLLR Journal
- May 7
- 2 min read
Daksh Verma, Law College Dehradun, Uttaranchal University,
Prof. (Dr.) Anil Kumar Dixit, Law College Dehradun, Uttaranchal University
ABSTRACT
The Digital Personal Data Protection Act, 2023 marks a watershed moment in India’s privacy jurisprudence, operationalising the constitutional guarantee articulated in Justice K.S. Puttaswamy v. Union of India through a consent-centric architecture. Yet the Act’s reliance on a binary relationship between the “data principal” and the “data fiduciary,” combined with its restrictive definition of personal data, leaves a structural lacuna: the phenomenon of shadow profiles. Shadow profiles—dossiers algorithmically constructed from inferred attributes, contact harvesting, device fingerprinting, and third-party disclosures concerning individuals who have never registered with or consented to a particular data fiduciary—exist at the periphery of the DPDPA’s protective ambit. This article contends that the right to erasure under Section 12 cannot reach these profiles because (a) the statute presumes a consensual touchpoint between data principal and data fiduciary; (b) inferred and derived data, which constitutes the very fabric of shadow profiles, finds no explicit recognition; and (c) non-users—the principal subjects of shadow profiles—lack effective standing under the Act. By contrasting the DPDPA’s approach with Article 17 of the General Data Protection Regulation and the European Court of Justice’s jurisprudence beginning with Google Spain v. AEPD, this article demonstrates that India’s right to be forgotten is most deficient where it is most necessary. Drawing on the proportionality test in Puttaswamy, the article advances four reforms: explicit statutory recognition of inferred data; a disclosure-and-erasure right for non-users; mandatory shadow-profile auditing for Significant Data Fiduciaries; and a proactive notification mandate. Absent these interventions, the right to be forgotten in India risks becoming an entitlement only the already-visible may invoke.
Keywords: Shadow Profiles, Right to Be Forgotten, DPDPA, Inferred Data, Informational Privacy, Puttaswamy, GDPR, Significant Data Fiduciary.
