Data PrivacyAnalysing Geospatial Data Privacy under the Digital Personal Data Protection Act, 2023

INTRODUCTION

Geospatial data has become an integral part of the digital ecosystem, powering numerous applications and services across various  economy. Location-based information is crucial for innovation, efficiency, and economic growth. However, the proliferation of geospatial data collection raises significant privacy concerns, particularly regarding the protection of individual rights and personal information.

As defined by the Department of Science and Technology (‘DST’) in the Guidelines for Acquiring and Producing Geospatial Data and Geospatial Services including Maps, 2021 geospatial data encompasses “positional data with or without attribute data tagged, whether in the form of images, videos, vector, voxel and/or raster datasets or any other type of geospatial dataset in digitized or non-digitized form or web-services.” This broad definition covers a wide range of information, including:

1. Positional data: Latitude, longitude, and elevation/depth of points within India’s territory
2. Attribute data: Additional information associated with positional data
3. Maps: Symbolic representations of real-world objects, regions, or themes

Geospatial data is collected through various technologies, including satellite imagery, aerial photography, ground-based surveys, and mobile sensors. Its applications span numerous sectors, from traditional areas like urban planning and natural resource management to emerging fields such as the blue economy, which encompasses offshore resources and maritime activities.

GEOSPATIAL DATA AS PERSONAL DATA – REQUIREMENT OF ANONYMISATION

The Digital Personal Data Protection Act, 2023 (“DPDPA”) approaches personal data based on the principle of identifiability. This means that even if geospatial data does not directly name an individual, it may still be considered personal data if it can be indirectly used, alone or in combination with other information, to identify a person. For instance, repeated location data points showing regular visits to a specific residence and workplace could easily lead to identification.

This necessitates anonymisation of geospatial data. However, the standards for anonymisation and standards to determine whether a given dataset may directly or indirectly identify a person is unclear, and requires clarification in the form of sub-ordinate legislation.

Anonymization and identification techniques are crucial for balancing the utility of geospatial data with privacy protection. However, truly anonymizing location data presents significant challenges due to the unique patterns that individuals exhibit in their movements.

Techniques for anonymizing geospatial data may include:

1. Spatial cloaking: Reducing the precision of location coordinates
2. Temporal cloaking: Aggregating data over time periods
3. k-anonymity: Ensuring that each location is shared by at least k individuals
4. Differential privacy: Adding controlled noise to dataset queries

SPECIAL CONSIDERATIONS FOR SENSITIVE GEOSPATIAL DATA

Certain types of geospatial data may reveal highly sensitive information about individuals. According to the Data Protection Committee’s Report titled “A Free and Fair Digital Economy Protecting Privacy, Empowering Indians” released on May, 2018, the following categories of information may require data fiduciaries to be particularly vigilant in their privacy practices:

1. Religious or political affiliations (e.g., visits to specific venues or events)
2. Health status (e.g., visits to specialized medical facilities)
3. Sexual orientation (e.g., visits to specific venues or events)
4. Caste or tribe (e.g., visits to events or congregations)

This may include implementing stricter access controls, more frequent privacy audits, and specialized training for staff handling such data. Moreover, compliance with the DST guidelines negative list of attributes is crucial. This list specifies certain sensitive locations or features that must not be identified or associated with any location on a map. Data fiduciaries must ensure their geospatial data collection and processing practices respect these restrictions.

CROSS-BORDER TRANSFER OF GEOSPATIAL DATA

The DST guidelines place restrictions on the export of high-accuracy geospatial data, requiring that maps and data above certain threshold accuracies be stored and processed only on domestic servers. Data fiduciaries must navigate both these geospatial-specific restrictions and the broader personal data protection requirements of the DPDPA. For multinational companies offering location-based services in India, this may necessitate data localization measures, such as maintaining separate Indian geospatial databases or implementing technical measures to ensure that precise location data of Indian users does not leave the country.

BALANCING INNOVATION AND PRIVACY IN GEOSPATIAL SERVICES

The DPDPA aims to foster innovation while protecting individual privacy. For the geospatial sector, this balance is particularly crucial. The DST guidelines have liberalized the geospatial data regime to promote domestic innovation and reduce reliance on foreign resources. However, this liberalization must be tempered with strong privacy safeguards and push towards.

Privacy-enhancing technologies (‘PETs’) offer promising avenues for innovation in privacy-compliant geospatial services such as:

1. Edge computing viz., moving computer storage processing closer to the users, for local processing of location data.
2. Homomorphic encryption allowing processing on encrypted geospatial data without revealing personal data.
3. Federated learning techniques for analysing distributed location datasets without centralizing raw data.

AMLEGALS REMARKS

As location information becomes increasingly central to digital services and economic activities, robust privacy protections are essential to address the complex issues of geospatial data privacy.

Key recommendations for data fiduciaries handling geospatial data include:

1. Conduct comprehensive data mapping to identify all geospatial data flows within the organization; ensure compliance with both DPDPA and DST requirements particularly regarding data localisation and restricted attributes.
2. Implement granular consent mechanisms specifically designed for different types of location data collection and use.
3. Adopt strong anonymization techniques for geospatial datasets, while recognizing the limitations of anonymization for location data, and invest in other PETs.
4. Regularly audit geospatial data practices, paying particular attention to potential sensitive data inferences.

By embracing privacy as a fundamental design principle, the Indian geospatial sector can build trust, drive innovation, and establish global best practices in privacy-conscious location-based services.

– Team AMLEGALS assisted by Mr. Satish Chandra Chitrapu (Intern)

For any queries or feedback, feel free to reach out to mridusha.guha@amlegals.com or liza.vanjani@amlegals.com