Data Protection Laws and Personality Rights in India

The rapid growth of digital technologies has transformed how personal information is collected, stored, and used. In this evolving landscape, two legal concepts have gained significant importance—data protection and personality rights. While data protection focuses on safeguarding personal data, personality rights deal with protecting an individual’s identity, reputation, and personal attributes such as name, image, voice, and likeness.

In India, both these areas are still developing and are not governed by a single unified legislation. However, constitutional principles, statutory frameworks, and judicial decisions together provide a foundation for their protection. The intersection between data protection laws and personality rights is particularly relevant in the age of social media, artificial intelligence, and digital marketing, where misuse of personal identity has become common.

This article examines the relationship between data protection laws and personality rights in India, their legal basis, the role of courts, and the challenges that arise in protecting individual identity in the digital era.

Meaning and Scope of Personality Rights

Personality rights refer to the right of an individual to control the use of their identity and personal attributes. These rights ensure that a person’s name, image, voice, or likeness is not used without consent, especially for commercial purposes.

Personality rights broadly include two key components:

Right to Privacy

The right to privacy protects individuals from intrusion into their personal life. It ensures that personal information is not disclosed or misused without consent.

Right to Publicity

The right to publicity allows individuals to control the commercial use of their identity. This is particularly relevant for celebrities, public figures, and influencers whose identity carries economic value.

In India, personality rights are not codified in a specific statute. Instead, they have evolved through judicial interpretation and are closely linked with the constitutional right to life and personal liberty.

Constitutional Foundation of Personality Rights

The most important development in the recognition of personality rights in India came with the decision in Justice K.S. Puttaswamy v. Union of India (2017). In this landmark case, the Supreme Court recognised the right to privacy as a fundamental right under Article 21 of the Constitution.

The judgment laid down that privacy includes:

• Protection of personal data
• Control over dissemination of personal information
• Autonomy over personal identity

This recognition has strengthened the legal basis for personality rights. It implies that misuse of an individual’s identity or personal data may amount to a violation of fundamental rights.

Data Protection Laws in India

India has recently introduced a structured framework for data protection through the Digital Personal Data Protection Act, 2023 (DPDP Act). This law governs the processing of digital personal data and establishes rights and obligations for individuals and organisations.

Key Features of the DPDP Act

• Consent-Based Processing: Personal data can only be processed with clear and informed consent of the individual.
• Purpose Limitation: Data must be used only for the purpose for which it was collected.
• Data Minimisation: Only necessary data should be collected.
• Rights of Individuals (Data Principals): Individuals have the right to access, correct, and erase their data.
• Obligations of Data Fiduciaries: Organisations must ensure data security and lawful processing.
• Data Protection Board: A regulatory body is established to enforce compliance and handle grievances.

The DPDP Act reflects a shift towards recognising the importance of personal data as an extension of individual identity.

Interconnection Between Data Protection and Personality Rights

Although data protection and personality rights are distinct concepts, they are closely connected. Both aim to protect individuals from misuse of personal information and identity.

Personal Data as an Element of Identity

Personal data includes information such as:

• Name
• Photograph
• Biometric data
• Voice recordings
• Online behaviour

This data forms a part of an individual’s identity. Therefore, misuse of personal data directly affects personality rights.

Consent as a Common Principle

Both data protection laws and personality rights are based on the principle of consent.

• Under the DPDP Act, data cannot be processed without consent.
• Under personality rights, identity cannot be used without permission.

For example, using a person’s photograph in an advertisement without consent may violate both data protection laws and the right to publicity.

Protection Against Commercial Exploitation

Personality rights primarily protect against unauthorised commercial use of identity. Data protection laws reinforce this by restricting how personal data can be processed and shared.

In the digital economy, businesses often use personal data for targeted advertising. If such use involves identity exploitation without consent, it may lead to legal liability under both frameworks.

Digital Misuse and Emerging Risks

Technological advancements have increased the risk of identity misuse. Common issues include:

• Deepfake videos
• Voice cloning
• Fake endorsements
• Identity theft

These activities involve misuse of personal data and violation of personality rights. Data protection laws provide mechanisms to regulate such misuse, while personality rights offer remedies against unauthorised use of identity.

Role of Intellectual Property and Other Laws

In the absence of a specific statute on personality rights, Indian law relies on multiple legal frameworks to provide protection.

Trade Marks Act, 1999

The Trade Marks Act prevents unauthorised use of a person’s name or likeness in trademarks. It recognises that identity can have commercial value.

Copyright Act, 1957

The Copyright Act protects:

• Performer’s rights
• Moral rights

It prevents distortion or misuse of a person’s creative expression, which may overlap with personality rights.

Law of Passing Off

The tort of passing off protects against false representation. It is often used in cases where a person’s identity is used to suggest endorsement or association without consent.

Information Technology Act, 2000

The IT Act addresses issues such as:

• Identity theft
• Cyber fraud
• Data breaches

It provides additional support in cases involving digital misuse of personal data.

Conclusion

Data protection laws and personality rights in India are closely intertwined. While personality rights protect an individual’s identity and reputation, data protection laws regulate the collection and use of personal information.

The recognition of the right to privacy under Article 21 has strengthened both areas. The introduction of the Digital Personal Data Protection Act, 2023 marks a significant step towards protecting personal data in the digital age.

However, the absence of a dedicated personality rights law and the challenges posed by technological advancements highlight the need for further legal development. A comprehensive and integrated approach is necessary to ensure effective protection of individual identity in an increasingly digital world.