Legitimate interest as a legal base ensures business continuity while not compromising the interests of data principals. Entities could rely on legitimate interest only when data principals reasonably expect such processing, or there is a strong justification. Moreover, under EU GDPR, processing personal information on the grounds of legitimate interest comes with exceptions where processing shall not violate the fundamental rights and freedoms of the individual. 

Moreover, consent as a lawful base can’t be extended to different scenarios and data collection chains. A data fiduciary collects information about persons (data principals) in various ways – both direct and indirect. Directly, by directly seeking information from data principals, where individuals provide data in return for service. Indirectly, through third parties and publicly available personal information. In comparison, obtaining consent from individuals when data is collected directly is possible. However, it would be difficult to obtain consent during indirect data collection where data fiduciaries don’t directly interact with individuals to whom the data belongs. This might create disruptions to emerging technological innovations. 

For instance, Artificial Intelligence relies heavily on the model’s ability to scrape, collect, and process data forms, including publicly available personal information, semi-public (or private) personal information, or license information that might contain strands of personal information.The more a model processes data, the better it becomes. However, as prescribed under section 6 of DPDPA 2023, the consent-based approach doesn’t consider Al solutions’ complex data processing mechanism, which involves other reasonable purposes to process. For instance, data fiduciaries source information through different means. Consent could be operationalised when data fiduciaries directly seek information from data principals. However, it would be difficult in the case of third-party data collection, like through scraping, where there is no direct interaction between the individuals and data fiduciaries. Moreover, seeking consent to process data generated as an outcome of Al solutions would be challenging, as this blurs the lines between data collection and processing. 

This could cause a fall through the cracks as the determining legitimacy of consent is nebulous in Al operations. Therefore, it would be essential for the government to consider expanding the legal bases for processing data within the DPDPA 2023 to account for use cases of emerging technologies.