We belong to a generation where one does not have complete control over their
personal privacy or it might be said that privacy no longer exists with the
presence of internet. As the technology becomes more advanced , the concept of
"privacy" is blurred and erased , being one of the foremost necessary element ,
it allows us to feel safe, feel comfortable and to be in control which
ultimately makes it the consequential element of human dignity and freedom of
expression. As we continue to become more technology depended, the line between
public and private becomes very hard to pin point.
This article aims to discuss as to how our privacy is getting hindered because
of some business whose entire business model is focused on collecting the
personal data and then selling it for profit. Those businesses are called data
brokers. But who are they, how do they collect data, what do they do with it and
what is the process behind this whole data leak.
The article also discusses the personal data protection bill in light of right
to privacy finally it offers some recommendations for improving the ethical
standards of data brokerage including greater transparency and accountability ,
stronger data protection laws and the development of ethical guidelines for the
use of new technologies. By the end of this article one will be extremely
shocked to know that they themselves are sometimes the reason for their data
What Are Data Brokers
Data brokers are the company that collect analyze and sell consumer data to
other organizations, typically for marketing purposes. They operate in a largely
unregulated industry, and there are concerns about the potential misuse of
personal data and the lack of transparency in the data collection and sale
process, the primary reason for the criticism of data brokerage industry is its
opacity as data brokers have no real incentive to interact with people whose
data they collect analyze, sell and make profit from.
How Do Data Brokers Collect Information
First up, to begin with, the most primary step is collection of data, data
broker sites obtain information about you in several ways, both on and offline
from various sources regarding an individual interest in different field of
area, connecting all the dots together in such an appropriate way that it
ultimately results in building a fully fledged comprehensive profile of a
The sources being web browsing history: every time while using search engine, a
social media app, or other apps, filling out an online quiz or entering into a
competition or might be visiting different website, we leave an electronic
trail, data brokers use this trail to build up a picture of who you are, data
brokers use web scrapping which is basically a small piece of software or script
that extracts data from any website to gather some information.
- Public sources: this includes birth certificates, marriage licenses,
voter registration, court records, bankruptcy records, motor vehicle records
and census data.
- Commercial sources: one's purchases which they made, how much for and
whether a coupon was used or not.
- Consent: when an individual give consent while clicking on "accept" for
What Kind Of Information Does These Data Brokers Collect
Data brokers typically collect various types of data on individual:
- Demographic Information: this includes age, gender, income, education
level, marital status and occupation.
- Financial Information: This includes information on an individual's
credit history, income, debt and investment holdings.
- Geological Data: this includes information on an individual's physical
- Health Data: This includes information on an individual's health
conditions, medical history, and prescription medications.
- Social data: this includes information regarding connections such as
their friends, family members, and professional network.
The Shady World Of Data Brokerage In Light Of Right To Privacy
A fundamental human right that is acknowledged by many nations and international
organizations is the right to privacy. It safeguards people against unauthorized
access to their private information and lives but this right is being violated
by many data brokers who acquire and sell personal information about people
without their consent or knowledge.
Despite the fact that the data brokerage business model is profitable, it
doesn't seem to be a business that many people would be interested in. some of
the murkiest situation that occurred in the data broking sector is that a data
broker sold data lists of rape suspects, alcoholics and "erectile dysfunctional
sufferers in 2013 and the issue was so significant that it shed the light on the
examination of massive enterprises like Acxiom and Experian.
There is one more example of data brokerage from India itself to give the
readers the idea regarding how data brokers operate. In 2017, a research was
conducted on a data broker company and the discovery was pretty unexpected. The
company was selling personal information on up to 1 laky people in cities like
Bangalore, Hyderabad and Delhi for merely 10,000 and 15,000 rupees.
Although in India, various decisions concerning data broking and the right to
privacy have been made. The Supreme Court historic decision in Justice K.S.
Puttaswamy (Retd) v. Union of India, which recognized the right to privacy as
a basic right under the Indian constitution, is the most noteworthy of them.
According to the judgment, privacy is a fundamental right that is necessary for
the enjoyment of other rights, such as the right to life and personal liberty.
The court also acknowledged the requirement for data protection legislation to
control the gathering, storing and utilization of personal data.
Following the Puttaswamy judgment, the Indian government introduced the Personal
Data Protection Bill, which sets rules for how personal data should be processed
and stored, and lists people's right with respect to their personal information,
. It also proposes to create an independent Indian regulatory authority called
the data protection authority [DPA], to carry out this law. The main provisions
of the bill signifies that is the bill comes into force then business would have
to tell users about their data collection practices and seek customers consent.
They would have to collect and store evidence of the fact that such notice
regarding the consent was given and subsequently the consent was received
because the bill gives the consumer the right to withdraw their consent. also
the bill gives consumer right to access, correct and erase their personal data
and it is mandatory for all the business to create ways to allow consumers to do
so the bill also requires companies to make organizational changes in order to
protect the data in a better way in short, it aims to regulate the collection,
storage and use of personal data by individuals and entities in India, including
data brokers. The bill has not been passed yet, but it is expected to provide
greater protections for individual's right to privacy by giving greater
protection over personal data and has to be complied by both Indian as well as
foreign companies who is dealing with the data of Indian citizen.
In addition to the Puttaswamy case, there have been several other judgments in
India related to data brokerage and the right to privacy. For example, in the
case of Google India pvt. Ltd. vs. Visaka Industries Limited
Delhi High court held that Google's display of search results for certain
keywords did not violate individual's right to privacy. However, the court also
recognized that individual
that the individuals have a right to control the dissemination of their personal
information and that Google should take measures to protect individual's
Overall, there is growing recognition in India for the importance of protecting
individuals' right to privacy in the context of data brokerage, and the legal
framework is evolving to provide greater protections for individuals' personal
Also the shady world of data brokerage highlights the need for greater
transparency and accountability in the collection and use of personal data. It
is important for individuals to be aware of their rights and for policymakers to
take action to ensure that these rights are protected in the digital age.
Recomenmendations To Improve The Ethical Standards Of Data Brokerage
To improve the ethical standards of data brokerage, the following
recommendations could be considered:
Greater transparency: Data brokers should be required to provide more
transparency regarding their data collection and usage practices. This can be
achieved by providing clear and concise policies, including information about
types of data collected, the purposes of data collection and the types of third
party organizations that have access to the data. Data brokers should also
provide individuals with the ability to access correct and delete their personal
information. As already mentioned in Data Protection Bill of 2022.
Accountability: data brokers should be held accountable for any misuse or
mishandling of personal data. this can be achieved through the implementation of
penalties for data breaches or unauthorized data sharing , and by providing
individuals with the ability to file complaints and seek compensation for any
harm caused by data breaches or unauthorized data sharing
Stronger Data Protection Laws: Governments should consider strengthening data
protection laws to provide greater protection for invidual's personal
information. This may include imposing stricter requirements on data brokers
regarding the collection and use of personal data, such as mandatory data
minimization and government should also consider providing individuals with
greater control over their personal data, such as the right to opt out of data
sharing and right to data portability.
Development of Ethical Guidelines: industry associations, civil society
organizations and government should work together to develop ethical guidelines
for the use of new technologies in data brokerage. These guidelines should aim
to ensure that the use of new technologies, such as artificial intelligence and
machine learning do not result in discriminatory practices
.Education and Awareness: Education and awareness campaigns should be developed
to inform individuals about the risk associated with data brokerage and the
steps they can take to protect their personal information. This may include
providing individuals with the information about their privacy rights. By
implementing these recommendations, data brokerage can be conducted in a more
ethical and responsible manner, ensuring that individuals privacy, security and
consumer rights are protected.
Safeguards Measures That Can Be Taken By Individuals For Data Brokerage
- Be cautious about sharing personal information: It is important to be
cautious about sharing personal information online, especially on social
media platforms. Avoid sharing sensitive information such as social security
number, bank account details, or credit card information.
- Use privacy settings: one make use of the privacy settings on social
media accounts to limit who can see their personal information. One would
only share personal information with trusted individuals and organizations
- Use strong passwords: making use of the strong passwords and avoiding
usage of same passwords multiple times.
- Two factor authentication: Two factor authentications provides an
additional layer of security and make it difficult for hackers to gain
access to accounts.
- Keep software up to date: making sure that the system which is being
used contains antivirus software which will ultimately help to ensure the
protection against latest threats.
- Be aware of phasing scams: one should be aware of phishing scams , where
attackers try to trick away personal information as a legitimate
organization, one can avoid clicking on suspicious links or downloading
attachments from unknown sender,
- Use of VPN: using a virtual private network [VPN] while accessing
the internet from public Wi-Fi network. This helps to protect data from
hackers who may be trying to intercept it.
By following these safeguard measures, individuals can help protect their
personal data from being brokered or misused by the third parties
In conclusion, the obscure industry of data brokerage poses a serious danger to
people's right to privacy. Although data brokerage has become common practice in
the digital economy, it operates in a largely unregulated and opaque
environment, leaving people vulnerable to the misuse and abuse of their personal
information. As a result, it is essential that government adopt a proactive
strategy to regulate the actions of data brokers in order to guarantee that they
respect people's right to privacy.
Individuals must also assume responsibility for protecting their personal
information by understanding how it is gathered, shared, and used. We can only
achieve a balance between the advantages of data broking and the right to
privacy by cooperating, ensuring that the digital economy serves the interest of
all parties involved.
- AIR2017 SC 4161
- (2020) 4 SCC 162