Bundled Consent, 'Anonymised' Health Data and a Significant Data Fiduciary's Duties

The consent fails on several independent grounds.

• Specific and informed. Consent must be free, specific, informed, unconditional and unambiguous, given by clear affirmative action, and limited to the specified purpose. A single checkbox over 47 pages does not tell the user what is collected, for which purposes, or to whom it is shared.
• Itemised notice. The notice must be itemised, in plain language, and available in the languages the statute contemplates. One long document with no breakdown of purposes does not meet that standard.
• Unconditional. Consent cannot be bundled with unrelated purposes. Signing up for step tracking is not consent to ad-tech sharing; a user who refuses the ad-tech purpose must still be able to use the core service.
• Withdrawal. Consent must be as easy to withdraw as to give; a grievance officer alone does not provide that mechanism, and a consent manager is the designed route.

What must change. Purpose-wise notices per data category; separate opt-ins for ad-tech sharing; a withdrawal and erasure path; a consent manager; plain-language summarisation with the full notice one click away; and a register recording which consent version each user accepted.

The claim fails on the facts.

• Hashing is pseudonymisation, not anonymisation. A hashed phone number is stable across datasets. Anyone holding the same hash function, or able to match the identifier against another source, can re-link the record. The data remains personal data because an individual is identifiable, directly or indirectly.
• Probabilistic matching is exactly the risk. AdSift re-identified cohorts from device identifiers and inferred health status. The inference was then used to target a diabetes drug. That is processing of health data, not of anonymous statistics.
• Context matters. Even a device identifier combined with cycle-tracking data and a location pattern is identifiable in practice. The test is whether identification is reasonably possible for the recipient, not whether the sender has tried.
• Consequence. The sharing falls within the Act. Purpose limitation applies: consent for ad-tech profiling was never obtained, and health data cannot be repurposed simply by renaming the field. The appropriate route is a genuine anonymisation standard with a documented re-identification risk assessment, or deletion.

The argument also has an enforcement edge: a fiduciary that labels pseudonymised data as anonymous has made a misrepresentation to users and to the regulator.

Significant Data Fiduciary duties.

1. Appoint a Data Protection Officer based in India, who reports to the board and is the contact point for grievances.
2. Appoint an independent data auditor and carry out periodic audits.
3. Conduct data protection impact assessments for the ad-tech sharing and the school pilot, and publish the methodology at a high level.
4. Apply algorithmic due diligence so that profiling does not produce discriminatory or health-harming targeting.
5. Maintain grievance redressal and breach notification to the Board and to affected users.

Children's data. Verifiable parental consent is required for users under 18. The limited carve-outs for specified institutional settings are narrow and subject to safeguards; a company-run school pilot with 4,000 minors does not fit, and 'educational purposes' is not a general defence. Behavioural tracking and targeted advertising directed at children are separately restricted.

Exposure. The penalty schedule is tiered: failure to take reasonable security safeguards is the highest tier, up to Rs 250 crore; failure to notify a breach up to Rs 200 crore; breach of children's obligations up to Rs 200 crore; breach of Significant Data Fiduciary duties up to Rs 150 crore; residual breaches up to Rs 50 crore. Multiple failures can attract separate proceedings, and the Board can order remediation as well as penalty.