Skip to content

CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Artificial Intelligence - Introduction and Basics

A Chennai hospital group builds a diagnostic AI using patient records collected for treatment. A data scientist proposes using the full identifiable records for training without further steps. Considering the Digital Personal Data Protection Act, 2023 principle of purpose limitation and good AI practice, which approach is most appropriate?

The appropriate approach is to use the data only for a purpose consistent with the consent or lawful basis, and to de-identify it where possible before training. Free reuse breaches purpose limitation, a blanket ban overstates the law, and selling the data does not remove the hospital's responsibility as data fiduciary.

  1. AUse the identifiable records freely, since they are already held by the hospital
  2. BDelete the records, because personal data can never be used for model training
  3. CUse the data only for a purpose consistent with the consent or lawful basis, and de-identify it where possible before trainingCorrect
  4. DSell the records to a vendor so that the vendor bears all legal responsibility

Explanation

Personal data should be processed only for the purpose for which consent or a lawful ground exists, so new use needs a compatible basis, and de-identification reduces risk. Free reuse ignores purpose limitation. A blanket ban is not the law, and selling data does not shift the hospital's obligations as a data fiduciary.

Did you get it right without looking?

One question tells you little. A timed set on Artificial Intelligence - Introduction and Basics shows your real accuracy, how long you take and where you lose marks.

Practise Artificial Intelligence - Introduction and BasicsFree diagnostic mock

More Artificial Intelligence - Introduction and Basics questions