Geospatial data or map data, as it is commonly called, has become one of the most important categories of data in recent times. It has wide-ranging uses right from infrastructure, mining and utility services to consumer-facing businesses such as mobility, fitness, and last-mile delivery and logistics. The importance of well-constructed, accurate and extensive map data can hardly be undermined for any modern economy. It is no surprise, therefore, that the Indian Government had significantly liberalized collection, use and other processing of map data through guidelines in 2021 (“Guidelines”). Subsequently, in 2022, the Department of Science and Technology of the Indian Government issued an office memorandum providing clarifications and compliance points regarding the Guidelines (“Geospatial Data OM”).

Geospatial data may be collected through various means. These include satellite imagery, vehicle mounted sensors, mobile application data and drones. Data collection activities aimed at collecting map data can incidentally (or intentionally) capture a host of personal data, including faces and physical features, location data, biometric data (such as facial recognition and gait analysis), audio data (voices, sounds), etc. During such activities, individuals whose data is being collected may not be aware of and/or may not consent to their data being collected. 

Given the amount of personal data that can be collected during geospatial data collection, data protection laws assume considerable importance for such operations. A significant development in Indian data protection laws has been the enactment of the Digital Personal Data Protection Act, 2023 (“DPDPA”), the first comprehensive data protection regime of India. While the DPDPA has not been enforced as of date, it is expected to be enforced within a few months (at the time of writing), along with rules which will flesh out details of compliance requirements.

A key requirement under the DPDPA is that of consent of the data principal prior to collection and other processing of their data. This is subject to limited exceptions, however, such as certain legitimate uses (e.g., fulfilling any legal obligation, complying with court orders, medical emergencies, etc.) and other limited exemptions. Commercial collection of map data in numerous use cases is unlikely to be covered under the said exempti ons. This effectively means that collection and subsequent processing of personal data during geospatial activities may be subject to consent and notice requirements under the DPDPA (and other compliance requirements and restrictions). 

Keeping aside instances of deliberate snooping, even those data collectors who seek to comply with the DPDPA would face difficulties. For instance, if a vehicle is being used to capture street images in a public space and incidentally captures pictures of individuals’ faces, technically it may be required to provide notice to each such individual regarding the purpose of collection of data. Moreover, and more challengingly, it would be required to obtain consent from all such individuals. Notably, in case of collection and processing of children’s personal data or that of persons with disability, the DPDPA requires the data fiduciary to obtain the “verifiable consent” of the parent or lawful guardian, as the case may be. Operationally, obtaining consent in such cases may become highly challenging. Further, where map data collection is on a large scale, it would be near impossible to comply with consent and notice requirements. 

A practical solution is the use of technical means through which individual identifiable  features are blurred at the time of collection of data. It would be interesting to see if equipment manufacturers for map surveying activities could build in such features across products, based on the market’s requirements and compliance of laws.

Legal principles may be yet another way of solving this conundrum, especially the development of the “reasonable expectation of privacy” principle. Put simply, capturing information of individuals while they are in public spaces without any reasonable expectation of privacy does not require their consent. Notably, this principle is not expressly included in the DPDPA. Nevertheless, it would be interesting to consider if this principle has a place in the overall scheme of DPDPA since the Act is not applicable to “personal data that is made or caused to be made publicly available by—the Data Principal to whom such personal data relates.” Does this mean that if a person is stepping out into a public place, they are making their face available for processing without consent? While this has obvious benefits in terms of the concerns we are addressing in this article, if this argument is extended, it could also mean that entities can freely capture faces of individuals in public and the processor can modify, morph, share and use such data freely. 

In case any of the entities in the value chain is a foreign entity, such an entity may also be covered under the DPDPA. Moreover, the Government of India is expected to issue a list of jurisdictions to which transfer of personal data would be restricted. Even otherwise, the compliance requirements and restrictions under the Guidelines and Geospatial Data OM would also need to be considered. For instance, while there is no strict data localization requirement (apart from the transfer restriction discussed above), a soft data localization requirement would be applicable basis geospatial laws. 

In sum, when it comes to geospatial data processing activities, both consent requirements under DPDPA in addition to geospatial data laws would need to be considered. Therefore, even if data protection principles permit collection of personal data of individuals in public, geospatial data law requirements may restrict such data collection / processing activities. With respect to consent and notice requirements, technical means seem to be the most appropriate, however, a general rethinking of legal principles also merits consideration.