We’re happy to bring you another guest post by our Fellowship applicant Prarthana Patnaik. Prarthana is a 4th year student at National Law University, Odisha. This is her second submission for the Fellowship.
A Case for Creating ‘Identity Rights’ for Digital Identities in India
Prarthana Patnaik
In the era of the Aadhar, demonetization, blockchain and other technological advancements, ‘digital identities’ are gaining increasing prominence. The World Bank defines ‘digital identities’ as “a set of electronically captured and stored attributes and credentials that can uniquely identify a person”. Currently, in India, the conception of digital identities centres around Aadhar, the 12-digit unique ID number issued to Indian residents. Conceptually, digital identities are wider in scope and can include social media accounts, mail accounts, IP addresses, bank accounts etc. While these identities help enhance connectivity and visibility, they also raise an alarm on privacy concerns, identity frauds and various other cyber crimes. Increasing instances of such crimes highlight the need to look into various legal measures to protect digital identities.
The protection of such identities finds some expression in Indian jurisprudence. On 24th August, 2017, in the now landmark case of K.S. Puttaswamy (retd.) v. Union of India, a nine Judge Bench of the Supreme Court, while mulling over the right to privacy, highlighted several related rights arising from the same. These included rights such as: one’s “right to control information that is available about them on the world wide web”, the right to protect one’s own reputation, and one’s “personal conception of the ‘self’”. The Court observed that such identity rights also emanate from ‘informational privacy’ i.e., the right to exercise control over one’s personal data which entails the right to control one’s “existence on the Internet”.
To me, this poses a question: Is it possible to use IP law to protect such identities? The idea of protecting identities as intellectual property may seem far-fetched to most and perhaps, even ludicrous. After all, IP law protects creations of the human mind, and identities can certainly not be classified as a ‘creation’.
The Link between Personality Rights & Digital Identities
Perhaps the only part of IP law that allows for a connection between the two is “personality rights”.
Personality rights have been defined as the right of famous individuals, whose identities have acquired a sort of brand value. This right allows them to “control when, where and how their identity is used”. As has been stated by the Delhi High Court in ICC Development (International) v. Arvee Enterprises, such identities or ‘personas’ cannot be monopolized by persons other than the individual i.e., the right vests in an individual and he alone is entitled to profit from it.
Upon noting that personality rights have received IP protection, one can consider the possibility of extending the same to digital identities of individuals.
To begin with, personality rights are known to have sprung from the ‘right to publicity’ – which in turn, stems from the ‘right to privacy’. The ‘right to publicity’ is often used interchangeably with personality rights. It was first discussed (but not explicitly mentioned) in R. Rajagopal v. State of Tamil Nadu, wherein it was stated that a person’s name and identity could not be used without his consent. After elaboration in further cases (D.M. Entertainment v. Baby Gift House, Shivaji Rao Gaikwad v. Varsha Productions, etc.), the right now accords all natural persons the right to prevent the unauthorized use of indicators of their identities (name, personality, trait, signature, voice etc.).The same can be applied to digital identities: on creation of such identities, individuals submit themselves to the scrutiny of the public, similar to celebrities in movies and public events. In fact, one may conclude that people’s digital identities are exposed to a larger and more global audience.
A pertinent argument that could follow is that digital identities are not ‘properties owned’ by individuals and are therefore not entitled to receive IP protection. While identities or indicia of identities have been held to be “property” of individuals, the ownership issue admittedly raises complex issues in case of digital identities: Several arguments have been advanced, to show that governments and companies have the right of ownership over our digital identities. This issue can also be settled by drawing parallels to personality rights. The same question arises in both instances: Who owns the rights in question? Do celebrities own their personas or the agencies/companies who represent these celebrities?
Are Digital Identities ‘Property Owned’ by Individuals?
The right in the “identities” (or property, as shown above) is viewed as a fully alienable right, which may be assigned or transferred to others. It has been argued by scholars that this right must be interpreted as a partially alienable right. An interesting article deals with this issue and the author creates a distinction between “publicity-holders” (person who owns property interests in commercial uses of an identity) and “identity-holders” (the individual whose identity or indicia is the one that must be appropriated to show a violation of his publicity rights). However, even then, rights of the “identity holders” hold precedence. As the author of the aforementioned article argues, instead of viewing publicity right as a fully alienable property right, limits on alienability should be introduced within the property framework, and such rights must be viewed as rooted solely in the identity-holder. A similar view was taken by the Delhi High Court when it held that personality rights can “inhere only in an individual or in any indicia of an individual’s personality like his name, personality trait, signature, voice, etc.,”. It further held that “An individual may acquire the right of publicity by virtue of his association with an event, sport, movie, etc. However, that right does not inhere in the event in question, that made the individual famous, nor in the corporation that has brought about the organization of the event.” From the above interpretation, one may argue that the right to control one’s identity solely vests in the individual.
Another related concern with regard to the protection of “identities” under IP is that personality rights/publicity rights cannot apply to digital identities. This is because only infringement of celebrities’ rights result in commercial losses to companies and hence, IP protection should only be accorded to them, instead of ordinary people and their digital identities. However, when we view identities as properties of individuals, it is reasonable to assume that a person’s identity can assume pecuniary value in certain cases and can be exploited for commercial benefits. This can be highlighted by instances where infringement of digital identities have caused huge losses to companies and other individuals alike. Examples include the attack by the WannaCry ransomware on hospital databases and banking institutions, the reports of Aadhar-related frauds where customers’ Aadhar details were used to siphon money, and other similar reports of identity theft and fraud.
‘Identity Rights’ in India: The Way Forward
Since both identity rights and personality rights are privacy-oriented, ‘identity rights’ can be used as an umbrella term to include the latter along with protection of digital identities inter alia. It has been argued that there is a need to create a distinct legal status for personality rights. On the contrary, it has also been argued that such rights do not deserve protection under IP law. However, the need for these rights cannot be disputed in an era where commercial appropriation of identities is rampant. Also, the amorphous nature of identities and the issue of multiple identities will not be effectively covered if such rights are outlined and made inflexible.
The introduction of identity rights under IP law is particularly important in today’s India. Our data security laws and cyber laws are not evolved enough to account for most cyber-attacks and hence, most cyber-attacks do not fall under the scanner of the law and victims of such cases are rendered incapable of availing justice. If such rights are recognized under IP law, affected individuals will be able to seek civil damages and permanent or temporary injunctions, which are more effective than criminal remedies in such cases. The same two-step test of validity (enforceable right in identity) and identifiability (the concerned person must be identifiable) which has been employed in cases of infringement of right to publicity can be employed in cases of infringement of digital identities too. In an increasingly digitized world, people’s identities and their personal data gain more commercial value and hence, there is a need to accord all sorts of protection available under the law.
Image from here