You are posted as the Joint Secretary in the Department of Information Technology of a state. The government recently implemented several citizen-centric digital services, collecting large volumes of personal data from residents. The Digital Personal Data Protection (DPDP) Act, 2023, requires that such data be processed only with explicit and informed consent, and mandates that processing must cease immediately upon withdrawal of consent. During an internal audit, you discover that the department continues to process and analyze personal data of several citizens even after they have formally withdrawn their consent. This data is being used for policy analytics and service improvement, purposes not explicitly disclosed at the time of data collection. When you bring this to the attention of your department head, you are informed that halting the processing will disrupt ongoing digital initiatives and may affect state-level performance metrics. Moreover, you find that the consent withdrawal process is cumbersome, and many citizens are unaware of their rights under the DPDP Act. You also learn that a prominent social activist is planning to file a complaint with the Data Protection Board against involuntary use of personal data, which could attract public scrutiny and legal action against the department. (a) Identify and discuss the ethical issues involved in this case. (b) What are the potential consequences for the department if the issue is not addressed transparently? (c) How would you balance the need for efficient public service delivery with the obligation to protect citizens' data rights?

(a) Ethical Issues

1. Perspective of citizens → (i) violation of right to privacy (ii) absence of informed consent (iii) seen as the 'means' to an end.

2. Perspective of the organization → (i) not following the rule of law. (ii) prioritizing efficacy > rights.

3. Perspective of society → (i) trust in institutions (ii) relationship between citizen & state (iii) violation of Rousseau's social contract.

(b) Potential consequences to the department →

1. Disruption and re-opening of all digital initiatives.
2. Loss of public trust and reputation.
3. Investigation into data management practices by the Data Protection Board under the DPDP Act.
4. Utilitarian slippery slope where ends justify any means possible.
5. Risk of negative work culture: where rights of citizens considered secondary to governance.

(c) Balancing act →

In this situation, I would regard the right to privacy under Article 21 as "trumping" other considerations of efficient public service since the 'means' cannot be ignored.

Ronald Dworkin argues that balancing social needs with individual rights must affirm the rights and uphold rule of law.

Course of action →

Information gathering:

1. Get information on scale of data gathering, number of people who withdrew consent.
2. Information on reasons for withdrawal.

Transparency measures: 3) Inform data principal that their information is still with the state. 4) Informed consent: Inform them about the use of information in policy formulations. 5) Persuasion: establish rapport and tell them about how their data is contributing to better policy formulation. 6) Respect the consent of those who still choose to withdraw consent.

Balancing Act : 7) Anonymize the data that is to be removed to retain policy value while upholding the right to be forgotten.

Long term Policy change : 8) Institutionalize Department Policy of using data only based on prior informed consent. 9) Penalize wrongdoers.