What is interesting to note is the fact that these techniques have been subjected to a complete prohibition, and have not been made contingent on the consent of the data subject. The only exception, under Recital 29, applies to the use of medical techniques deployed with explicit consent, e.g. the use of Deep Brain Stimulation to cure neurological disorders. Such a blanket prohibition differs, for instance, from the framework for processing of special categories of personal data under Article 9 of the General Data Protection Regulation (GDPR), which can still be processed with informed consent. Assuming that the use of algorithmic systems envisaged under Article 5(1)(a) of the AI Act involves processing of data on cognitive and behavioural states of data subjects, it is apparent that the AI Act possibly carves out a special category of data derived from a person’s internal decision-making processes that is afforded even higher protection than that ordinarily available under Article 9 of the GDPR. 

The reasons for providing greater protection to data relating to a person’s cognitive and affective states appear to be obvious: as the Information Commissioner’s Office (ICO) in the UK notes (p. 19), consent in the realm of “neurotechnology” may be an inadequate safeguard when it comes to ensuring control over one’s personal data. In a normal situation, by providing consent to processing of personal data, the data subject retains conscious control over what items of personal data are being divulged. When neurotechnology itself manipulates and modifies the data subject’s cognitive and behavioural functioning by directly modulating electrical activity or artificially stimulating certain areas of the brain,  the “voluntary” and “informed” nature of consent becomes suspect. Further, reports have emerged of neurotechnological advancements that purport to have the ability to convert brain scans into transcribed speech in real time. In the face of such technology, even if initially consent is provided, one has no control over what kinds of data may be unwittingly disclosed to the outside world, let alone determine the inferences that may be revealed from them. 

From a rights perspective, the prohibition in Article 5(1)(a) is itself an expression of the unqualified protection that is afforded to unexpressed “thought” or the “forum internum” in the European Convention on Human Rights (ECHR). Under Article 9(1) of the ECHR, protection is granted to “freedom of thought, conscience and religion”. However, while Article 9(2) envisages limitations on manifestation of one’s religion or beliefs, the provision is silent on any possible limitations on the freedom of “thought”. One possible interpretation of this deliberate wording points to the fact that unexpressed “thought” or the forum internum under the ECHR is given an inviolate and absolute status, free from any potential limitations or restrictions. This can explain why under Article 5(1)(a) of the AI Act, technological advancements that tinker with “thought” at its most basic level, namely, the cognitive process of thinking, are not permitted even with consent, subject to the medical use exception. 

While technological advancements ought to be welcomed, it is imperative to ensure that the freedom to preserve one’s innermost thoughts and the autonomy to make choices are not tinkered with. Viewed from this angle, Article 5(1)(a) of the AI Act acts as a guardrail that effectively safeguards the inviolability of “thought” from neurotechnological intervention. 

As held by the Indian Supreme Court in the Puttaswamy case, the fundamental right to privacy not only encompasses protection of one’s personal data from unauthorized processing, but also protection of the right to informational self-determination and data sovereignty. In other words, the data subject must have control over how her personal data is to be processed. While children and adults cannot be placed at par when it comes to providing consent for processing of personal data, it appears to be overly paternalistic to assume that the child can never decide what is in her best interests.

In the digital age, the proliferation of EdTech and social media has ensured that the primary means of communication and information-sharing happens online. Keeping such a context in mind, one can argue that fundamental rights of minors, such as the right to education and the right to receive and impart information, are liable to be infringed, in case parents deny consent to processing of their personal data. The problem is further exacerbated by the fact that the age limit of 18 years is set unduly high, unlike in enactments like the General Data Protection Regulation (GDPR) in the EU, and the Children’s Online Privacy Protection Act in the US, where the age limit is set at 16 years and 13 years, respectively.

Scholars have argued that the rights of a child vis-à-vis her parents cannot be subjected to a bright line test, but rather lie on a spectrum, with the rights of a child continually increasing in extent with age and maturity, even when the legal age of majority has not been reached. This position is in line with both international regulations and case law. Article 12 of the UN Convention on the Rights of the Child, which India has ratified, stresses on the point that due weightage must be given to the views of the child when the child is “capable of forming his or her own views”. The General Comment on this provision makes it clear that as the age and maturity of the child increases, the role of the parent as the sole decision-maker on behalf of the child correspondingly decreases [84]. In the UK, the Gillick case adopted a similar line of reasoning, albeit in the context of a child’s right to access healthcare without the consent of parents. As the House of Lords noted, a child must be able to provide consent to obtain contraception before the age of 18 years, provided that the child shows “sufficient understanding and intelligence” to understand the ramifications of the decision.

It is undoubtedly true that children remain vulnerable to online harm, and a certain degree of parental supervision and guidance may be warranted. However, the paternalistic approach in the DPDPA that nullifies the right of the child to take decisions concerning her own personal data, conflicts not only with international legal norms but can potentially fall foul of a child’s fundamental rights.

Section 29 of POCSO is peculiar in the sense that it raises a presumption of guilt from the moment a person is prosecuted under the specified sections of the Act. Therefore, it significantly differs from reverse onus clauses that operate only on the prosecution establishing certain basic elements of the offence, such as Section 35 of the Narcotic Drugs and Psychotropic Substances Act (NDPS). In Noor Aga v. State of Punjab, a case in which the constitutionality of Section 35 of NDPS was challenged, the Supreme Court recognised that the presumption of innocence is a human right under Article 14(2) of the International Covenant on Civil and Political Rights, but refused to recognise it as a Fundamental Right under Article 21 of the Indian Constitution. The Court hinted that reverse onus clauses could be declared valid if the statute required the prosecution to prove basic foundational facts of the case against the accused [paras 35, 54].

It is settled law that the procedure for deprivation of one’s “life and personal liberty” under Article 21 must be fair, just and reasonable, with the right to a fair trial being one of its concomitants. It is questionable how far a trial, proceeding on the presumption of guilt, without the State (despite its massive resources) having to prove even basic foundational facts, can be termed to be “fair”. As the Bombay High Court has noted, while holding a similar reverse onus clause under Section 9B of the Maharashtra Animal Preservation Act as unconstitutional, the criterion of the State having to prove foundational facts before the presumption of guilt can be invoked, is a precondition ensuring fairness and reasonableness of the procedure under Article 21. On this count, Section 29 of POCSO, in not requiring the prosecution to prove any fact related to the case, appears to be arbitrary and unreasonable, and therefore, violative of Article 21.  It is a reality that of all the reverse onus provisions enacted in India, Section 29 is one of the most extreme. Such a blanket presumption of guilt contravenes the criterion for constitutionality of reverse onus clauses laid down in Noor Aga, and raises the possibility of wrongful convictions.

The general tendency of courts in India to show deference to the legislature in matters of public policy, especially when heinous crimes are sought to be tackled, has emboldened the legislature to routinely enact reverse onus clauses. Section 43E of the Unlawful Activities (Prevention) Act (UAPA) inserted in 2008, and the amended Section 24 of the Prevention of Money Laundering Act are further examples of reverse onus clauses enacted by Parliament as the “quick fix” for achieving its twin objectives of deterring heinous crimes and increasing the rate of convictions.

The prevalence of reverse onus clauses ultimately points towards the incapability of the investigating agencies in conducting proper investigation within the bounds of established fair trial standards. Any deviation from such standards would involve a trade-off between fairness and efficiency, which would neither be constitutional nor desirable.