By- Archisman Chatterjee
INTRODUCTION
Technological implants have been used in a restorative manner to compensate for the lack of any biological functionality of an individual as well as supplement human abilities to create an enhanced version of it. However, recently the use of such implants for non-therapeutic purposes like providing access to secure facilities, automated payments have exponentially increased among individuals.[1] For instance, a company in Sweden developed microchips to perform the function of a covid-19 passport and promoted their usage through its employees. In the US, the ECPA, 1986 allows consent-based surveillance of employee communication through their implants but if it is exploited to tap into their personal conversations as well then it would amount to a gross violation of their several basic rights including but not limited to right to privacy, individual autonomy. In the Indian context, even though usage of such implants is at a nascent stage, a sudden rise of the scale their implementation can be expected due to the increased affordability.
When such an event transpires in India, questions such as whether the Drugs and Cosmetics Act, 1940 which pertains to the usage of such a device as well as the IT Act, 2000 which governs the flow of data do crop up. Throughout this writing piece, the author would go on to identify and categorize the issues that would arise upon such implementation into two prongs namely, (a) affixing of liability in case of product failure and (b) protection of data acquired through such devices. Lastly, we delve into an analysis of the Indian framework governing such spheres and suggest calibrated reforms while taking cues from foreign models to address such lacunae.
WHAT ARE MICROCHIP IMPLANTS?
Technological implants are scientifically termed as human microchip implants (hereinafter ‘HMI’) as they are implanted in bodies while being encased in a case made up of silica and they operate on the principle of transponders which respond to radio frequency identification (hereinafter ‘RFID’). These microchips possess distinct identification numbers which are unique to that individual and serve as a bridge to online databases for storage of personal information in the nature of medical records, criminal background, etc.
ISSUES
On certain occasions, if an implant fails to meet delineated criteria or negatively alters the status quo of health of an individual, manufacturer liability can be incurred due to product defects. Herein arises the problem of ascertainment of liability since it would necessarily involve a question of who should be held liable between doctors and manufacturers and to what degree. In this context, importance has to be accorded to the purpose of such implantation wherein non-medical implants used for enhancement purposes could be given a lesser standard of care incorporating a mere careful implementation as opposed to medical ones requiring utmost professionalism. To elucidate, party A gets a hearing implant to increase his hearing beyond that of a normal person and party B installs a prosthetic limb. Herein, the standard of care on part of medical professionals and obligations on the manufacturer should be of a greater degree in the latter case since it is aimed to achieve the necessary quality of life while the former is affecting a performance improvement. However, the criteria of determining such level of care and whether it will vary for each individual implant is subjective in nature and requires further consideration.
The normal functioning of implants would require them to collect data, more so the ones which would rely on data to improve their functioning or are programmed to transfer them to a server. The sensitive nature of medical data brings up questions of as to who can collect such data, whether they require consent of the owner each time they acquire and what would be the extent of the oversight role to be played by a regulatory authority if established. Whether one framework would apply all implants or a category system based on either purpose or sophistication is needed for regulating the collection and flow of data can be addressed through specific legislation.
SCENARIO IN INDIA AND POTENTIAL SOLUTIONS
Product liability problem
In India, implant technology has largely been implemented for therapeutic purposes governed by Drugs and cosmetics rules, 2019 framed under Drugs and Cosmetics Act, 1940. In 2019, the government of India decided to regulate the sale, import and manufacture of medical devices. Despite that, as stated before, in order to ascertain manufacturer liability, it becomes necessary to introduce a distinct and independent legislation. For instance, defining the term ‘medical devices’ in the drugs act would provide a two-pronged solution to this issue. Firstly, it would allow existing medical equipment as well as futuristic implants to be brought under its ambit. This would bring a shift in manufacturer tendencies since they would be subject to greater quality control as compared to mere executive overseeing through way of a notification. Secondly, individuals would also be able to seek recompense from the manufacturers in order to remedy defective implants. Furthermore, in order to improve the process of determining who is bound to pay compensation as well as its quantum, a multi-tier redressal mechanism can be set up consisting of judges, medical practitioners as well as technicians to reduce the scope of error in affixing liability.
Till such a framework for accurately determining liability is established, the risk-utility test can be employed by courts as an alternative. In the US, these tests were used by the courts to settle lawsuits relating to product liability. The test is used to check whether any alternative solution was available to the producer which would fix such defect while maintaining cost and utility. However, for microchips, this step may extend even beyond primary implementation since certain chips undergo evolution in their functioning with the accumulation of data as time passes. Thus, courts might be required to extend the ambit of this test to include any potential alternatives available to the implant during its transitory phase. This solution can have a great deal of ameliorating effect in the short term by upholding product liability. However, the increasing complexity of implant technology due to addition of more features would need legislation to effectively keep its misuse in check.
Issue of Safety of Data
In India, the Data Protection Bill, 2021 (hereinafter ‘DPD’) was referred to a Joint Parliamentary Committee and after the much needed deliberations surrounding its provisions and intent, it was withdrawn by the legislature. The primary flaw of the bill was the scope for its misuse by enforcement agencies. Utilisation of implants in human bodies has a necessary repercussion in form of collection of data. To protect such data, adding safeguards which would incorporate free consent with processing of data to ensure standards is a must.
In the EU, a cumulative application of Art 6 and Art 9 of GDPR governs the processing of any data generated by implants wherein the later provision qualifies such personal data into a special category. In the US, the CCPA has certain gaps in its framework since it leaves personal data such as medical information out of its scope and in the hands of local legislation. Even though the IT rules, 2011 categorises medical records as sensitive data, it does not have any mention of health data and suffers from lacklustre implementation. Herein, the data protection authority envisaged by the DPD could have a separate division to classify medical data and authorize it on the basis of processing requests by processors or data owners. This will act as a preventive measure against fraudulent data processing.
However, before reaching the stage of processing of data, the criteria of either obtaining valid consent from the data subject or an equivalent and justifiable need ought to be satisfied. The minimum consent standards set by the IT rules, leads to them relying on principles of contract law. Taking the peculiarity of the Indian scenario in account, it is prudent to mention that the balance of bargaining power when deriving consent tilts in the favour of the processors. To counterbalance this while taking cues from the GDPR, changes devised in relevant laws to check whether it is informed, explicitly stated, free in nature as well as whether it was given before or after data collection can raise its standard.
Additional innovative solutions are needed to address the unequal bargaining gap between the processors and data-subjects especially there being individuals who need implants for restoration purposes. For instance, separate consent criteria can be set up for processing data collated from restorative and enhancement implants based on level of treatment one requires. This can be improved by tweaking Rule 5(7), IT rules to allow minimum standard of services to patients who have not consented since the contrary is envisaged by it. Presence of civil society to oversee the consent taking procedure can counteract against the weak position of the economically weaker patients.
CONCLUSION
The introduction of implant technology in the Indian landscape would have manifold consequences since it has a direct nexus with right to life and right to privacy of individuals along with its economic significance. Herein, the author argues that the role of the legislature should be to tweak the law in a manner which streamlines the implementation of such technology while balancing the interests of patients, manufactures as well as medical professionals. Bringing completely new laws might not be the best solution since it could create confusion in relation to the existing laws. In light of this, making changes in the present laws which govern such devices coupled with judicial interpretation being bestowed on them down the line can ensure a decent framework.
[1]Gasson M Kosta E and Bowman D, Human ICT Implants: Technical, Legal and Ethical Considerations, 23 (TMC Asser Press 2012) 16.
(Archisman Chatterjee is a law undergraduates at National Law University, Odisha. The author may be contacted via email at 22bba012@nluo.ac.in ).
Cite as: Archisman Chaterjeeare, Technological Implants and the Need for Sufficiency of Legislation, 27 July 2023 ) <https://rmlnlulawreview.com/2023/07/27/technological-implants-and-the-need-for-sufficiency-of-legislation/>date of access.
The RMLNLU Law Review Blog 