1. Introduction

The Data-Driven Biosurveillance Governance Doctrine is a proposed legal and governance framework for regulating the collection, analysis, sharing, storage, and use of biological and health-related data to detect, predict, and control diseases and other biological threats.

It concerns the use of technologies such as:

Electronic health records and hospital databases.

Genomic sequencing and pathogen surveillance.

Artificial intelligence (AI) for outbreak prediction.

Wearable devices and digital health monitoring.

Wastewater monitoring and population-level epidemiological analysis.

Digital contact-tracing and infectious-disease reporting systems.

The central legal question is:

How can governments, hospitals, research institutions, and private technology companies use biological data to protect public health without violating privacy, bodily autonomy, equality, confidentiality, and constitutional rights?

An important qualification is that this exact doctrine is not a separately codified or universally recognised legal doctrine. It is an analytical framework derived from constitutional law, data protection, administrative law, public health legislation, and judicial decisions concerning surveillance and personal information.

In India, its principal constitutional foundation is the right to privacy recognised in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017). Comparative authorities, particularly S. and Marper v. United Kingdom (2008), also help explain the legal limits on retaining sensitive biological information.

Law Gratis+1

2. Meaning and scope of data-driven biosurveillance

Biosurveillance is the systematic collection and analysis of biological or health-related information to identify health risks, monitor disease trends, or detect biological threats.

Data-driven biosurveillance uses statistical methods, interconnected databases, automated analysis, and predictive models to support these activities.

The biosurveillance governance cycle

1. Data collection

Clinical records, laboratory tests, genomic data and public-health reports

2. Data processing and analysis

Validation, anonymisation, statistical analysis and AI-based detection

3. Public-health decision-making

Outbreak alerts, targeted testing, resource allocation and preventive interventions

4. Governance and accountability

Legal review, security audits, human oversight, remedies and deletion when appropriate

The legal challenge is not limited to whether the original collection of data was lawful. It also concerns subsequent uses, automated decisions, transfers to third parties, retention periods, security failures, and the consequences of inaccurate predictions.

For example, an infectious-disease surveillance system might lawfully receive laboratory reports but still raise legal problems if it later shares identifiable patient information with employers or law-enforcement agencies for unrelated purposes.

3. Core principles of the doctrine

A. Legality and statutory authorisation

Every biosurveillance programme should have a valid legal basis. A government department cannot assume that the public-health objective automatically authorises every form of biological monitoring.

The applicable law should clarify:

Which authority may collect the information.

What categories of data may be collected.

Why the collection is necessary.

Who may access the data.

Whether information may be disclosed to other agencies.

How long records may be retained.

What remedies are available for unlawful use.

In India, the relevant framework may include Articles 14 and 21 of the Constitution, applicable public-health legislation, and data-protection and confidentiality requirements.

B. Necessity and proportionality

The extent of surveillance must be proportionate to the legitimate objective.

For example, monitoring aggregated infection rates may achieve an epidemiological objective without collecting every person's complete genome, identity, location history, and medical records.

A proportionality analysis should ask:

Is the objective legitimate?

Is the surveillance measure rationally connected to that objective?

Is a less intrusive alternative reasonably available?

Are the public-health benefits sufficient to justify the interference with individual rights?

The Supreme Court of India applied proportionality analysis in Modern Dental College and Research Centre v. State of Madhya Pradesh (2016) and recognised privacy as a fundamental right in Puttaswamy (2017).

C. Data minimisation and purpose limitation

Only information reasonably required for the defined purpose should be collected.

Information collected for outbreak control should not automatically become available for insurance underwriting, employee screening, commercial profiling, or criminal investigations.

Purpose limitation also requires organisations to assess whether a new use is legally authorised and compatible with the original purpose.

D. Privacy and confidentiality

Biological information can reveal considerably more than a person's current health condition. Genomic information, for example, may reveal inherited characteristics and information relevant to biological relatives.

Appropriate safeguards include access controls, encryption, pseudonymisation, secure research environments, and restrictions on onward disclosure.

Removing names alone does not always make genomic or location-linked health information anonymous. Re-identification risks must be considered.

E. Equality and non-discrimination

Biosurveillance systems must not unfairly target communities or produce discriminatory outcomes.

Potential risks include:

Assigning higher disease-risk scores to particular neighbourhoods without adequate evidence.

Denying employment or insurance based on predicted health risks.

Using inaccurate AI predictions to stigmatise particular populations.

Allocating public-health resources according to biased or incomplete datasets.

Article 14 of the Indian Constitution is particularly relevant when government surveillance or resulting decisions are arbitrary or discriminatory.

F. Transparency and accountability

A responsible system should document the purpose of collection, the legal basis, data sources, analytical methods, responsible officials, security incidents, and procedures for challenging adverse decisions.

Where AI is used, meaningful oversight should address model accuracy, bias, uncertainty, and whether a human decision-maker can review consequential outputs.

4. Important case laws and their legal principles

The following judgments provide the principal legal foundations for analysing data-driven biosurveillance. Some concern privacy directly; others provide analogous principles applicable to biological monitoring.

Case 1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Supreme Court of India · (2017) 10 SCC 1

Facts and issue: The Supreme Court considered whether privacy is protected as a fundamental right under the Constitution of India.

Judgment: A nine-judge Bench unanimously recognised the fundamental right to privacy as intrinsic to life, personal liberty, dignity, and the freedoms guaranteed by Part III of the Constitution.

Indian Kanoon+1

Relevance to biosurveillance:

Identifiable medical records and genomic information can implicate informational privacy.

Government surveillance must have a lawful basis and satisfy constitutional requirements.

Public-health objectives do not automatically justify unlimited collection or disclosure of personal data.

Privacy protection includes obligations to safeguard personal information, not merely refrain from collecting it.

Legal principle: Biosurveillance must be assessed through legality, legitimate state purpose, necessity, and proportionality.

Case 2. Justice K.S. Puttaswamy (Aadhaar) v. Union of India (2018)

Supreme Court of India · (2019) 1 SCC 1

Facts and issue: The Court examined the constitutional validity of the Aadhaar identity system and its associated statutory framework, including biometric identification and authentication.

Judgment: The majority upheld the Aadhaar framework in substantial part while striking down or limiting particular provisions and uses. The decision considered proportionality, data protection, and restrictions on the use of Aadhaar information.

Relevance to biosurveillance: The judgment helps analyse whether a centralised biological or health-data identification system collects excessive information, enables inappropriate linkage, or permits uses beyond its lawful purpose.

Legal principle: The legitimacy of an identification system does not make every use of its data constitutionally valid.

Case 3. Selvi v. State of Karnataka (2010)

Supreme Court of India · (2010) 7 SCC 263

Facts and issue: The case concerned involuntary narcoanalysis, polygraph examinations, and brain electrical activation profile tests during criminal investigations.

Judgment: The Court held that involuntary administration of the techniques at issue violated constitutional protections, including Article 20(3) in the relevant circumstances and Article 21.

Relevance to biosurveillance: The judgment is particularly important where monitoring moves beyond passively observing population-level disease patterns into compulsory bodily testing, neural data extraction, or compelled scientific examinations.

Legal principle: Public or investigative interests do not automatically override bodily integrity, mental privacy, and constitutional protections against compelled self-incrimination.

The case does not prohibit every medically justified test or legally authorised health examination; the applicable context and safeguards matter.

Case 4. People's Union for Civil Liberties (PUCL) v. Union of India (1997)

Supreme Court of India · (1997) 1 SCC 301

Facts and issue: The Court considered safeguards governing telephone interception under Indian law.

Judgment: It prescribed procedural safeguards for interception, recognising the privacy implications of surveillance and the need to constrain executive discretion.

Relevance to biosurveillance: Although telephone interception is not biological monitoring, the case supports a broader governance principle: intrusive surveillance powers should be subject to defined procedures, authorisation, records, and oversight.

Legal principle: Surveillance should not operate as an uncontrolled administrative power.

Case 5. District Registrar and Collector v. Canara Bank (2005)

Supreme Court of India · (2005) 1 SCC 496

Facts and issue: The dispute involved statutory powers to inspect private documents held by a bank and the privacy implications of such access.

Judgment: The Court examined the protection of private records against intrusive statutory inspection and the constitutional limits on access to confidential information.

Relevance to biosurveillance: Medical and genomic databases may be held by hospitals, laboratories, research institutions, or commercial service providers. Their possession of the data does not eliminate the privacy interests of the individuals concerned.

Legal principle: Access to sensitive records requires lawful authority and cannot be justified solely by the fact that a third party holds them.

Case 6. Anivar A. Aravind v. Ministry of Home Affairs — Aarogya Setu litigation

Kerala High Court · W.P. (C) No. 7483 of 2020

Context: The litigation challenged aspects of the government's COVID-19 contact-tracing application and its data-sharing arrangements.

Relevance: It illustrates the legal questions that arise when digital public-health systems combine personal information, government access, private technical infrastructure, and emergency objectives.

Issues include the legal basis for collection, consent where required, the purposes for which information may be used, and controls on disclosure.

The precise procedural history and operative orders should be checked against the primary court record before relying on this litigation for a specific binding proposition.

Software Freedom Law Center, India+1

Case 7. S. and Marper v. United Kingdom (2008)

European Court of Human Rights · Applications Nos. 30562/04 and 30566/04

Facts and issue: The applicants challenged the indefinite retention of their fingerprints, cellular samples, and DNA profiles after criminal proceedings in which they had not been convicted.

Judgment: The Grand Chamber found a violation of Article 8 of the European Convention on Human Rights. It criticised the blanket and indiscriminate retention of sensitive biological information.

HUDOC

Relevance to biosurveillance:

Biological data should not necessarily be retained indefinitely.

Retention policies should distinguish between purposes and categories of individuals.

The sensitivity of DNA information calls for careful scrutiny.

Individuals should have appropriate routes to challenge unjustified retention.

Legal principle: Even when initial collection is lawful, continued storage and use may become disproportionate.

This is a persuasive comparative authority in India, not a binding Indian judgment.

Case 8. Carpenter v. United States (2018)

Supreme Court of the United States · 585 U.S. 296 (2018)

Facts and issue: The case concerned government acquisition of historical cell-site location records held by wireless carriers.

Judgment: The Court held that obtaining the extensive historical location records at issue constituted a Fourth Amendment search and generally required a warrant supported by probable cause.

LII / Legal Information Institute

Relevance to biosurveillance: The decision illustrates how information held by third parties can reveal intimate patterns when records are aggregated over time.

Combining health records, location histories, and genomic information may reveal far more than any individual dataset does in isolation.

Legal principle: Data aggregation and the scale of surveillance can materially change the privacy analysis.

The decision interprets the US Constitution and is not binding in India.

Case 9. Jacobson v. Massachusetts (1905)

Supreme Court of the United States · 197 U.S. 11

Facts and issue: The case challenged a state law authorising compulsory smallpox vaccination under specified public-health circumstances.

Judgment: The Court upheld the vaccination requirement in the circumstances before it, recognising the state's authority to protect public health while acknowledging constitutional limits on the exercise of that authority.

Relevance: Biosurveillance governance must balance collective health protection against individual liberty. However, authority to impose a public-health measure does not automatically authorise unrestricted collection of genomic information or indefinite monitoring.

Legal principle: Public-health powers must be assessed within the applicable constitutional and statutory framework.

Case 10. Modern Dental College and Research Centre v. State of Madhya Pradesh (2016)

Supreme Court of India · (2016) 7 SCC 353

Facts and issue: The case concerned state regulation of admissions and fees in private professional educational institutions.

Judgment: The Court applied proportionality analysis when examining restrictions on constitutional freedoms.

Relevance: Although not a biosurveillance case, its proportionality framework can inform analysis of whether restrictions associated with biological monitoring are justified and appropriately tailored.

Legal principle: A legitimate objective does not, by itself, justify every means chosen to achieve it.

5. Indian statutory framework

Several legal instruments may apply, depending on the nature of the surveillance programme and the institution conducting it.

Important qualification: DPDP Act commencement

The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 were notified with a phased commencement schedule. The Gazette notification dated 13 November 2025 provides for the principal processing provisions to commence 18 months after publication, while specified provisions commenced earlier or have a separate timetable. Therefore, as of 5 November 2026, it would be incorrect to assume that every substantive obligation under the Act is already operative.

E-Gazette+1

A legal assessment should verify the commencement status of the particular provision and any subsequent notifications before relying on it. The Act's scope and applicable exemptions must also be considered; it should not be treated as a complete, standalone code for every form of biological surveillance.

6. Governance structure for data-driven biosurveillance

A workable governance model should regulate the entire data lifecycle.

1. Legal authority

Identify the legislation, competent authority, purpose and limits of the programme before collecting information.

2. Privacy impact assessment

Assess sensitivity, re-identification risks, discrimination, data linkage and less intrusive alternatives.

3. Controlled data management

Apply minimisation, access restrictions, retention schedules, encryption and documented sharing agreements.

4. Scientific and algorithmic oversight

Validate models, document uncertainty, test for bias and review consequential automated recommendations.

5. Independent review and remedies

Enable audits, complaint mechanisms, breach response, correction of inaccurate records and judicial review where available.

These are recommended governance safeguards. They should not be mistaken for a claim that every element is expressly mandated by a single Indian biosurveillance statute.

7. Legal liability and accountability

Different actors may be responsible for different failures.

Liability is not automatic merely because a system produces an error. The applicable statutory duty, contractual obligations, causation, available defences, and evidence of harm must be examined.

Potential remedies include constitutional judicial review, appropriate writ relief, statutory complaints, injunctions, compensation where legally available, and regulatory or disciplinary action.

8. Application to practical scenarios

Scenario A: AI predicts an outbreak

A health department combines laboratory reports with anonymised hospital statistics to predict a disease outbreak.

Legal assessment: This may be justified where there is appropriate legal authority, adequate safeguards, and a legitimate public-health purpose. The department should assess re-identification risks and the accuracy of predictions.

Scenario B: Employers receive genomic risk scores

A private company obtains genetic information originally collected for disease research and uses it to screen job applicants.

Legal assessment: The secondary use raises serious purpose-limitation, confidentiality, discrimination, and legal-authorisation concerns. The original research purpose does not automatically justify employment screening.

Scenario C: Indefinite retention of biological samples

An authority retains identifiable biological samples after the original investigation has ended, without reviewing whether retention remains necessary.

Legal assessment: S. and Marper provides a strong comparative argument against blanket, indiscriminate retention. The legality of retention in India would depend on the governing statute, purpose, constitutional requirements, and circumstances.

Scenario D: Health data shared with law enforcement

A disease-monitoring agency transfers identifiable patient records to police for an unrelated investigation.

Legal assessment: The agency must establish a valid legal basis for the disclosure and examine confidentiality, purpose, proportionality and applicable safeguards. Public-health collection alone does not settle the legality of a subsequent law-enforcement use.

9. Key legal tests for courts and regulators

A court or regulator examining a biosurveillance programme can use the following questions as an analytical checklist:

Authority: Is the programme authorised by valid law?

Purpose: Is the objective legitimate and sufficiently defined?

Necessity: Is the data collection genuinely required for that objective?

Proportionality: Is the interference with rights excessive relative to the expected benefit?

Safeguards: Are access, retention, disclosure and security adequately controlled?

Fairness: Could the system discriminate against individuals or communities?

Accountability: Can affected people challenge unlawful processing or consequential decisions?

Review: Is there a mechanism to reassess the programme when the emergency ends or the scientific justification changes?

The most important Indian constitutional authority for this analysis is Puttaswamy (2017). Selvi (2010) is particularly relevant to bodily and mental autonomy, while PUCL (1997) provides a surveillance-safeguards analogy. S. and Marper (2008) is especially useful for biological-data retention.

10. Conclusion

The Data-Driven Biosurveillance Governance Doctrine can be understood as a proposed framework requiring biological surveillance to remain lawful, necessary, proportionate, secure, non-discriminatory, and accountable.

Its central insight is that a legitimate public-health objective does not eliminate the obligation to protect individual rights. The legality of a biosurveillance system depends not only on why information is collected, but also on how it is analysed, shared, retained, and used to make decisions.

For Indian legal research, the strongest starting points are Puttaswamy (2017), Puttaswamy (Aadhaar) (2018), Selvi (2010), PUCL (1997), and District Registrar v. Canara Bank (2005), supplemented by comparative decisions such as S. and Marper and Carpenter.

For a deeper research paper, the next useful step would be to develop this framework into a case-law comparison focused specifically on India, the European human-rights system, and the United States, distinguishing binding precedent from persuasive authority.