1. Introduction

Data linkage across datasets is the process of combining records from two or more databases to identify relationships, discover patterns, or construct a more complete profile of an individual, organisation, or population.

For example, a biotechnology company might combine:

Hospital records containing diagnoses and treatment histories.

Genomic databases containing DNA sequences.

Insurance records containing claims and payment histories.

Public datasets containing demographic or geographical information.

Wearable-device records containing health and activity measurements.

Even if each dataset appears harmless when considered separately, linking them may reveal sensitive information about an identifiable person. It can also enable profiling, discrimination, surveillance, or decisions about employment, insurance, healthcare, and public benefits.

The central legal question is whether the linkage has a lawful purpose and an adequate legal basis, and whether the resulting processing respects privacy, confidentiality, data-protection duties, and applicable sector-specific laws.

Data linkage is not inherently illegal. Its legality depends on the jurisdiction, the type of information, the purpose of combining the records, the identity of the parties conducting the linkage, and the safeguards employed.

2. Meaning and major forms of data linkage

Medip health :: Bienvenidos al hospital 2.0

A. Deterministic linkage

Records are matched using a common identifier, such as a patient number, Aadhaar number, or another unique ID. This can improve accuracy but may create substantial privacy risks when identifiers are reused across unrelated systems.

Probabilistic record linkage of de-identified research datasets with discrepancies using diagnosis codes | Scientific Data

B. Probabilistic linkage

Records are matched using combinations of attributes such as age, postcode, date of birth, or name. Even without a shared identifier, combinations of attributes may re-identify individuals.

1_Company Introduction KZ

C. Genomic and health-data linkage

Genetic, clinical, research, and family-history records are combined. This raises additional questions about informed consent, research ethics, genetic privacy, and potential implications for biological relatives.

Cleanroom Technology for Secure Data Collaboration: Options with Databricks and Snowflake | by Rama Mohan Reddy Pilli | Medium

D. Cross-organisational linkage

Government agencies, hospitals, universities, insurers, or pharmaceutical companies combine datasets. The parties must consider their respective legal authority, permitted purposes, contractual responsibilities, and data-sharing arrangements.

3. Legal framework in India

A. Constitutional right to privacy

The leading constitutional authority is Justice K.S. Puttaswamy (Retd.) v. Union of India.

The Supreme Court's nine-judge bench recognised privacy as a fundamental right protected by the Constitution, including under Article 21 and the broader guarantees of Part III.

The judgment is particularly important for data linkage because combining datasets can create a detailed picture of a person's activities, health, relationships, and behaviour that was not apparent from individual records. The later Aadhaar judgment expressly discussed the danger of linking separate databases to aggregate information and enable profiling.

PRIVACY+1

Legal principles relevant to data linkage:

A legitimate objective is required where the State interferes with fundamental privacy rights.

The interference must have an adequate legal basis.

The measure must be proportionate to its objective.

Safeguards against excessive collection, disclosure, and misuse are important.

Privacy includes informational autonomy and protection against unjustified aggregation of personal information.

These principles are especially significant for government databases and mandatory linkage schemes. Private-sector processing is also subject to applicable statutory and other legal obligations.

B. Digital Personal Data Protection Act, 2023

India's Digital Personal Data Protection Act, 2023 (DPDP Act) is a key statutory framework for digital personal data. The relevant provisions include:

Section 3: Scope of application.

Section 4: Processing personal data for a lawful purpose, based on consent or a recognised legitimate use.

Sections 5–6: Notice and consent requirements, subject to applicable exceptions.

Section 7: Specified legitimate uses.

Section 8: Obligations of Data Fiduciaries.

Sections 10–17: Additional provisions addressing specified categories and circumstances of processing, where applicable.

Official commencement notifications and rules determine when particular provisions apply. Accordingly, the Act's commencement status and applicable rules must be checked for the date and circumstances of a proposed linkage.

A business cannot assume that combining two lawfully obtained datasets is automatically lawful. The linkage itself must be assessed against the applicable legal basis, stated purpose, notice and consent requirements or relevant exception, security obligations, and restrictions on further processing.

Official legislation and rules can be checked through the Ministry of Electronics and Information Technology.

C. Information Technology Act, 2000 and SPDI Rules

Where applicable, section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 have historically provided a framework for certain sensitive-data processing and security failures.

The interaction of this older framework with the DPDP Act and its commencement provisions must be examined carefully. It would be incorrect to assume that every older provision or rule continues to apply unchanged in every situation.

D. Sector-specific requirements

Additional laws or regulatory requirements may apply to:

Medical records and patient confidentiality.

Clinical trials and biomedical research.

Genetic and genomic information.

Financial and insurance records.

Government identity databases.

Confidential business or research information.

Ethics committee approval, research consent, data-sharing agreements, or institutional permission may be required in particular contexts. None of these should be treated as a universal substitute for an applicable statutory legal basis.

4. International legal framework

A. European Union: General Data Protection Regulation (GDPR)

The GDPR provides one of the most developed legal frameworks for assessing data linkage.

The principal provisions are:

Source: Official GDPR text, EUR-Lex.

EUR-Lex+1

Practical application: A pharmaceutical company that originally collected patient information for clinical treatment cannot automatically combine it with genomic and insurance records to develop commercial risk profiles. It must determine whether the new processing is compatible with the original purpose and whether it has a valid legal basis for every relevant processing operation.

Pseudonymisation may reduce risk, but it does not necessarily take data outside the GDPR. Data that can reasonably be linked back to an individual may remain personal data.

B. United Kingdom

The UK GDPR and Data Protection Act 2018 govern relevant personal-data processing in the United Kingdom. The core issues are similar to those under the EU GDPR: lawful processing, purpose limitation, data minimisation, transparency, security, and individual rights.

The UK Supreme Court's decision in Lloyd v Google LLC also demonstrates that unlawful data processing and entitlement to compensation are distinct legal questions. A claimant must satisfy the applicable requirements for the remedy sought.

C. United States

The United States has a sectoral rather than a single comprehensive federal privacy framework.

Relevant laws may include:

HIPAA: Applies to covered entities and business associates and regulates protected health information within its scope.

Federal Trade Commission Act: Can address unfair or deceptive data practices.

Genetic Information Nondiscrimination Act (GINA): Restricts specified forms of genetic discrimination in employment and health insurance, but does not prohibit every possible use of genetic data.

State privacy laws: May impose additional requirements on sensitive personal information, data sharing, profiling, and consumer rights.

The legality of linking hospital records with consumer databases will therefore depend on the organisations involved, the applicable data categories, the permitted disclosure or processing route, and state law.

5. Important case laws

The following judgments establish principles that are relevant to data linkage, privacy, aggregation, and remedies. Not all are direct disputes about technical database matching; some establish broader rules governing the underlying processing.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Supreme Court of India · (2017) 10 SCC 1

Facts: The litigation concerned the constitutional status of the right to privacy in the context of the Aadhaar scheme and the State's collection and use of personal and biometric information.

Judgment: A nine-judge Constitution Bench recognised privacy as a fundamental right protected by the Constitution.

Relevance to data linkage:

Informational privacy is constitutionally significant.

Control over personal information is connected to dignity and autonomy.

Government systems that combine information from different sources can create privacy risks beyond those arising from individual collections.

Legal principle: Governmental data-linkage programmes that interfere with privacy must be evaluated against constitutional requirements, rather than justified solely by administrative convenience.

Source: Full judgment and case materials.

Indian Kanoon+1

Case 2: K.S. Puttaswamy v. Union of India (Aadhaar judgment, 2018)

Supreme Court of India · (2019) 1 SCC 1

Facts: The Court examined the constitutional validity of the Aadhaar framework, including biometric authentication, mandatory linkage, and the use of identity information.

Judgment: The Court upheld important aspects of Aadhaar while invalidating or restricting particular provisions and uses. It also examined the proportionality of the State's data-collection and linkage arrangements.

The judgment specifically recognised that seeding a common identity into different databases can enable the aggregation of otherwise separate information into a comprehensive personal profile.

Indian Kanoon+1

Legal significance:

A common identifier can create risks of cross-database surveillance.

A legitimate government objective does not automatically justify every method of linkage.

The scope of data collection, access, retention, and disclosure matters.

Legal safeguards must be assessed in light of the nature and extent of the privacy interference.

Application: A government agency proposing to link welfare, tax, health, and identity records should examine its statutory authority and the proportionality of the proposed linkage, including whether a less intrusive method can achieve the objective.

Case 3: Lloyd v. Google LLC [2021] UKSC 50

UK Supreme Court · 10 November 2021

Facts: The claimant brought a representative action alleging that Google had secretly collected browsing information from millions of iPhone users and used it for commercial purposes.

Judgment: The Supreme Court rejected the proposed representative compensation claim in the form presented. Under the applicable Data Protection Act 1998, the claimant could not obtain the claimed uniform compensation merely by establishing unlawful processing and loss of control without proving the necessary individual circumstances and damage.

Relevance to data linkage: The case illustrates the legal risks of aggregating personal information for commercial use without adequate transparency or compliance with data-protection requirements.

It also establishes an important distinction: a finding of unlawful processing does not automatically establish an identical right to damages for every affected individual.

Practical lesson: Organisations should preserve evidence of their processing activities, the legal basis for collection and subsequent use, the information disclosed to individuals, and the safeguards applied.

Source: Official UK Supreme Court case page.

UK Supreme Court+1

Case 4: Google Spain SL and Google Inc. v. Agencia Española de Protección de Datos and Mario Costeja González (2014)

Court of Justice of the European Union · Case C-131/12 · ECLI:EU:C:2014:317

Facts: The dispute concerned search-engine results connecting an individual's name with information in older newspaper notices about financial difficulties.

Judgment: The Court held that a search engine's activities in finding, organising, and displaying information about individuals could constitute processing of personal data. In the circumstances considered, an individual could seek removal of certain search results where the legal conditions were satisfied.

Relevance: Data linkage is not limited to physically merging databases. Searching, indexing, and arranging information from separate sources under a person's name can also create a meaningful personal profile.

Legal principle: Public availability of individual records does not necessarily mean every subsequent aggregation or presentation of those records is unrestricted.

Source: CURIA, Case C-131/12.

Case 5: Breyer v. Bundesrepublik Deutschland (2016)

Court of Justice of the European Union · Case C-582/14 · ECLI:EU:C:2016:779

Facts: The dispute concerned whether a dynamic IP address held by a website operator could constitute personal data when additional information identifying the user was held by an internet service provider.

Judgment: The Court held that information can qualify as personal data where the controller has legal means reasonably likely to be used to identify the individual through additional information held by another party.

Relevance to probabilistic linkage: A dataset need not contain a person's name to be personal data. The possibility of identification through additional information, access arrangements, and realistic means of linkage matters.

Practical lesson: Removing direct identifiers from a dataset is not enough, by itself, to establish that the resulting data are anonymous.

Source: CURIA, Case C-582/14.

6. When is data linkage lawful or unlawful?

The following scenarios illustrate how the legal principles operate in practice.

These assessments are conditional. The actual outcome depends on the governing law, the facts, and any applicable exceptions.

7. Legal doctrines applicable to cross-dataset linkage

A. Purpose limitation

Information collected for one purpose cannot automatically be repurposed for an unrelated objective. The organisation must assess whether further processing is legally permitted.

Example: Patient information collected for treatment should not automatically be reused to create commercial genetic-risk scores.

B. Data minimisation

Only information necessary for the specified purpose should be linked. If aggregate statistics can answer the research question, combining full identifiable records may be disproportionate.

C. Informed consent and lawful authority

Consent may provide a legal basis where valid consent is required and obtained. However, consent is not the only possible legal basis in every jurisdiction. Public-authority processing, healthcare, and scientific research may be governed by additional statutory rules or exceptions.

D. Re-identification risk

Data that are pseudonymised or stripped of names may remain identifiable through combinations of age, location, dates, rare diagnoses, or genetic characteristics.

A linkage assessment should consider the information available to the organisation and other parties, the realistic means of matching records, and the potential harm arising from identification.

E. Proportionality and necessity

In constitutional and public-law contexts, particularly in India, a State data-linkage programme should be evaluated in light of its legitimate objective, legal authority, necessity, proportionality, and safeguards.

F. Accountability and security

Organisations should document their decisions and maintain appropriate technical and organisational controls. A lawful linkage at the time of collection can still create liability if subsequent access, disclosure, retention, or use violates applicable requirements.

8. Legal consequences of unlawful data linkage

Depending on the jurisdiction and facts, unlawful linkage may lead to:

Regulatory action: Investigations, directions, penalties, or corrective measures under applicable data-protection legislation.

Civil claims: Claims for compensation, privacy violations, breach of confidence, or contractual breaches where the legal requirements are met.

Constitutional remedies: Judicial review or other appropriate relief against unlawful State action.

Employment and discrimination disputes: Challenges where linked data are used unlawfully in recruitment, promotion, insurance, or other consequential decisions.

Contractual liability: Disputes between organisations that share or process data contrary to agreed restrictions.

Research and institutional consequences: Suspension of access, research-governance action, or other sanctions where relevant ethical or regulatory requirements have been violated.

The available remedy is not identical in every case. For example, Lloyd v Google demonstrates that proving a data-protection breach and proving entitlement to a particular form of compensation are separate questions.

UK Supreme Court+1

9. Compliance checklist for lawful data linkage

Organisations considering cross-dataset linkage should work through the following steps.

Data-linkage compliance review

0 of 9

Define the linkage purpose

Document the specific operational, research, clinical, or public-interest objective.

Identify the legal basis

Assess consent, statutory authority, legitimate uses, and applicable sector-specific requirements.

Assess compatibility

Determine whether the proposed use is compatible with the original purpose or otherwise legally permitted.

Minimise the data

Exclude unnecessary fields and consider aggregate or less identifiable alternatives.

Assess re-identification risk

Test whether combined attributes can identify individuals or expose sensitive traits.

Establish governance controls

Allocate responsibilities, restrict access, document disclosures, and execute appropriate data-sharing agreements.

Complete risk assessments

Conduct a privacy or data-protection impact assessment where required or appropriate.

Secure and audit the linkage

Use encryption, controlled matching environments, access logging, retention limits, and incident-response procedures.

Review downstream uses

Ensure linked outputs are not reused for incompatible purposes or unlawful discriminatory decisions.

Reset checklistCopy checklist

10. Conclusion

Data linkage across datasets is a legitimate and often valuable practice in healthcare, scientific research, public administration, and commercial analytics. Nevertheless, combining information creates additional privacy risks and may amount to a new form of personal-data processing that requires independent legal assessment.

The most important authorities include Puttaswamy (2017), the Aadhaar judgment (2018), Lloyd v Google (2021), Google Spain (2014), and Breyer (2016). Together, they help explain constitutional privacy, the risks of aggregation, the legal significance of identification through additional data, and the distinction between unlawful processing and entitlement to remedies.

For India, the analysis should begin with the constitutional privacy framework, the DPDP Act and its applicable commencement provisions, and any sector-specific rules governing the datasets involved. For international projects, the GDPR or other applicable national legislation may impose additional requirements.

For a more focused legal analysis, the next useful step would be to examine data linkage specifically under Indian law, with statutory provisions, additional judgments, and a case-by-case assessment of government, healthcare, and genomic datasets.