1. Introduction

Data minimization in biosurveillance is the legal and ethical principle that public authorities, laboratories, hospitals, research institutions and private companies should collect, process, retain and disclose only the biological and personal information reasonably necessary for a legitimate public-health purpose.

Biosurveillance involves monitoring biological indicators to detect, prevent or control threats to human, animal or environmental health. Examples include:

Monitoring infectious diseases through hospital reports and laboratory results.

Analysing genomic sequences to identify emerging pathogens and new variants.

Wastewater surveillance for community-level detection of infectious diseases.

Monitoring antimicrobial resistance and unusual disease outbreaks.

Using digital health records and epidemiological databases to identify public-health trends.

These activities can save lives, but excessive collection can expose individuals to privacy violations, discrimination, re-identification, commercial exploitation and disproportionate government surveillance.

The central legal question is:

How can the state collect enough biological information to protect public health without collecting or retaining more personal information than necessary?

Data minimization provides a framework for balancing these competing interests. It is not an absolute prohibition on collecting identifiable data: identifiable information may be necessary for contact tracing, outbreak investigation or clinical intervention. The question is whether each category of information, and its continued use, is justified by a specific purpose.

2. Meaning and principal elements

Data minimization generally requires five related practices.

Purpose limitation

Data must be collected for a defined and lawful objective, such as identifying a disease outbreak, rather than for unrestricted future surveillance.

Minimum necessary collection

Collect only the fields needed for the task. For community-level surveillance, aggregate infection counts may suffice without collecting every person's name, address and complete medical history.

Privacy-preserving processing

Use de-identification, pseudonymisation, aggregation and controlled access where suitable. Genetic data require special caution because they may remain identifiable even after names are removed.

Retention limitation

Establish justified retention periods and delete or irreversibly anonymise information when the original purpose and applicable legal obligations no longer require identifiable records.

Accountability and security

Document necessity, assess privacy risks, restrict access, audit data use and prevent secondary use that is incompatible with the original purpose.

These elements are related but distinct. Data minimization concerns how much information is processed; purpose limitation concerns why it is processed; retention limitation concerns how long it is kept; and security concerns how it is protected.

3. Legal foundations

A. Constitutional privacy and proportionality

In jurisdictions that protect privacy as a constitutional or human right, biosurveillance measures may be assessed against requirements such as legality, legitimate purpose, necessity and proportionality.

A government programme should generally be supported by lawful authority, pursue a legitimate public-health objective and avoid unnecessarily intrusive means.

For example, monitoring infection rates by district may be sufficient to identify an outbreak. Collecting the continuous location history, genetic profile and social contacts of every resident would require a substantially stronger justification.

B. Data protection legislation

Modern data protection frameworks commonly require personal information to be adequate, relevant and limited to what is necessary for the stated purpose.

The European Union's General Data Protection Regulation (GDPR), particularly Articles 5(1)(b), 5(1)(c), 5(1)(e) and 9, is an important example. It combines purpose limitation, data minimization, storage limitation and special protections for health and genetic data. Public-health processing can be lawful under specified conditions; the GDPR does not prohibit all such processing.

C. Public-health necessity

Biosurveillance sometimes requires identifiable information. During a serious outbreak, officials may need a patient's identity and contact details to notify exposed individuals or provide treatment.

Minimization does not require removing information that is genuinely necessary to achieve these objectives. It requires authorities to justify that necessity, limit access and avoid using emergency powers as a basis for unlimited collection.

4. Important case laws

There is no single universally controlling judgment specifically establishing a comprehensive data-minimization rule for every biosurveillance system. The principles are drawn from constitutional privacy cases, public-health surveillance disputes, data-protection decisions and cases concerning large-scale digital monitoring.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1

India — Landmark constitutional case

Court: Supreme Court of India
Year: 2017

Facts and legal issue: The Court considered whether privacy is protected as a fundamental right under the Indian Constitution in challenges connected with the Aadhaar identification system.

Judgment: The nine-judge Constitution Bench unanimously recognised privacy as a fundamental right protected by Article 21 and other freedoms in Part III of the Constitution.

The judgment developed a framework for evaluating state intrusions into privacy, including legality, legitimate state aims, proportionality and safeguards against abuse.

Application to biosurveillance:

Suppose a public authority creates a database containing citizens' genetic information, infectious-disease status and location histories. Even if disease prevention is a legitimate objective, the government should be able to justify why each category is necessary and why a less intrusive system would not suffice.

A biosurveillance system collecting only disease indicators may be easier to justify than one that creates permanent, identifiable biological profiles of the entire population.

Legal principle: Public-health objectives do not automatically eliminate constitutional privacy protections. Collection and use must be justified under the applicable constitutional framework.

Important limitation: Puttaswamy did not directly decide a comprehensive biosurveillance data-minimization dispute. Its constitutional principles provide the foundation for analysing such disputes.

Case 2: K.S. Puttaswamy v. Union of India (Aadhaar), (2019) 1 SCC 1

Court: Supreme Court of India
Decision: 2018

Facts and legal issue: The Court examined the constitutional validity of the Aadhaar framework, including the collection and use of identity and biometric information.

Judgment: The Court upheld important parts of the Aadhaar framework while invalidating or limiting certain provisions, including the provision allowing private entities to use Aadhaar authentication under Section 57 in the form then challenged.

Relevance to biosurveillance: The decision illustrates why a government or institutional database containing biometrics must be assessed not merely by reference to its stated benefits, but also by examining the purposes for which information can be used, the scope of disclosure and the legal safeguards surrounding it.

For example, a biometric system introduced to support disease-control programmes should not automatically become a general-purpose identity-tracking system.

Legal principle: The constitutional legitimacy of collecting sensitive identifying information depends on the applicable legal authority, purpose, proportionality and safeguards.

Limitation: The case concerned Aadhaar, not a biosurveillance programme, and its holdings must be applied according to the particular statutory and constitutional context.

Case 3: Carpenter v. United States, 585 U.S. 296 (2018)

United States Supreme Court · 2018

Facts: Investigators obtained historical cell-site location records covering approximately 127 days, enabling them to reconstruct the defendant's movements.

Judgment: The Supreme Court held that obtaining the historical cell-site records at issue constituted a search under the Fourth Amendment and generally required a warrant supported by probable cause.

LII / Legal Information Institute+1

Application to biosurveillance: Although the case concerned location records rather than biological data, it demonstrates the privacy dangers created when extensive information is accumulated over time.

For instance, combining genetic test results, hospital visits, location information and exposure histories can reveal intimate details that no individual data field would disclose independently.

Legal principle: The scale, comprehensiveness and revealing nature of aggregated digital records can increase privacy risks and trigger legal protections.

Limitation: Carpenter expressly left several other forms of surveillance unresolved. It does not establish that all biosurveillance data collection requires a warrant.

Case 4: Sorrell v. IMS Health Inc., 564 U.S. 552 (2011)

United States Supreme Court · 2011

Facts: Vermont restricted the sale, disclosure and marketing use of identifiable prescription information about doctors. The dispute concerned the intersection of medical confidentiality, data mining and commercial speech.

Judgment: The Supreme Court invalidated the challenged restrictions because they impermissibly burdened protected commercial speech under the First Amendment. The Court also observed that a more coherent and narrowly designed confidentiality regime could present a different constitutional question.

Justia U.S. Supreme Court Center+1

Application to biosurveillance: Data minimization rules should be designed around clearly defined privacy objectives and consistent restrictions on collection, disclosure and use. A rule that restricts only selected users or disfavoured uses may face legal objections depending on the jurisdiction.

Legal principle: Privacy protection must be implemented through legally defensible, appropriately tailored rules.

Limitation: This is principally a commercial-speech decision, not a direct ruling that biosurveillance databases must collect the minimum possible data.

Case 5: European Data Protection Board and GDPR case law

For biosurveillance within the European Union, the starting point is the GDPR rather than any single case.

Article 5(1)(c) expressly requires personal data to be adequate, relevant and limited to what is necessary for the purposes of processing. Article 9 separately regulates sensitive categories, including genetic and health data. Public-health processing can be permitted under Article 9(2)(i), subject to its legal conditions and safeguards, alongside an applicable lawful basis under Article 6.

EUR-Lex+1

The Court of Justice of the European Union has also clarified that processing health data under a special-category exception does not dispense with the need to satisfy the GDPR's general requirements for lawful processing. See Case C-667/21, Krankenversicherung Nordrhein, EU:C:2023:1022.

EUR-Lex

Application: A public-health agency cannot rely on the importance of disease surveillance alone to disregard purpose limitation, minimization or other applicable GDPR requirements.

Legal principle: A valid public-health justification and compliance with the general data-processing principles are separate requirements.

5. Indian legal framework governing biosurveillance

India does not have one comprehensive statute exclusively governing biosurveillance. The applicable rules depend on the institution, the type of information, the public-health activity and the legal authority under which data are collected.

A. Constitution of India

Article 21: Protects life and personal liberty, including the constitutional right to privacy recognised in Puttaswamy.

Article 14: May be relevant where surveillance practices are arbitrary or discriminatory.

Article 19: May be relevant when surveillance interferes with protected freedoms.

A public-health programme that collects identifiable genetic information should be assessed against its legal authority, necessity, proportionality and safeguards.

B. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023, establishes a framework for processing digital personal data. Its applicability to biosurveillance depends on whether the information falls within the Act and on the relevant statutory provisions and exemptions.

India Code+1

Important considerations include:

Lawful processing and applicable consent requirements or statutory exceptions.

Duties of data fiduciaries under provisions that apply to the processing activity.

Security safeguards and restrictions on processing or retaining data where required by the applicable provisions.

The scope of exemptions available under the Act.

Commencement caution: The Indian government notified phased commencement on 13 November 2025. As of 4 November 2026, the Act's principal processing provisions are scheduled to commence 18 months after that notification, in May 2027. Therefore, those provisions should not be treated as already operative merely because the Act has been enacted.

India Code+1

C. Other applicable laws and rules

Depending on the facts, biosurveillance may also engage:

The Epidemic Diseases Act, 1897.

The Disaster Management Act, 2005, where its requirements apply.

The Indian Council of Medical Research's ethical guidance for biomedical and health research.

Applicable clinical-establishment, laboratory, professional-confidentiality and research-ethics requirements.

Other applicable information-security and health-data rules.

These instruments do not all create an identical data-minimization obligation. Their legal effect must be evaluated separately.

6. Applying data minimization to different biosurveillance systems

These are examples, not fixed legal rules. A field that is unnecessary for population-level monitoring might be essential for an individual patient's treatment or for a legally authorised outbreak investigation.

7. Hypothetical legal case study

Facts: A state health department establishes a genomic surveillance programme to identify emerging infectious-disease variants. Participating laboratories transmit patient names, government identification numbers, full genome sequences, addresses, medical histories and test results to a central database.

The department retains all records indefinitely and permits other agencies to access the database for unrelated administrative investigations.

Legal issues:

Is every collected field necessary to identify emerging variants?

Could laboratories submit pathogen sequences and limited epidemiological metadata instead?

Is the transfer of identifiable data supported by an appropriate legal basis?

Is indefinite retention justified?

Are secondary uses compatible with the original purpose and authorised by law?

Are access controls, security measures and oversight adequate?

Legal analysis: The department has a legitimate public-health objective, but that objective does not automatically justify unrestricted collection or secondary use. Under the constitutional reasoning in Puttaswamy, the necessity and proportionality of the intrusion must be examined. Under the GDPR, where applicable, the requirements of Articles 5, 6 and 9 would also have to be satisfied.

Possible remedy: Redesign the system to receive pathogen sequences and the minimum epidemiological metadata necessary for variant monitoring; segregate identity information where individual follow-up is needed; restrict secondary access; establish retention periods; and document the reasons for any continued processing of identifiable data.

The exact legal remedy would depend on the jurisdiction, the applicable legislation and the evidence of unlawful processing.

8. Compliance framework for biosurveillance institutions

A defensible data-minimization programme should include the following steps.

Define the purpose. Specify whether the programme detects outbreaks, monitors variants, tracks antimicrobial resistance or supports individual treatment.

Map the information. Identify every data field, its source, recipients, processing purpose and retention period.

Test necessity. Record why each field is needed and whether aggregate, pseudonymised or less detailed data could achieve the same objective.

Separate identity from surveillance data. Store identifying details separately where feasible, with access limited to personnel who need them.

Set retention rules. Establish deletion or anonymisation triggers, subject to research-integrity duties, legal holds and applicable retention obligations.

Control secondary use. Require a documented legal basis and compatibility assessment before sharing data with researchers, private companies or other government bodies.

Audit and review. Reassess necessity as an outbreak evolves or ends, document exceptions and investigate unauthorised access.

9. Consequences of violating data-minimization principles

Depending on the applicable legal system and the facts, excessive biosurveillance may lead to:

Constitutional judicial review or an order restricting unlawful state surveillance.

Regulatory investigations and statutory penalties where an applicable data-protection law has been breached.

Injunctions or other remedies available under the governing legislation.

Institutional liability, contractual consequences or research-ethics sanctions.

Loss of public trust, reduced participation in testing and impaired public-health cooperation.

Not every instance of excessive collection automatically creates a damages claim or criminal offence. Liability depends on the relevant legal duty, available cause of action, evidence and remedy.

10. Conclusion

Data minimization in biosurveillance is a safeguard against turning legitimate disease monitoring into unnecessary, permanent or discriminatory surveillance. It requires institutions to justify what they collect, why they collect it, who can access it, how long it is retained and whether it is reused for another purpose.

The most relevant authorities include Justice K.S. Puttaswamy v. Union of India (2017), K.S. Puttaswamy v. Union of India (Aadhaar, 2018), Carpenter v. United States (2018), and Sorrell v. IMS Health Inc. (2011). These cases address related constitutional and privacy questions, rather than establishing one universal biosurveillance rule. The GDPR provides a more explicit statutory expression of data minimization, while India's constitutional framework and applicable legislation must be assessed in their own context.

The governing principle is not to collect the least data regardless of consequences, but to collect no more personal information than is reasonably justified by the lawful public-health objective, with safeguards proportionate to the risks.