Data protection in online exhibitions

Introduction

Online exhibitions are digital platforms where museums, universities, biotechnology companies, research institutions, and cultural organisations display information, photographs, scientific discoveries, biological materials, and research publications through websites or virtual events. These exhibitions may collect personal information from visitors through registration forms, online payments, cookies, interactive applications, and feedback systems.

In biotechnology and scientific exhibitions, additional risks arise because displayed material may include genetic information, medical images, clinical research findings, and identifiable information about research participants. Therefore, organisers must ensure that personal information is collected, stored, displayed, and shared according to applicable data protection laws.

Data protection in online exhibitions aims to protect visitors' privacy, prevent unauthorised disclosure, maintain confidentiality, and establish accountability for digital information.

Legal framework governing data protection

1. Digital Personal Data Protection Act, 2023 (India)

The DPDP Act provides a legal framework for processing digital personal data in India. Online exhibition organisers may qualify as Data Fiduciaries when they determine the purpose and means of processing visitors' information.

Section 4 establishes the requirement that personal data may be processed for a lawful purpose on the basis of consent or certain legitimate uses recognised by the Act. Section 5 deals with notice requirements, while Section 6 addresses consent.

Section 8 establishes obligations relating to the processing of personal data, including responsibility for compliance and reasonable security safeguards. Therefore, exhibition organisers should explain why visitor information is collected and ensure that it is protected against unauthorised access.

The Act's commencement notifications and applicable rules must be considered when determining which provisions are operational.

2. Information Technology Act, 2000

The Information Technology Act provides additional legal protection for electronic information and digital systems. Section 43 addresses unauthorised access and certain forms of damage to computer systems. Section 66 provides criminal consequences where specified acts under Section 43 are committed dishonestly or fraudulently.

Section 72 concerns breach of confidentiality and privacy by persons who obtain access to information under powers conferred by the Act. Exhibition organisers should also follow applicable cybersecurity requirements and contractual confidentiality obligations.

3. General Data Protection Regulation (GDPR)

The GDPR applies to organisations established in the European Union and, in certain circumstances, organisations outside the EU that offer services to or monitor individuals in the EU.

Article 5 establishes principles such as lawfulness, fairness, transparency, purpose limitation, and data minimisation. Article 6 provides lawful bases for processing personal data. Article 9 provides additional protection for special-category information, including health and genetic data.

Article 32 requires appropriate technical and organisational security measures. These requirements are relevant to online exhibitions involving international visitors or sensitive scientific information.

Major data protection issues in online exhibitions

1. Collection of personal information

Online exhibitions may collect names, email addresses, telephone numbers, institutional affiliations, and payment details. Organisers should collect only information necessary for registration, communication, and other clearly explained purposes.

2. Protection of photographs and recordings

Virtual exhibitions may include photographs, video recordings, interviews, and live-streamed discussions. Organisers should establish appropriate permissions before publishing identifiable images or recordings, particularly where participants have not agreed to public display.

3. Protection of sensitive biological information

Scientific exhibitions may display genetic sequences, medical records, laboratory photographs, or clinical research results. Where such information relates to identifiable individuals, privacy and confidentiality obligations become particularly important.

4. Cookies and visitor tracking

Websites may use cookies, analytics tools, and tracking technologies to understand visitor behaviour. Organisers should provide appropriate privacy information and obtain consent where required by applicable law.

5. Cybersecurity and unauthorised access

Online exhibitions may face hacking, phishing, data theft, and unauthorised downloading of confidential material. Security measures should include encryption, access controls, secure hosting, regular updates, and incident response procedures.

Relevant case laws

There are limited reported decisions specifically concerning data protection in online exhibitions. However, the following judgments establish principles applicable to digital privacy and information protection.

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court of India recognised privacy as a fundamental right under Article 21. The judgment established that individuals have an important interest in controlling the collection and use of their personal information. It provides a constitutional foundation for protecting visitor information and identifiable research material displayed online.

2. District Registrar and Collector, Hyderabad v. Canara Bank (2005)

The Supreme Court recognised the importance of privacy and confidentiality in personal records. The judgment is relevant to online exhibition organisers handling confidential visitor information and sensitive documents.

3. Google Spain SL v. Agencia Española de Protección de Datos (2014)

The Court of Justice of the European Union examined the processing and accessibility of personal information through online search results. The judgment demonstrates that online publication and accessibility can create significant privacy concerns.

4. Breyer v. Bundesrepublik Deutschland (2016)

The Court of Justice of the European Union considered whether dynamic IP addresses could constitute personal data. The decision is relevant because online exhibition platforms may collect IP addresses and other technical identifiers that can contribute to identifying visitors.

These cases provide analogous principles rather than direct rulings on online exhibitions.

Compliance measures for exhibition organisers

Organisers should adopt the following safeguards:

Publish a clear and accessible privacy policy.

Obtain appropriate consent before collecting or displaying personal information.

Avoid publishing identifiable medical or genetic information without a lawful basis.

Use encryption and secure authentication systems.

Establish data retention and deletion policies.

Restrict access to confidential exhibition materials.

Enter into suitable data processing agreements with hosting and technology providers.

Establish procedures for handling complaints and data breaches.

Conclusion

Data protection in online exhibitions is essential for maintaining visitor trust and preventing the misuse of personal and scientific information. Indian data protection legislation, the Information Technology Act, and international frameworks such as the GDPR provide important legal safeguards. Exhibition organisers must ensure transparency, lawful processing, appropriate consent, cybersecurity, and responsible publication practices. These measures become particularly important when exhibitions involve medical images, genetic information, clinical research, or other sensitive biological materials.