Secure Multiparty Computation for Joint Analyses Compliance

Introduction

Secure Multiparty Computation (MPC) is a cryptographic technique that enables two or more parties to jointly analyse data without revealing their individual datasets to one another. For example, hospitals may calculate disease trends across patient records without directly exchanging identifiable medical information. MPC can reduce privacy risks, but it does not automatically make a joint analysis lawful. Compliance still depends on the purpose of processing, legal authority, consent, data minimisation, security, accountability and safeguards against re-identification.

In India, MPC-based health and biotechnology research must be assessed under constitutional privacy principles, applicable data-protection law, research ethics guidelines and sector-specific rules.

Legal Framework

Article 21 of the Constitution protects the right to privacy. The Justice K.S. Puttaswamy (Retd.) v. Union of India judgment recognises informational privacy and requires state action affecting privacy to satisfy legality, legitimate purpose and proportionality. Thus, joint analysis involving sensitive health or genetic data should have a lawful basis and use only data necessary for the stated objective.

The Digital Personal Data Protection Act, 2023, where applicable and in force, regulates processing of digital personal data. MPC may help organisations reduce disclosure, but encrypted or secret-shared data should not simply be presumed outside the law. If the processing can relate to an identifiable individual, the parties must evaluate their obligations under the applicable provisions and commencement rules.

The ICMR National Ethical Guidelines for Biomedical and Health Research Involving Human Participants, 2017, require ethical review, informed consent or a justified waiver, confidentiality and responsible data use. A joint analysis should remain within the approved research purpose and consent conditions.

Compliance Requirements

A compliant MPC project should:

Define the purpose: Specify the research or analytical question and prohibit unrelated secondary use.

Identify roles: Determine which organisations decide the purpose and means of processing and document their respective responsibilities.

Minimise data: Use only necessary attributes; avoid uploading raw identifiers into the computation.

Secure the protocol: Assess cryptographic design, key management, access controls, leakage through outputs and risks from collusion among participants.

Control results: Apply output review, aggregation or suppression where results could reveal individual-level information.

Maintain accountability: Keep records of consent or other legal basis, ethics approval, security testing, data-sharing terms and incident-response procedures.

MPC is a technical safeguard—not a substitute for legal permission, ethics approval or sound governance.

Relevant Case Laws

1. ** Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1**
The Supreme Court recognised informational privacy as part of Article 21 and emphasised lawful, legitimate and proportionate handling of personal information. This provides the central constitutional basis for privacy safeguards in joint data analysis.

Indian Kanoon

2. ** Samira Kohli v. Dr. Prabha Manchanda (2008) 2 SCC 1**
The Court held that valid medical consent must be voluntary and informed, and should relate to the procedure undertaken. Though not an MPC case, its consent principles are relevant when health data is reused for collaborative research.

3. ** Anivar A. Aravind v. Union of India (Karnataka High Court, 2021)**
The Aarogya Setu litigation raised concerns about collection and sharing of health-related information and informed consent. The proceedings are relevant as a caution against treating technical safeguards as a replacement for transparent legal authority.

No reported Indian Supreme Court decision directly determines compliance requirements for secure multiparty computation. These authorities therefore apply through broader privacy, consent and research-governance principles.

Conclusion

Secure multiparty computation can make collaborative research safer by allowing analysis without direct disclosure of source datasets. Nevertheless, compliance requires more than encryption: parties must establish a lawful basis, respect consent and ethics approval, minimise inputs, govern outputs and document responsibility. The strongest approach combines MPC with privacy impact assessment, independent security review and enforceable data-sharing agreements. The ICMR guidelines specifically call for ethical review, controlled access, security measures and protection of privacy in digital health research.

DHR ePMS+1