1. Introduction 

Cognitive-Emotion Data Fiduciary Duties refers to the legal and ethical responsibilities of an organisation that collects, analyses, stores, infers, or shares information about an individual's emotions, mental states, cognitive responses, or psychological tendencies.

The term is best understood as an emerging legal theory rather than the name of a separately enacted statute or a universally recognised judicial doctrine. Its foundations can be found in data-protection law, constitutional privacy, consumer protection, employment law, anti-discrimination principles, and rules governing artificial intelligence.

Examples of cognitive-emotion data include:

Facial expressions analysed to infer happiness, anger, sadness, or stress.

Voice recordings processed to estimate anxiety, confidence, or emotional distress.

Eye movements and reaction times used to infer attention or cognitive fatigue.

Digital behaviour used to predict vulnerability, impulsiveness, or psychological susceptibility.

Brain-signal data collected through neurotechnology to infer attention, intentions, or emotional responses.

A crucial distinction is that observed behaviour is not the same as a person's actual emotional state. An algorithm may classify a neutral expression as anger or nervousness as dishonesty. Consequently, fiduciary duties should address both the protection of the data and the risks of making consequential decisions based on unreliable psychological inferences.

2. What is a cognitive-emotion data fiduciary?

A cognitive-emotion data fiduciary is, for the purposes of this analysis, an organisation that determines why and how personal cognitive or emotional data is processed.

Examples include:

Il software veloce e sicuro per l'accesso remoto | TeamViewer

Employers and workplace-monitoring providers

Organisations using voice, facial-expression, or attention analytics to evaluate employee performance, engagement, stress, or suitability for a role.

Volgsoftware op school: ‘Kinderen groeien op met idee dat surveillance normaal is’

Educational technology companies

Platforms that attempt to measure student attention, emotional engagement, frustration, or concentration through cameras and behavioural analytics.

How AI Is Shaping the Future of Mental Health Care

Digital platforms and AI providers

Services that infer emotional vulnerabilities or psychological preferences to personalise advertising, recommendations, or conversational experiences.

Как нейротехнологии меняют обучение, работу и даже наше тело | РБК Компании

Neurotechnology and research organisations

Providers that process neural signals or related information to investigate cognition, emotion, or mental responses.

The organisation's precise legal status depends on the applicable jurisdiction and its actual role. A company that determines processing purposes may be a data fiduciary or controller, while a vendor processing information solely on another organisation's instructions may instead be a processor.

3. Principal fiduciary duties

The following framework describes the duties that should govern cognitive-emotion data processing. Some are directly required by existing legislation; others are proposed safeguards derived from privacy, fairness, and accountability principles.

A. Duty of informed and meaningful consent

An organisation should explain, in clear language:

What data it collects, including whether it analyses facial movements, voice, or neural signals.

Which emotions or cognitive characteristics it attempts to infer.

Why it needs those inferences and how they will be used.

Whether the information will influence employment, education, insurance, credit, healthcare, or other consequential decisions.

Whether the information will be shared with third parties.

Consent should not be treated as meaningful merely because a user clicked an acceptance button. Where refusing would cause a person to lose access to an essential service or employment opportunity, the voluntariness of consent requires particular scrutiny.

Legal foundation: India's Digital Personal Data Protection Act, 2023 (DPDP Act), contains provisions on notice and consent in Sections 5 and 6. Its application to a particular system depends on the statutory commencement and applicable rules.

IndiaCode+1

B. Duty of purpose limitation

Emotion data collected to improve a user's experience should not automatically be repurposed to rank employees, screen job applicants, assess insurance risk, or manipulate purchasing decisions.

For example, an application that estimates a user's stress to offer optional relaxation exercises should not silently transfer those estimates to an employer to identify employees considered insufficiently resilient.

The fiduciary should establish defined purposes before collection and assess whether subsequent uses are compatible with the applicable law and original disclosures.

C. Duty of data minimisation

The organisation should collect only the information reasonably necessary for a legitimate purpose.

If an ordinary user survey can adequately measure customer satisfaction, continuous facial surveillance may be excessive. If a student can request assistance directly, a school should carefully justify the necessity of continuously estimating that student's emotional state through a webcam.

Minimisation may involve:

Avoiding continuous recording when occasional measurements suffice.

Processing data locally rather than transmitting raw recordings.

Retaining derived scores only when necessary.

Removing unnecessary identifiers.

Prohibiting collection of neural or emotional information unrelated to the service.

D. Duty of accuracy and epistemic caution

This duty is especially important because emotional states are difficult to infer reliably.

A responsible organisation should not represent an algorithmic estimate as a verified psychological fact. It should evaluate performance across relevant demographic groups, environmental conditions, languages, disabilities, and cultural contexts.

Where an inference may affect a person materially, appropriate safeguards should include:

Testing the system's validity for the particular intended use.

Communicating uncertainty and known limitations.

Providing a process for correcting inaccurate information.

Avoiding adverse decisions based solely on weak emotional proxies.

Periodically reviewing model performance and error rates.

Illustration: An automated interview system labels an applicant as dishonest because the applicant avoids eye contact. Without reliable evidence that the inference is valid in that context, using it to reject the applicant may raise serious fairness and discrimination concerns.

E. Duty of confidentiality and security

Cognitive-emotion data can reveal intimate personal information. A breach could expose not merely a person's identity but also inferred vulnerabilities, behavioural tendencies, or private psychological experiences.

Appropriate measures include encryption, access restrictions, secure deletion, vendor oversight, incident-response procedures, and controls against unauthorised reuse.

Under Section 8 of India's DPDP Act, data fiduciaries have statutory responsibilities concerning security safeguards, breach notification, processing through data processors, and erasure when legally required.

IndiaCode+1

F. Duty of non-manipulation and non-exploitation

A fiduciary should not exploit emotional vulnerability merely because its algorithms can predict it.

Examples of problematic practices include targeting people inferred to be distressed with aggressive sales messages, using anxiety estimates to encourage excessive spending, or manipulating emotionally vulnerable users into disclosing further personal information.

This proposed duty draws on privacy, consumer-protection, autonomy, and fairness principles. Whether a specific practice is unlawful depends on the relevant statute and facts; not every emotionally personalised recommendation is automatically prohibited.

G. Duty of fairness and non-discrimination

Emotion-recognition systems can produce unequal outcomes because expressions, communication patterns, disability-related behaviours, and cultural conventions vary.

A fiduciary should investigate whether a system disadvantages protected or vulnerable groups, particularly when the results influence hiring, education, healthcare, public benefits, or access to financial services.

An appropriate fairness assessment should consider both technical error rates and the consequences of those errors. A false inference used to recommend optional content is different from a false inference used to deny employment.

H. Duty of accountability and independent review

An organisation should be able to explain:

Why the data was collected.

Which system generated a particular inference.

Who had access to the information.

How the inference affected a decision.

What safeguards were applied.

How the individual can challenge the outcome.

For high-risk processing, a documented impact assessment, independent audit, and meaningful human review may be appropriate or legally required, depending on the applicable framework.

Under Sections 8 and 10 of India's DPDP Act, general fiduciary obligations and additional duties for notified Significant Data Fiduciaries provide relevant statutory reference points.

IndiaCode+1

4. Important case laws and their relevance

There is no established body of cases specifically titled Cognitive-Emotion Data Fiduciary Duties. The following judgments provide relevant legal principles by analogy. They do not all concern emotion-recognition technology directly.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Supreme Court of India · (2017) 10 SCC 1

Facts and legal issue: A nine-judge Constitution Bench considered whether privacy is a constitutionally protected fundamental right.

Decision: The Court unanimously recognised privacy as a fundamental right protected under Article 21 and other freedoms in Part III of the Constitution. The judgment connected privacy with dignity, autonomy, and the ability to make intimate personal choices.

Indian Kanoon+1

Relevance to cognitive-emotion data: Emotional and cognitive information can reveal deeply personal aspects of an individual's life. Unauthorised psychological profiling may therefore raise questions of informational privacy, dignity, and autonomy.

Legal principle: State interference with protected privacy interests must satisfy applicable constitutional requirements, including legality, legitimate purpose, and proportionality. The precise requirements depend on the nature of the interference.

Limitation: Puttaswamy did not create a separate statutory fiduciary duty specifically for emotion-recognition systems, nor does every private-sector processing activity automatically constitute a constitutional violation.

Case 2: Bărbulescu v. Romania (2017)

European Court of Human Rights, Grand Chamber · Application No. 61496/08

Facts: An employer monitored an employee's workplace communications. The dispute concerned the employee's privacy and whether the domestic courts had adequately examined the monitoring.

Decision: The Grand Chamber emphasised the importance of safeguards when evaluating workplace monitoring, including advance notice, the extent of monitoring, legitimate reasons, less intrusive alternatives, consequences for the employee, and adequate protection against misuse.

HUDOC+1

Relevance: Emotion analytics can be more intrusive than ordinary activity monitoring because they attempt to infer internal psychological states from observable behaviour.

Legal principle: Workplace monitoring must be evaluated in context and balanced against privacy interests; managerial convenience alone does not settle the question.

Practical application: Before deploying an employee emotion-scoring system, an employer should establish necessity, define the scope of monitoring, notify affected workers, restrict access, and provide safeguards for challenging consequential decisions.

Case 3: López Ribalda and Others v. Spain (2019)

European Court of Human Rights, Grand Chamber · Applications Nos. 1874/13 and 8567/13

Facts: Employees were subjected to covert video surveillance in a supermarket following suspected theft.

Decision: The Court examined whether the surveillance and the domestic courts' assessment struck a fair balance between privacy and the employer's legitimate interests. It considered factors including the justification for monitoring, its scope and duration, its intrusiveness, and available safeguards. The outcome depended on the circumstances of the case.

HUDOC+1

Relevance: The case illustrates that workplace surveillance is not assessed in isolation from its purpose and proportionality. Continuous emotion monitoring would require a similarly careful assessment, especially if conducted secretly or used to make employment decisions.

Important distinction: The judgment did not specifically approve emotion-recognition software. Its value is in the principles governing workplace surveillance.

Case 4: Puttaswamy and informational self-determination

The informational-privacy reasoning in Puttaswamy is also relevant to data practices that construct detailed profiles from seemingly ordinary observations.

For example, a platform might combine a person's voice, browsing activity, pauses, and facial movements to infer anxiety or susceptibility to persuasion. Even if the raw observations appear innocuous, their combination may reveal more sensitive information.

The legal question is not merely whether the platform possesses the data. It is also whether the processing has an adequate legal basis, is proportionate to its purpose, respects applicable rights, and includes appropriate safeguards.

Case 5: López Ribalda read with Bărbulescu

Together, these European human-rights decisions provide a useful framework for assessing workplace cognitive surveillance:

Transparency and prior notice are important.

The more intrusive the monitoring, the stronger the justification generally needs to be.

Less intrusive alternatives should be considered.

The extent and duration of monitoring matter.

Effective safeguards and remedies must be considered.

These principles are relevant by analogy, but their direct legal effect depends on jurisdiction. They are not automatically binding precedents in Indian courts.

5. European Union law: specific regulation of emotion recognition

The European Union provides an important example of legislation that directly addresses emotion-recognition AI.

Under Article 5(1)(f) of the EU Artificial Intelligence Act, Regulation (EU) 2024/1689, certain AI systems intended to infer emotions of natural persons in workplaces and educational institutions are prohibited, subject to specified exceptions. The provision distinguishes emotion recognition from physical states such as pain or fatigue and excludes certain medical or safety-related uses from the prohibition.

AI Act Service Desk+1

This is significant because it moves beyond general privacy principles and places specific limits on particular uses of emotion-recognition technology.

The distinction matters:

The EU framework demonstrates that consent alone does not necessarily make every use of emotion-recognition technology permissible.

6. Indian statutory framework

In India, the principal starting point is the DPDP Act, 2023, read with applicable commencement notifications and rules.

Section 5 — Notice

Individuals must receive the prescribed notice about the personal data and purpose of processing. A vague notice that merely says a service uses AI may not adequately explain the actual processing involved.

Section 6 — Consent

Consent must satisfy the statutory requirements. A system should not assume that agreement to ordinary service terms automatically authorises every subsequent use of inferred emotional data.

Section 8 — General obligations of Data Fiduciary

The provision addresses responsibility for processing, processor contracts, accuracy and consistency in relevant circumstances, security safeguards, breach notification, erasure, and grievance redressal.

Section 9 — Children's personal data

The provision establishes additional protections, including requirements concerning verifiable parental consent and restrictions on specified harmful processing practices, subject to applicable statutory exceptions.

Section 10 — Significant Data Fiduciaries

Notified Significant Data Fiduciaries have additional duties, including appointing a Data Protection Officer and independent auditor and undertaking prescribed impact assessments and audits.

The statutory text and provisions should be checked against the applicable commencement notifications and rules before being applied to a particular dispute.

IndiaCode+3

Does Indian law treat emotional data as sensitive personal data?

The DPDP Act does not establish a separate statutory category called cognitive-emotion data. Its applicability turns on whether the information qualifies as digital personal data within the Act's scope and whether an exclusion applies.

Consequently, identifiable facial recordings, voice recordings, behavioural information, or psychological inferences may be covered depending on the circumstances. The legal analysis should not assume that all emotional data is automatically subject to a distinct sensitive-data regime.

The constitutional privacy principles in Puttaswamy may provide an additional basis for analysing government processing and related constitutional questions. Private-sector disputes may also engage contractual, employment, consumer-protection, and other applicable legal obligations.

7. Application to hypothetical disputes

Consider three examples showing how the proposed fiduciary duties could operate.

Scenario A: Employee emotion scoring

An employer deploys cameras that classify employees as angry, distracted, or disengaged. Workers are not told about the analysis, and the scores influence promotions.

Potential legal issues: Privacy, inadequate transparency, disproportionate monitoring, inaccurate inference, discrimination, and unfair employment decisions.

Likely safeguards: Prior notice, documented necessity, validated methods, restricted access, a meaningful challenge process, and consideration of less intrusive alternatives. EU workplace restrictions may independently prohibit the system unless an exception applies.

Scenario B: Emotional vulnerability advertising

A shopping platform predicts that certain users are anxious or impulsive and directs high-pressure advertising at them.

Potential legal issues: Unfair or deceptive practices, unlawful data processing, manipulative design, and misuse of personal information.

Likely safeguards: Purpose limitation, transparent processing, controls on profiling, and assessment of whether the practice exploits vulnerable users or breaches applicable consumer-protection rules.

Scenario C: Student attention surveillance

An online examination provider estimates attention from facial movements and penalises students whose scores suggest distraction.

Potential legal issues: Reliability of inference, procedural fairness, privacy, children's data protections where relevant, and potentially specific AI restrictions.

Likely safeguards: Avoid unsupported conclusions, provide an appeal process, use less intrusive assessment methods, and ensure that adverse decisions are supported by reliable evidence rather than emotional estimates alone.

These are hypothetical applications, not findings that any particular company has violated the law.

8. Accountability, remedies, and liability

A breach of cognitive-emotion data duties can potentially lead to several forms of legal consequence, depending on the jurisdiction and the facts.

Under the DPDP Act, the Data Protection Board has statutory enforcement functions, and penalties may apply to specified contraventions. The availability of a particular remedy depends on the applicable provisions; a claimant should not assume that every privacy breach automatically creates an independent right to compensation.

For high-risk systems, an organisation should preserve evidence of its processing purposes, notices, consent records where applicable, technical validation, access controls, audit results, complaints, and corrective measures.

9. A model framework for cognitive-emotion data fiduciary duties

A proposed governance framework can be organised into eight principles:

Legitimacy: Establish a lawful and sufficiently specific purpose before collecting cognitive-emotion data.

Autonomy: Respect the individual's ability to understand, refuse, or challenge processing where the applicable law provides for it.

Proportionality: Ensure that the intrusion is justified by the importance of the objective and that less intrusive alternatives are considered.

Reliability: Do not equate probabilistic emotional predictions with established psychological facts.

Confidentiality: Restrict access and prevent unauthorised disclosure, repurposing, and retention.

Fairness: Assess error rates, disparate effects, and the consequences of decisions based on emotional inferences.

Contestability: Give affected individuals appropriate ways to question inaccurate data and consequential decisions.

Accountability: Document compliance, conduct appropriate assessments, monitor vendors, and remedy identified harms.

This framework is a proposed synthesis of established legal principles, not a claim that every principle currently exists as a freestanding statutory duty in every jurisdiction.

10. Conclusion

Cognitive-Emotion Data Fiduciary Duties address a fundamental question of modern data governance: What responsibilities should an organisation bear when it can infer a person's emotional or cognitive state from personal data?

The strongest existing legal foundations include India's constitutional privacy jurisprudence in K.S. Puttaswamy, the workplace-surveillance principles in Bărbulescu and López Ribalda, applicable data-protection legislation, and the EU AI Act's specific restrictions on certain emotion-recognition systems.

Taken together, these sources support a careful approach based on legality, transparency, necessity, proportionality, accuracy, security, fairness, and accountability. They do not, however, establish a single universal doctrine called Cognitive-Emotion Data Fiduciary Duties.

The central legal challenge is to ensure that organisations cannot convert uncertain psychological predictions into intrusive surveillance, manipulative commercial practices, or unjustified decisions affecting people's lives.