1. Introduction

The Commercial Biosurveillance Accountability Doctrine is a proposed legal and governance framework for holding private companies accountable when they collect, analyse, monitor, store, share, or commercially exploit biological and health-related information.

It concerns the intersection of commercial activity, biological surveillance, informational privacy, bodily autonomy, data protection, consumer protection, and corporate responsibility.

Important legal clarification: As of November 2026, the phrase Commercial Biosurveillance Accountability Doctrine should be treated as an analytical or proposed doctrine, not as a separately established cause of action expressly recognised under that name by the Supreme Court of India. Its legal foundations can instead be developed from existing constitutional principles, statutes, and judicial precedents.

Commercial biosurveillance may involve:

Genetic testing companies collecting DNA samples and genetic profiles.

Digital health applications tracking symptoms, sleep, heart rate, reproductive health, or other health indicators.

Employers or insurers using biological information to evaluate individuals.

Biotechnology companies combining medical records with consumer databases.

Companies using wearable devices or predictive algorithms to infer disease risks.

Data brokers selling or sharing health-related information with advertisers, insurers, or other commercial entities.

The central legal question is:

When a company monitors biological information for commercial purposes, who is responsible for ensuring that the monitoring is lawful, transparent, proportionate, secure, and free from unjustified discrimination?

The doctrine seeks to ensure that commercial innovation does not eliminate individual rights or allow businesses to treat biological information as an unrestricted commercial asset.

2. Meaning and scope of the doctrine

The accountability framework

Biological information

DNA, health records, biomarkers, wearable data and biological inferences

Commercial processing

Collection, analysis, profiling, storage, disclosure and monetisation

Legal accountability

Lawful purpose, consent where required, security, oversight and remedies

The doctrine has five principal objectives:

Prevent unlawful surveillance: Companies should not collect or infer sensitive biological information without an appropriate legal basis.

Ensure transparency: Individuals should understand what is collected, why it is processed, and with whom it may be shared.

Assign responsibility: Businesses must be answerable for misuse, security failures, deceptive practices, and unauthorised disclosures.

Prevent discrimination: Biological profiles should not become a tool for unjustified exclusion from employment, insurance, credit, or essential services.

Provide remedies: Affected individuals should have meaningful avenues to challenge unlawful processing and obtain remedies available under applicable law.

The framework applies not only to the initial collection of data but also to subsequent use, commercial transfers, algorithmic inferences, retention, and deletion.

3. Legal foundations in India

A. Constitution of India

The Constitution primarily governs State action, but its fundamental-rights framework is important when commercial biosurveillance involves government authorities, statutory systems, or State-supported programmes. Constitutional values can also inform the interpretation of legislation governing private businesses.

Article 21 — Right to life, dignity and privacy

In Justice K.S. Puttaswamy (Retd.) v. Union of India (2017), the Supreme Court recognised privacy as a fundamental right. Privacy includes interests in personal autonomy and control over information about oneself.

Commercial implications include scrutiny of intrusive collection and use of identifiable genetic or health data, particularly where the activity seriously affects personal dignity or autonomy.

Article 14 — Equality and non-arbitrariness

Biological profiling may raise equality concerns when a public authority or legally regulated decision-making system treats people differently on arbitrary or impermissible grounds.

Article 19 — Fundamental freedoms

Biological surveillance may indirectly affect freedom of expression, association, movement, or participation in public life if individuals fear that their health or biological characteristics will be monitored and exploited.

Article 32 and Article 226 — Constitutional remedies

These provisions allow appropriate proceedings before the Supreme Court and High Courts, respectively, where the requirements for constitutional jurisdiction are satisfied. A purely private dispute does not automatically become a constitutional claim; the nature of the respondent, the legal duty involved, and the relief sought matter.

B. Statutory framework

Important distinction: Not every biological sample is itself digital personal data. A DNA sample, a digital genetic profile, and a health inference produced by an algorithm may engage different legal rules. The applicable legislation must be examined according to the nature of the information, the activity, and the parties involved.

The precise commencement and applicability of data-protection provisions must also be verified before relying on a particular statutory duty in litigation.

4. Leading case laws and their application

The following decisions provide the strongest judicial foundations for constructing a commercial biosurveillance accountability framework. Some directly address privacy or biological information; others provide analogous principles that can be applied to commercial surveillance disputes.

Case 1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Supreme Court of India · (2017) 10 SCC 1

Facts and issue: A constitutional challenge concerning privacy arose in the context of the Aadhaar identification system. The Supreme Court considered whether privacy is protected as a fundamental right under the Indian Constitution.

Judgment: A nine-judge bench unanimously recognised the fundamental right to privacy, including informational privacy, under the Constitution.

Legal principles relevant to commercial biosurveillance:

Privacy protects personal autonomy and informational control.

Privacy is not automatically surrendered merely because information is held by another entity.

Intrusions must satisfy applicable requirements of legality, legitimate purpose, and proportionality in the constitutional context.

The judgment recognised that informational-privacy risks can arise from non-State actors as well as government.

Application: Suppose a commercial genetic-testing company collects DNA samples to provide ancestry reports but subsequently sells identifiable genetic profiles to advertising companies without adequate disclosure or legal authority. The privacy principles in Puttaswamy offer a strong analytical basis for assessing the intrusion, although the precise cause of action against a private company depends on the applicable statutory and civil-law framework.

Importance: This is the foundational Indian constitutional authority for the proposed doctrine.

Indian Kanoon+1

Case 2. Selvi v. State of Karnataka (2010)

Supreme Court of India · (2010) 7 SCC 263

Facts and issue: The case concerned the involuntary administration of narcoanalysis, polygraph examinations, and brain electrical activation profile tests to accused persons and suspects.

Judgment: The Supreme Court held that the involuntary administration of the impugned techniques violated constitutional protections, including Article 20(3) and Article 21.

Relevance: The decision emphasises bodily integrity, mental privacy, and the constitutional limits of compelled investigative techniques.

Application: A commercial company cannot assume that its technological ability to infer a person's biological or cognitive characteristics gives it unrestricted legal authority to obtain them. However, Selvi does not establish a blanket prohibition on every biological test, and it did not directly decide ordinary commercial data-processing disputes.

Doctrine principle: Technological capability does not itself create legal authority to intrude upon bodily or mental autonomy.

Supreme Court

Case 3. District Registrar and Collector v. Canara Bank (2005)

Supreme Court of India · (2005) 1 SCC 496

Legal issue: The case concerned statutory powers permitting the inspection of private documents and the protection of privacy in personal records.

Judgment and principle: The Court recognised the importance of privacy in confidential documents and examined the constitutional limits of intrusive inspection powers.

Application to commercial biosurveillance: Health records, laboratory reports, genetic databases, and biometric records should not be treated as freely accessible simply because an institution possesses them. Access and disclosure must be assessed under the applicable law and the circumstances of collection.

Importance: This authority supports the principle that possession of sensitive information does not necessarily justify unrestricted access or disclosure.

Case 4. People's Union for Civil Liberties v. Union of India (1997)

Supreme Court of India · (1997) 1 SCC 301

Facts and issue: The case examined telephone interception and safeguards against arbitrary surveillance.

Judgment: The Supreme Court prescribed procedural safeguards governing telephone interception under the legal regime then applicable.

Relevance to commercial biosurveillance: Although the judgment concerned government interception rather than corporate health-data processing, it illustrates why surveillance powers need authorisation, procedural controls, review, and accountability.

Hypothetical application: A private health-data company receiving a legally valid request for customer information should verify the request's legal basis, disclose only what the law requires, and preserve appropriate records. Whether a particular disclosure is lawful depends on the governing statute and the circumstances.

Importance: Surveillance must be controlled by rules and safeguards rather than left to unrestricted discretion.

Case 5. Justice K.S. Puttaswamy (Aadhaar-5J.) v. Union of India (2019)

Supreme Court of India · (2019) 1 SCC 1

Issue: The Court examined the Aadhaar framework and its constitutional validity, including questions concerning proportionality, privacy, and the use of identity information.

Relevance: The decision is important for understanding how identity systems and large databases should be evaluated against constitutional rights.

Application: A commercial platform that links biometric identifiers with medical information, location histories, and consumer profiles creates risks of identification, tracking, and secondary use. The Aadhaar litigation offers a relevant framework for examining those risks, but its specific holdings must not be treated as a universal prohibition on biometric databases.

Case 6. Sharda v. Dharmpal (2003)

Supreme Court of India · (2003) 4 SCC 493

Issue: The case concerned the power of a matrimonial court to direct medical examinations during proceedings.

Judgment and principle: The Court held that a medical examination may be ordered in appropriate circumstances under law; privacy does not create an absolute bar against every court-directed examination.

Relevance: The proposed doctrine must distinguish between unlawful commercial collection, genuinely voluntary testing, and legally authorised medical examinations. Neither privacy nor commercial convenience should be treated as an absolute rule overriding every competing legal interest.

Case 7. S. and Marper v. United Kingdom (2008)

European Court of Human Rights · Applications Nos. 30562/04 and 30566/04

Facts: The applicants challenged the indefinite retention of their fingerprints, cellular samples, and DNA profiles after criminal proceedings had not resulted in convictions.

Judgment: The Grand Chamber found a violation of Article 8 of the European Convention on Human Rights, which protects private and family life.

Relevance: The Court recognised the privacy significance of retaining biological material and genetic profiles, even where the information had originally been lawfully collected.

Commercial application: A company should not automatically retain identifiable genetic material indefinitely simply because a customer originally agreed to testing. The lawful retention period, original purpose, subsequent use, and applicable deletion requirements must be assessed.

Jurisdictional qualification: This is a European human-rights judgment, not binding precedent in India. It is persuasive comparative authority.

Indian Kanoon+1

Case 8. Maryland v. King (2013)

Supreme Court of the United States · 569 U.S. 435 (2013)

Issue: The Court examined DNA collection from qualifying individuals arrested for serious offences under Maryland law.

Judgment: The majority upheld the particular DNA-collection procedure as a reasonable search under the Fourth Amendment in the circumstances before it.

Relevance: The case demonstrates that the legality of collecting biological information depends on the legal authority, purpose, procedure, and interests involved.

Important limitation: The judgment does not grant private companies general authority to collect DNA, and it should not be read as permitting unrestricted commercial genetic surveillance.

Case 9. Carpenter v. United States (2018)

Supreme Court of the United States · 585 U.S. 296 (2018)

Issue: Whether government acquisition of historical cell-site location records constituted a search under the Fourth Amendment.

Judgment: The Court held that the government generally needed a warrant supported by probable cause to obtain the historical location records at issue.

Relevance: Although the case concerned location information rather than biological data, it demonstrates that the aggregation of sensitive information held by third parties can raise substantial privacy concerns.

Commercial application: Combining wearable-device readings, health-app histories, location records, and genetic information can reveal far more than any individual dataset. The legality of such aggregation must be assessed under the relevant privacy, consumer-protection, and data-protection rules.

The holding is limited to its legal context and does not automatically extend the US warrant requirement to private companies or all biological data.

LII / Legal Information Institute

5. Current Indian data-protection law: an important qualification

The Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025, are central to the future regulation of commercial biosurveillance in India.

However, the Act has a phased commencement schedule. The notification dated 13 November 2025 brought certain provisions into force immediately, while many substantive provisions—including the principal processing, notice, consent, and individual-rights framework—were scheduled to commence 18 months after publication, in May 2027. Therefore, as of 2 November 2026, it would be incorrect to assume that every provision of the Act is already operative.

eGazette+2

For a present-day dispute, lawyers should identify the provisions actually in force on the relevant date and examine other applicable laws, including the Information Technology Act and applicable rules.

The DPDP framework is nevertheless important for compliance planning because it articulates principles such as transparency, purpose limitation, data minimisation, security safeguards, and accountability.

Press Information Bureau+1

6. Core principles of the Commercial Biosurveillance Accountability Doctrine

The proposed doctrine can be organised into eight principles.

1. Lawful collection

Companies must identify the applicable legal basis for collecting and processing biological information. Where consent is required, it should be obtained in the manner prescribed by the governing law. Consent must not be misrepresented or obtained through deceptive practices.

2. Purpose limitation

Information collected to provide a medical report should not automatically be repurposed for advertising, employment screening, insurance profiling, or unrelated commercial research.

3. Data security

Companies should implement risk-appropriate technical and organisational safeguards, including access controls, encryption where appropriate, secure sample handling, and breach-response procedures.

4. Retention and deletion

Physical samples and digital profiles should be retained only for a legally permissible and justified period. The rules governing samples, derived profiles, research records, and legally required records may differ.

5. Third-party accountability

Contracts with laboratories, cloud providers, data brokers, research partners, and other recipients should specify permitted uses, security responsibilities, onward disclosure, and incident reporting.

6. Algorithmic accountability

Companies should assess the scientific reliability, error rates, limitations, and discriminatory effects of biological predictions, particularly when those predictions influence significant decisions.

7. Auditability and transparency

Records should document the source of data, authorised access, processing activities, disclosures, retention decisions, and responses to complaints.

8. Effective remedies

Individuals should be able to challenge unlawful practices through applicable complaint procedures, regulatory processes, contractual claims, civil proceedings, or constitutional remedies where the legal requirements are satisfied.

These are proposed doctrinal principles, not eight independently enforceable legal duties automatically applicable to every company. Their enforceability depends on the relevant statute, contract, regulatory regime, or judicially recognised right.

7. Corporate liability under the doctrine

Commercial biosurveillance can produce several distinct forms of legal liability.

Liability is not automatic merely because biological information has been collected or a data breach has occurred. A claimant must establish the applicable legal duty, violation, jurisdictional requirements, and other elements relevant to the particular remedy.

Example: Genetic-testing company

Suppose a company collects saliva samples to generate genetic ancestry reports. It later links identifiable profiles to consumer purchasing histories and sells health-risk predictions to third parties without an adequate legal basis.

The potential legal questions include:

What representations did the company make when obtaining the samples?

What legal basis governed the collection and subsequent processing?

Did the company disclose its intended commercial uses?

Were the transfers permitted by the applicable law and contractual terms?

Were appropriate security and access controls maintained?

Did the activity cause legally actionable harm or violate a specific statutory obligation?

The answers determine the available claims and remedies. A privacy-policy violation, statutory breach, contractual breach, and compensable tort are related possibilities but are not interchangeable legal conclusions.

8. Comparative corporate accountability: the United States

Commercial biosurveillance accountability is not limited to constitutional privacy law. Consumer-protection enforcement can be particularly important where private companies make misleading claims about health-data handling.

In the United States, the Federal Trade Commission can address certain unfair or deceptive commercial practices under Section 5 of the Federal Trade Commission Act. The FTC has also updated its Health Breach Notification Rule to address certain health-information breaches involving entities outside the traditional HIPAA-covered framework.

PMC+1

This is relevant because some consumer health applications and connected devices may operate outside the scope of particular healthcare privacy rules while remaining subject to other applicable laws.

For example, a company that promises not to share users' reproductive-health data but secretly discloses that information to advertising partners may face consumer-protection scrutiny, depending on the facts and applicable law.

The FTC framework is a comparative example, not Indian law. Indian companies must be assessed under the laws applicable to their activities and the relevant jurisdiction.

9. Public health versus commercial surveillance

A key challenge is distinguishing legitimate biological monitoring from unjustified commercial exploitation.

Even a legitimate medical or public-health objective does not justify every method of collection or every secondary use. Equally, biological monitoring is not necessarily unlawful merely because it uses sensitive information.

The correct analysis depends on the purpose, legal authority, scientific validity, degree of intrusion, safeguards, and consequences.

10. Remedies and enforcement mechanisms

Depending on the facts and the law in force, an affected individual may consider:

Regulatory complaints: Reporting unlawful data processing, deceptive practices, or security failures to the competent authority.

Consumer proceedings: Challenging unfair trade practices or misleading representations where consumer law applies.

Civil claims: Seeking contractual or other legally available relief where the elements of the claim are satisfied.

Constitutional proceedings: Seeking judicial review where a qualifying constitutional claim exists.

Corrective measures: Requesting cessation of unlawful processing, correction of information, or deletion where a legal or contractual entitlement supports that request.

Compensation: Seeking damages or statutory compensation where the relevant legal requirements are met.

For practical enforcement, evidence may include consent forms, privacy notices, laboratory agreements, data-sharing contracts, audit logs, breach notifications, and correspondence with the company.

11. Critical legal issues and unresolved questions

The proposed doctrine raises several difficult questions for courts and regulators.

First, ownership versus control: Does purchasing a genetic-testing service give a company ownership of the customer's biological sample? The answer cannot be presumed from the transaction alone. Property law, consent, contractual terms, research rules, and other applicable legislation may affect the result.

Second, inferred data: If an algorithm predicts a person's disease risk without receiving a formal medical diagnosis, does the resulting inference receive the same legal protection as an existing medical record? The answer depends on the applicable definition of personal or health information and the governing legal framework.

Third, familial privacy: A genetic profile may reveal information about biological relatives who never supplied a sample. This complicates consent, disclosure, and research-use questions.

Fourth, anonymous data: Removing names does not necessarily eliminate re-identification risks, particularly when genetic profiles are combined with other datasets. Anonymisation claims therefore require careful technical and legal evaluation.

Fifth, cross-border transfers: A company may collect samples in India, store digital profiles abroad, and share inferences with international partners. Applicable data-protection, research, contractual, and cross-border rules must be analysed separately.

Sixth, automated decisions: A biological prediction may influence insurance, employment, or access to services without a human decision-maker understanding its limitations. Legal responsibility may involve several entities, including the developer, data supplier, and organisation using the prediction.

These issues demonstrate why a single consent form or privacy notice cannot, by itself, resolve every accountability problem.

12. Conclusion

The Commercial Biosurveillance Accountability Doctrine is best understood as a proposed framework synthesising existing principles of privacy, bodily autonomy, data protection, consumer protection, and corporate responsibility.

Its strongest Indian judicial foundation is Justice K.S. Puttaswamy v. Union of India (2017), supplemented by Selvi v. State of Karnataka (2010), District Registrar v. Canara Bank (2005), and PUCL v. Union of India (1997). Comparative authorities such as S. and Marper v. United Kingdom and Carpenter v. United States help illuminate the risks of retaining and aggregating sensitive information, but do not independently establish Indian legal obligations.

The central proposition is that commercial access to biological information does not automatically confer unrestricted authority to collect, retain, disclose, or monetise it. Accountability must be established through the legal duties applicable to the particular company, the nature of the information, the purpose of processing, and the rights affected.

For academic writing or litigation, the essential distinction is between the proposed doctrine as a conceptual synthesis and the actual legal rules that a court can enforce in a particular case.