1. Introduction

Commercial exploitation of public health datasets fairness is a legal, ethical, and governance concept concerned with whether governments, hospitals, research institutions, pharmaceutical companies, insurance businesses, and technology firms can commercially use health information collected from the public—and whether the resulting benefits, risks, and profits are distributed fairly.

Public health datasets may include:

Hospital admission and discharge records.

Disease surveillance and epidemic statistics.

Vaccination and immunisation records.

Genomic and genetic information.

Electronic health records and diagnostic reports.

Clinical trial results and pharmaceutical research data.

Health insurance claims and population-level health statistics.

These datasets can help develop medicines, improve diagnostic systems, predict epidemics, and design more effective public health policies. Commercial use can finance innovation, but it can also create serious inequalities when companies profit from publicly funded or community-contributed information without adequate privacy safeguards, transparency, accountability, or public benefit.

Research on digital healthcare in India highlights this tension: health information may have public-good characteristics and commercial value, while anonymisation alone may not adequately prevent re-identification.

PubMed Central (PMC)+1

The central legal question is: When health information is collected for public welfare, under what conditions may private entities use it to generate commercial profits without unfairly burdening the individuals and communities who made that information possible?

This is an emerging legal framework rather than one universally recognised legal doctrine. Its principles must be derived from constitutional privacy, equality, data protection, research ethics, consumer protection, competition law, and public health governance.

2. Meaning and scope of fairness

A. Privacy fairness

Individuals should not lose control over sensitive health information merely because a hospital or government agency collected it. Commercial access must respect applicable legal requirements, confidentiality, purpose limitations, and appropriate safeguards.

B. Distributive fairness

The economic and medical benefits generated from datasets should not accrue exclusively to companies while contributing communities receive no meaningful improvements in healthcare access or outcomes.

C. Equality and non-discrimination

Dataset design and commercial algorithms should not systematically disadvantage poorer populations, particular regions, women, people with disabilities, or underrepresented demographic groups.

D. Procedural fairness

The purpose of data sharing, the identity of recipients, the commercial arrangements, and the available complaint and redress mechanisms should be transparent and subject to suitable oversight.

E. Economic fairness

Commercial agreements should address the contribution of public funds, healthcare institutions, researchers, and communities. Depending on the circumstances, fair arrangements may include affordable products, reinvestment in public health, licensing conditions, or benefit-sharing.

These dimensions are related but distinct. A dataset can be anonymised and lawfully licensed while still being used to create an unfairly priced medicine or an insurance algorithm that disadvantages the people represented in it.

3. Legal framework in India

A. Constitutional right to privacy — Article 21

Article 21 of the Constitution protects life and personal liberty. The Supreme Court has recognised privacy, including informational privacy, as a fundamental right.

The constitutional analysis is particularly important when health data originate from government hospitals, public health programmes, or other public institutions.

Commercial use does not automatically become unlawful simply because it generates profit. However, public authorities cannot assume that information collected for one legitimate purpose can be used for any unrelated commercial objective.

Relevant questions include:

Is there a lawful basis for the processing?

Is the commercial purpose legitimate?

Is the use proportionate to that purpose?

Are adequate safeguards in place?

Is the information sufficiently protected against identification or misuse?

The Supreme Court's privacy jurisprudence expressly recognises the public interest in analysing anonymised hospital records to address epidemics, while distinguishing such uses from unauthorised disclosure of identifiable medical information.

Indian Kanoon+1

B. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act) is an important part of India's developing framework for digital personal data.

Its relevance includes:

Processing of digital information relating to identifiable individuals.

Duties imposed on data fiduciaries that determine the purposes and means of processing.

Consent and other legally specified grounds for processing.

Security safeguards and breach-related obligations.

Specific provisions concerning research, statistical, and archival processing.

Important distinction: The DPDP Act does not establish a general right to share in every profit generated from health data. Nor does it automatically prohibit every commercial use. The legality of a particular arrangement depends on the applicable provisions, the processing purpose, the facts, and the commencement status of the relevant requirements.

As of 2 November 2026, the Act has a phased commencement framework. Its substantive provisions should not be treated as though all were already operational. The relevant commencement notifications and rules must be checked for the specific transaction.

CMS Law+2

C. Information Technology Act and health-information safeguards

The Information Technology Act, 2000 and the rules historically governing sensitive personal data, including medical information, have been important in India's digital health privacy framework.

Because the DPDP Act has a phased transition, the applicability of existing provisions and rules must be assessed against the relevant commencement notifications and transitional arrangements.

Healthcare providers should not assume that removing names from a medical dataset eliminates every confidentiality or legal obligation.

D. Research ethics and clinical-trial governance

Commercial health research may also be subject to applicable clinical-trial regulations, institutional ethics review, research-consent requirements, and biomedical research guidelines.

For example, a pharmaceutical company using clinical-trial information must distinguish between:

Permitted secondary analysis of trial data.

Commercial reuse beyond the scope of the original arrangements.

Disclosure of participant-level records.

Publication of results necessary for scientific accountability.

These activities may raise different legal and ethical questions.

E. Equality and non-discrimination

Article 14 guarantees equality before the law and equal protection of the laws. Article 15 prohibits specified forms of discrimination, while Article 21 protects life and personal liberty.

These constitutional protections can become relevant when government decisions, public-private partnerships, or algorithmic systems built from health datasets create arbitrary or discriminatory outcomes.

For example, if a publicly developed disease-risk model systematically excludes a disadvantaged community from access to a public healthcare programme, the issue is not merely data privacy. It may also concern the fairness and legality of the resulting decision.

4. Important case laws and their legal principles

The following cases provide a foundation for analysing commercial health-data fairness. Not every case directly concerns the sale of public health datasets; some establish broader principles applicable by analogy.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1

Leading Indian authority

Court: Supreme Court of India
Decision: 24 August 2017

Facts and issue: The case concerned whether privacy is a fundamental right under the Constitution, arising in the context of the Aadhaar identification programme.

Judgment: The nine-judge Bench unanimously recognised privacy as a constitutionally protected fundamental right under Article 21 and the freedoms guaranteed by Part III.

Application to commercial health datasets:

Medical information attracts strong privacy protection.

A public authority must have a lawful basis for interfering with privacy.

Collection and processing must serve a legitimate purpose and satisfy proportionality.

Anonymised data may be used for legitimate public health purposes, subject to adequate safeguards.

Public possession of information does not create unlimited permission for unrelated commercial exploitation.

Legal significance: This judgment supplies the central constitutional framework for evaluating whether commercial reuse of public health data is lawful, necessary, and proportionate.

Indian Kanoon+1

Case 2: K.S. Puttaswamy v. Union of India (Aadhaar judgment) (2019) 1 SCC 1

Court: Supreme Court of India
Decision: 26 September 2018

Facts and issue: The Court examined the constitutional validity of the Aadhaar framework and related questions involving the collection, use, and protection of personal information.

Principle: State collection and use of personal data must be examined against the legal basis, purpose, privacy implications, and safeguards involved. The Court also discussed the legitimate use of appropriately anonymised health information to address public health concerns.

Application to commercial exploitation:

Suppose a state hospital collects records to monitor tuberculosis and later proposes to share them with a pharmaceutical company for market analysis.

The relevant questions include whether the proposed use is authorised, whether the data can identify patients, whether the original purpose and applicable legal framework permit the reuse, and whether less intrusive alternatives exist.

A commercial purpose does not automatically invalidate the arrangement, but it cannot by itself justify unrestricted access to sensitive information.

Indian Kanoon+1

Case 3: Neera Mathur v. Life Insurance Corporation of India (1992) 1 SCC 286

Court: Supreme Court of India

Legal issue: The case involved intrusive questions about intimate personal and reproductive information in an insurance-related employment context.

Principle and relevance: It is frequently discussed in connection with the protection of personal dignity and the impropriety of demanding excessively intrusive medical information.

For public health datasets, its broader relevance is that sensitive health information should not be collected, demanded, or used without a legitimate justification. However, it is not a direct ruling on commercial dataset licensing or profit-sharing.

Case 4: Mr. X v. Hospital Z (1998) 8 SCC 296

Court: Supreme Court of India

Issue: The case concerned disclosure of a patient's HIV status in circumstances involving the health interests of another person.

Principle: Medical confidentiality is important but not absolute. Disclosure may be justified in particular circumstances involving competing rights and a sufficiently weighty public interest.

Application: Commercial dataset providers cannot assume that confidentiality must always override every public health interest—or that public health concerns justify every disclosure. The purpose, necessity, recipients, and consequences of disclosure matter.

This case is especially relevant when determining whether sensitive health information can be shared beyond the immediate care relationship.

Case 5: Selvi v. State of Karnataka (2010) 7 SCC 263

Court: Supreme Court of India

Issue: The case concerned involuntary narco-analysis and other investigative techniques that implicated personal liberty and mental privacy.

Principle: The Court placed constitutional limits on involuntary techniques that intrude upon individual autonomy and protected interests.

Application: Although this was not a dataset-commercialisation case, it reinforces the broader proposition that scientific or technological usefulness does not automatically override individual rights.

It may inform debates about compulsory biological sampling, genomic databases, and health surveillance when the methods used to collect information themselves raise constitutional concerns.

Case 6: Cegedim Santé — French data protection authority decision

Authority: French data protection supervisory authority
Decision: 5 September 2024
Sanction: €800,000 administrative fine

Facts: The company processed health data that were not genuinely anonymous, without the required authorisation, and supplied them to customers for health-sector studies and statistical purposes.

Principle: Describing information as anonymous does not make the processing lawful if the data remain identifiable or the relevant legal requirements have not been met.

Application to India: This is a comparative regulatory example rather than binding Indian precedent. It illustrates why commercial health-data agreements should require robust anonymisation or other appropriate safeguards, lawful processing, and verification of the recipient's intended uses.

European Data Protection Board

Case 7: Lindenapotheke, Case C-21/23

Court: Court of Justice of the European Union
Decision: 4 October 2024

Issue: The case concerned health-related information entered when customers ordered pharmacy-only medicines online, and the relationship between data protection requirements and unfair commercial practices.

Principle: Information can qualify as health data when it reveals a person's health status through reasonable inference or the combination of information, even if it does not look like a conventional medical record.

The judgment also addressed when competitors may bring civil proceedings in connection with alleged data-protection violations and unfair commercial practices.

Application: A commercial health-data system must consider what can be inferred from the data, not merely whether explicit diagnoses or patient names are present. The case is relevant comparatively to datasets used for targeted advertising, medicine marketing, risk profiling, and predictive health analytics.

EUR-Lex+1

5. Major legal problems arising from commercial exploitation

A. Unfair appropriation of publicly funded research

Public hospitals and government-funded research programmes often generate datasets through public expenditure, clinical work, and patient participation. A private company may subsequently use those datasets to develop a valuable diagnostic tool or medicine.

The fairness problem arises when the company retains all commercial benefits while the public institution and the communities that contributed the data receive no meaningful return.

For example, a government-funded research institute creates a dataset covering diabetes among millions of patients. A private company licenses access, develops a predictive diagnostic product, and sells it at a price that many of the contributing patients cannot afford.

The arrangement raises questions about public procurement, licensing terms, contractual obligations, research ethics, and equitable access.

Legal position: Indian law does not generally require every company that profits from publicly funded health data to share its profits with the public. Benefit-sharing obligations ordinarily need a basis in applicable law, contract, funding conditions, licensing terms, or another enforceable arrangement.

B. Discrimination through health-data analytics

Commercial entities may use datasets to predict disease risk, insurance costs, treatment requirements, or likely healthcare expenditure.

If a dataset disproportionately represents affluent urban populations, the resulting model may perform poorly for rural populations or groups with different disease patterns.

Potential harms include:

Unfair insurance pricing or eligibility decisions.

Inaccurate disease predictions for underrepresented groups.

Exclusion from clinical trials or healthcare programmes.

Targeted marketing of expensive or ineffective products.

Reinforcement of existing social and economic inequalities.

Article 14 may be relevant to arbitrary or discriminatory state action, including certain public-sector decisions informed by commercial algorithms. Private-sector liability depends on the applicable statutory, contractual, and constitutional framework; Article 14 should not be treated as a universal direct cause of action against every private company.

C. Re-identification of supposedly anonymous data

Removing a patient's name is not necessarily enough to make a dataset anonymous.

Consider a dataset containing age, village, rare disease, treatment date, and hospital. Combining it with publicly available information might reveal the patient's identity.

The legal risk becomes particularly serious when a recipient uses the information to identify individuals, market products to them, or create personal profiles.

Appropriate controls may include:

Data minimisation and removal of unnecessary identifiers.

Assessment of re-identification risk.

Restricted-access research environments.

Limits on combining datasets.

Contractual prohibitions on re-identification.

Independent security audits and access monitoring.

The Puttaswamy jurisprudence and comparative enforcement in the Cegedim Santé matter both illustrate why public health value and the label “anonymous” cannot replace a proper legal and technical assessment.

Indian Kanoon+1

D. Unfair pricing of products developed from public datasets

Commercial fairness also concerns the accessibility of products developed using health information.

A pharmaceutical company might use a publicly funded genomic dataset to identify a treatment target and subsequently commercialise a drug.

The company may have legitimate rights in its inventions, subject to applicable intellectual property law. Nevertheless, the public contribution may justify contractual or funding conditions concerning affordability, licensing, supply, or access.

The key distinction is between a legally enforceable obligation to provide affordable access and a broader ethical argument that publicly supported innovation should benefit the public. The latter does not automatically establish the former.

E. Unequal bargaining power and consent

Patients may provide information because they need medical treatment, not because they wish to support unrelated commercial activities.

A patient may have little practical ability to negotiate a hospital's data-sharing arrangements. Broad consent forms may also fail to explain future commercial uses adequately.

Fair governance should therefore consider whether the individual was properly informed, whether consent was legally required and validly obtained, whether another lawful basis applies, and whether the commercial use remains within the permitted scope.

Consent should not be treated as a universal cure for every unfair arrangement.

6. A proposed fairness test for commercial health-data use

The following is a practical analytical framework derived from constitutional principles, data protection requirements, and research ethics. It is not a separate statutory test established by an Indian court.

Six-stage fairness assessment

Stage 1 — Lawful authority

Identify the law, consent, contract, public-health authority, or other applicable basis permitting collection, transfer, and commercial processing.

Stage 2 — Purpose and necessity

Determine whether the proposed commercial purpose is legitimate and whether the amount and sensitivity of the data are justified by that purpose.

Stage 3 — Privacy and security

Assess identifiability, re-identification risks, access controls, retention periods, onward transfers, and breach response.

Stage 4 — Equality and impact

Evaluate whether the dataset or resulting product creates foreseeable disadvantages for underrepresented or vulnerable groups.

Stage 5 — Distribution of benefits

Review public funding conditions, licence fees, access to resulting treatments, community benefit commitments, and the allocation of commercial returns.

Stage 6 — Accountability and redress

Establish independent oversight, audit rights, complaint mechanisms, corrective action, and appropriate remedies for unlawful processing or discriminatory outcomes.

A commercial arrangement that satisfies the first three stages may still fail the fairness assessment because its economic or social consequences are inequitable.

7. Fairness in different commercial settings

8. Accountability of the parties involved

Fairness is not solely the responsibility of the company purchasing a dataset.

Government and public health authorities

Must act within their lawful powers, protect information entrusted to them, and establish appropriate safeguards for public-private data arrangements.

Hospitals and research institutions

Should assess the proposed secondary use, follow applicable confidentiality and research requirements, and ensure that data-sharing contracts clearly allocate responsibilities.

Commercial data recipients

Must comply with the legal obligations applicable to their role, maintain appropriate security, and avoid processing beyond the authorised scope.

Technology and AI developers

Should evaluate dataset quality, bias, re-identification risks, and the foreseeable consequences of deploying models in real healthcare settings.

Independent oversight bodies

Can review compliance, investigate complaints within their jurisdiction, and require corrective action or impose legally authorised sanctions.

Contractual allocation of responsibility does not necessarily eliminate a party's independent statutory duties.

9. Remedies and legal consequences

Depending on the facts and applicable law, unfair or unlawful commercial exploitation may give rise to:

Constitutional remedies: A person affected by unlawful state action may seek appropriate constitutional relief, including under Articles 32 or 226 where their requirements are met.

Data protection remedies: Applicable statutory complaints, enforcement proceedings, corrective directions, and penalties may be available when the relevant provisions are in force and apply to the conduct.

Contractual remedies: A hospital, research institution, or other contracting party may pursue remedies for breach of data-sharing, confidentiality, licensing, or benefit-sharing agreements.

Confidentiality and privacy claims: Unauthorised disclosure or misuse may support remedies under applicable law.

Consumer and competition remedies: These may be relevant where the facts satisfy the requirements for unfair commercial practices, misleading conduct, or competition-law violations.

Research-governance consequences: Ethics committees, funders, regulators, or institutions may impose measures within their authority when research requirements are breached.

Compensation, injunctions, penalties, or termination of a licence are not automatic. Their availability depends on the applicable legal cause of action and the evidence.

10. International standards and comparative approaches

International data protection law provides useful models for strengthening fairness in commercial health-data use.

European Union — GDPR: Health information is a special category of personal data subject to additional conditions under Article 9, alongside the general requirements governing lawful processing, transparency, purpose limitation, and security.

OECD privacy principles: These provide a useful policy framework for collection limitation, purpose specification, security safeguards, openness, individual participation, and accountability.

Research ethics: Informed participation, independent ethical review, confidentiality, and responsible secondary use help protect people whose information contributes to medical research.

These standards are not automatically binding in India in every case. Their legal applicability depends on jurisdiction, territorial scope, contractual commitments, and relevant domestic law.

ECHR+1

11. Hypothetical case study

Consider a government hospital network that collects records from 500,000 patients. A technology company receives a copy of the dataset and develops a commercial AI system that predicts cardiovascular disease.

The company earns substantial revenue by licensing the system to private hospitals. However, the model performs poorly for rural patients, and the licence does not require any public-sector access.

The legal and ethical analysis should consider three separate questions.

First, was the data transfer lawful? The hospital and company must establish the applicable legal basis, permitted purposes, and required safeguards. Anonymisation alone does not resolve every issue.

Second, is the system fair? Its accuracy should be evaluated across relevant populations, and its use should not result in unjustified exclusion or disadvantage.

Third, are the commercial terms equitable? If public funding or a licence agreement requires affordable access or public-sector availability, the company may be legally obliged to comply. Without such a requirement, a failure to share profits does not by itself establish a legal violation.

A fairer arrangement could include audited privacy controls, subgroup performance testing, reasonable public-sector licensing terms, independent oversight, and a defined process for complaints and corrective action.

12. Conclusion

Commercial exploitation of public health datasets presents a difficult balance between innovation, privacy, equality, and public welfare.

The Indian constitutional foundation is supplied principally by Justice K.S. Puttaswamy v. Union of India, which recognises privacy as a fundamental right and requires lawful, justified, and proportionate interference. Other cases concerning medical confidentiality, personal autonomy, and sensitive information provide additional guidance. Comparative decisions, including the Cegedim Santé enforcement matter and Lindenapotheke, illustrate the importance of lawful processing, meaningful anonymisation, and accountability.

The most important conclusions are:

Public health data can support legitimate commercial innovation, but public availability does not mean unrestricted commercial permission.

Privacy protection and fairness in the distribution of commercial benefits are separate questions.

Anonymisation, valid legal authority, appropriate security, and accountability are central safeguards.

Equitable access and benefit-sharing should be addressed through suitable legislation, funding conditions, contracts, and licensing policies.

The existence of a commercial profit does not automatically establish illegality; the particular use, legal obligations, and resulting harms must be examined.

For further legal research, the most useful next step is to develop a case-law matrix separating binding Indian judgments, comparative foreign decisions, applicable legislation, and proposed fairness principles. This makes the analysis suitable for a law dissertation, research paper, or policy memorandum.