CROSS-APPLICATION BEHAVIOURAL TRACKING IN RECRUITMENT: PRIVACY, DATA PROTECTION AND EMPLOYMENT DISCRIMINATION UNDER INDIAN LAW

1. INTRODUCTION

Cross-application behavioural tracking in recruitment refers to the collection, integration and analysis of an individual's digital activities across multiple applications and online platforms to assess suitability for employment. Employers and recruitment agencies may examine social media interactions, browsing behaviour, online purchasing patterns, professional networking activities, mobile application usage and digital communication patterns.

Artificial intelligence and automated recruitment systems can combine these datasets to predict personality characteristics, professional reliability, emotional stability, political preferences and workplace compatibility.

Although employers may legitimately assess candidates' qualifications and professional suitability, extensive behavioural surveillance creates significant legal concerns involving privacy, consent, discrimination, data security and procedural fairness.

Indian law does not establish a blanket prohibition on all cross-application tracking. However, such practices must comply with applicable constitutional principles, data-protection legislation and employment-related legal requirements.

2. LEGAL FRAMEWORK GOVERNING CROSS-APPLICATION TRACKING

A. ARTICLE 21 OF THE CONSTITUTION

Article 21 protects life and personal liberty, including the fundamental right to privacy recognised by the Supreme Court. Recruitment-related surveillance involving personal communications, private activities and behavioural patterns may raise constitutional concerns, particularly where government employers are involved.

B. DIGITAL PERSONAL DATA PROTECTION ACT, 2023

The DPDP Act establishes requirements concerning the processing of digital personal data.

Relevant principles include:

Lawful processing and applicable consent requirements.

Transparency regarding the purposes of data collection.

Compliance with statutory obligations concerning personal-data accuracy.

Security safeguards against unauthorised processing.

Applicable rights of data principals.

Restrictions and conditions governing processing and retention.

The Act's application must be assessed alongside its commencement notifications, implementing rules and statutory exemptions.

C. INFORMATION TECHNOLOGY ACT, 2000

Section 43A historically provided compensation for failure by qualifying body corporates to maintain reasonable security practices concerning sensitive personal data or information. Its continuing applicability must be assessed in light of the DPDP Act's commencement and repeal provisions.

Section 72A addresses disclosure of personal information in breach of a lawful contract, subject to its statutory requirements.

D. ARTICLE 14 AND ARTICLE 16

Public-sector recruitment must comply with constitutional equality and non-discrimination principles. Algorithmic recruitment systems that produce arbitrary or discriminatory outcomes may be challenged under these provisions.

E. EMPLOYMENT AND LABOUR LEGISLATION

Applicable employment legislation, recruitment rules and workplace policies may impose additional requirements concerning fair selection, confidentiality and lawful employment practices.

3. MAJOR LEGAL ISSUES

A. UNAUTHORISED CROSS-APPLICATION DATA COLLECTION

Employers may obtain information from social media platforms, employment portals, financial applications and other digital services. Information made accessible on one platform should not automatically be treated as freely available for every recruitment purpose.

B. CONSENT AND PURPOSE LIMITATION

A candidate's agreement to use a recruitment application does not necessarily constitute unrestricted consent to monitor unrelated digital activities.

Employers should identify the information being collected, explain its intended use and comply with applicable statutory consent requirements.

C. ALGORITHMIC PROFILING

AI systems may infer personality, reliability, emotional vulnerability and behavioural tendencies from digital activity.

Such inferences can be inaccurate and may create unfair recruitment decisions.

D. DISCRIMINATION

Behavioural tracking may indirectly disadvantage candidates based on disability, economic circumstances, gender, religion or other sensitive characteristics.

E. DATA SECURITY AND RETENTION

Combining information from several applications creates extensive candidate profiles. Unauthorised access, excessive retention and disclosure may expose candidates to reputational and privacy harm.

F. AUTOMATED RECRUITMENT DECISIONS

Candidates may be rejected because of algorithmic scores without understanding the factors influencing the decision. Employers should maintain meaningful human oversight and appropriate review mechanisms.

4. IMPORTANT CASE LAWS

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

The Supreme Court recognised privacy as a fundamental right under Article 21. Privacy protection includes informational privacy and control over personal information.

This judgment provides the principal constitutional foundation for challenging excessive behavioural tracking in recruitment.

Authority: Direct constitutional authority on privacy; analogous to private-sector recruitment surveillance.

2. K.S. Puttaswamy v. Union of India (Aadhaar) (2018)

The Supreme Court examined proportionality, privacy safeguards and limitations on the collection and use of personal information.

Its reasoning is relevant when assessing whether extensive candidate profiling is necessary and proportionate to legitimate recruitment objectives.

Authority: Analogous.

3. District Registrar and Collector v. Canara Bank (2005)

The Supreme Court examined informational privacy and protection against unjustified access to private records.

The principles are relevant to employers seeking access to candidates' private digital information without sufficient legal justification.

Authority: Analogous.

4. People's Union for Civil Liberties v. Union of India (1997)

The Supreme Court recognised privacy concerns arising from telephone interception and emphasised procedural safeguards against intrusive surveillance.

Its principles are relevant to excessive monitoring of digital communications during recruitment.

Authority: Analogous.

5. R. Rajagopal v. State of Tamil Nadu (1994)

The Supreme Court recognised privacy protections concerning the publication of private information without lawful justification.

The judgment supports the principle that employers should not unnecessarily expose or circulate candidates' private information.

Authority: Analogous.

6. Maneka Gandhi v. Union of India (1978)

The Supreme Court established that state action affecting personal liberty must satisfy requirements of fairness, non-arbitrariness and reasonableness.

These principles are relevant to arbitrary public-sector recruitment decisions based on intrusive behavioural profiling.

Authority: Analogous.

7. Anuj Garg v. Hotel Association of India (2008)

The Supreme Court examined discriminatory restrictions affecting employment opportunities and emphasised substantive equality rather than reliance on stereotypes.

The decision is relevant where behavioural algorithms indirectly reproduce gender stereotypes or discriminatory assumptions.

Authority: Analogous.

5. EMPLOYER COMPLIANCE OBLIGATIONS

Organisations using cross-application tracking should implement the following safeguards:

Transparent disclosure: Explain the categories of candidate information collected and the recruitment purposes involved.

Lawful processing: Establish an applicable legal basis under the relevant data-protection framework.

Data minimisation: Collect only information reasonably necessary for recruitment.

Consent management: Obtain valid consent wherever required by law.

Algorithmic accountability: Evaluate recruitment models for discriminatory outcomes and inaccurate predictions.

Human review: Avoid relying exclusively on unexplained behavioural scores for consequential hiring decisions.

Security controls: Restrict access to candidate profiles and maintain appropriate security safeguards.

Retention limitations: Establish lawful retention periods and deletion procedures.

Candidate grievance mechanisms: Provide an appropriate channel to challenge inaccurate information and recruitment decisions.

Vendor accountability: Ensure recruitment technology providers comply with applicable contractual and statutory obligations.

6. LEGAL REMEDIES AVAILABLE TO CANDIDATES

Candidates affected by unlawful behavioural tracking may consider:

Requesting information about the collection and use of their personal data under applicable law.

Seeking correction of inaccurate personal information.

Raising complaints through the employer's recruitment grievance mechanism.

Approaching the appropriate data-protection authority where statutory remedies are available.

Challenging discriminatory public-sector recruitment decisions through constitutional remedies.

Seeking appropriate civil or contractual remedies where unlawful disclosure or misuse of personal information causes actionable harm.

7. CONCLUSION

Cross-application behavioural tracking creates significant legal challenges because recruitment decisions increasingly depend on personal information collected outside conventional employment applications. Indian constitutional privacy principles, data-protection legislation and equality requirements provide important safeguards against excessive surveillance and discriminatory profiling. Employers should ensure that candidate monitoring is transparent, proportionate, purpose-specific and legally justified. Recruitment decisions should primarily rely on relevant professional qualifications and verifiable evidence rather than intrusive behavioural predictions. A fair recruitment framework must protect both organisational interests and individual privacy, dignity and equal employment opportunities.