1. Introduction

Data-driven biosurveillance accountability doctrine and governance refers to the legal principles, institutional duties, and oversight mechanisms that govern the collection, integration, analysis, sharing, and use of biological and health-related data to detect, monitor, predict, and respond to threats to public health.

Biosurveillance may use:

Epidemiological and infectious-disease reporting.

Laboratory results and genomic sequencing.

Hospital records and electronic health records.

Wastewater surveillance and environmental sampling.

Wearable devices, mobile applications, and location-related information.

Artificial intelligence (AI) models that predict disease outbreaks or identify high-risk populations.

The central legal question is: Who is accountable when biosurveillance data is inaccurate, unlawfully collected, improperly shared, discriminatory, insecure, or used to justify coercive public-health measures?

The doctrine combines privacy and data-protection law, constitutional rights, administrative law, public-health legislation, scientific integrity, cybersecurity obligations, and judicial review.

There is no single, universally codified doctrine bearing this exact name. Instead, its legal foundations emerge from legislation, constitutional principles, regulatory frameworks, and judicial decisions across multiple jurisdictions.

2. Meaning and scope of the doctrine

Data accountability

Identifying who collected the data, who controls it, who can access it, and who is responsible for errors or misuse.

Legality and proportionality

Ensuring that surveillance has a lawful basis, pursues a legitimate public-health objective, and does not impose unnecessarily intrusive restrictions.

Governance and oversight

Establishing access controls, audit trails, independent review, retention limits, and mechanisms for investigating violations.

Individual and community protection

Preventing discriminatory profiling, unjustified disclosure, stigmatization, and disproportionate harm to vulnerable communities.

The doctrine applies throughout the data lifecycle, from initial collection to analysis, publication, sharing with law-enforcement agencies, and eventual deletion or archival.

3. Core principles of biosurveillance accountability

A. Principle of legality

Every biosurveillance programme should have a clearly identifiable legal basis. A government agency should not collect identifiable health, genomic, or location data merely because technology makes the collection possible.

A lawful framework should specify:

The public-health purpose of the surveillance.

The authority responsible for operating it.

The categories of data that may be collected.

The persons or populations whose data may be processed.

The conditions for data sharing and retention.

The mechanisms for review, challenge, and remedy.

Example: A government introduces an infectious-disease monitoring system using laboratory reports and mobile location information. The existence of a disease outbreak does not, by itself, settle whether every category of information may be collected or shared. The agency must identify the applicable legal authority and comply with relevant privacy and public-health safeguards.

B. Necessity and proportionality

Surveillance must be reasonably connected to a legitimate objective, and the intrusion should not exceed what is necessary to achieve it.

A proportionality assessment normally examines:

Whether the objective is legitimate.

Whether the measure is rationally connected to that objective.

Whether a less intrusive effective alternative exists.

Whether the benefits justify the resulting interference with rights.

For instance, aggregated regional infection statistics may be sufficient to identify an outbreak. Collecting identifiable movement histories for every resident may be excessive unless a stronger, evidence-based justification and appropriate legal authority exist.

C. Accuracy and scientific reliability

Data-driven systems may generate false positives, false negatives, misleading risk scores, or inaccurate outbreak predictions.

Accountability requires institutions to examine:

Data provenance and completeness.

Laboratory validation and quality control.

Bias in datasets and predictive models.

Error rates and uncertainty.

Human review of consequential automated decisions.

Correction procedures for inaccurate personal records.

A public authority should not treat an algorithmic risk score as conclusive evidence that an individual is infected or presents a public-health threat.

D. Purpose limitation and data minimisation

Data collected to control an infectious disease should not automatically become available for unrelated criminal investigations, employment screening, immigration enforcement, or commercial profiling.

Where legally permissible, governance rules should require:

Collection of only necessary data.

Separation of identifying information from research datasets.

Role-based access controls.

Defined retention and deletion periods.

Documented authorisation for secondary uses.

Additional safeguards for genetic and other highly sensitive information.

E. Transparency and contestability

Individuals should receive meaningful information about surveillance practices to the extent compatible with legitimate confidentiality and security requirements.

Where a surveillance decision affects a person's rights, an effective governance system should provide a means to challenge inaccurate data, question an unlawful decision, and seek review by an independent authority or court.

4. Leading case laws

The following cases do not all concern public-health biosurveillance directly. They establish legal principles that may be applied to biological databases, genomic surveillance, health-data analytics, and state monitoring, depending on the jurisdiction and the facts.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Supreme Court of India · (2017) 10 SCC 1 · Nine-judge bench

Facts and issue: The Supreme Court considered whether privacy is protected as a fundamental right under the Constitution of India.

Decision: The Court unanimously recognised privacy as a constitutionally protected right associated with life, personal liberty, dignity, and autonomy, principally under Article 21 and the broader framework of Part III.

Legal principles:

State action affecting privacy must be supported by law.

Restrictions must pursue a legitimate state objective.

Proportionality is relevant to assessing the validity of an intrusion.

Informational privacy is an important component of constitutional protection.

The judgment provides a major constitutional foundation for assessing government collection and use of sensitive personal information.

Sci API

Application to biosurveillance: If a government agency creates a central database containing identifiable genomic profiles, infection histories, and movement records, a court may examine the legal authority, legitimate purpose, scope, and proportionality of the collection.

Significance: This is a foundational Indian authority for challenging disproportionate or inadequately authorised biosurveillance. It does not prohibit every form of health-data collection; its principles require a legally defensible framework.

Case 2: S. and Marper v. United Kingdom (2008)

European Court of Human Rights · Applications Nos. 30562/04 and 30566/04 · Grand Chamber

Facts: The applicants challenged the indefinite retention of their fingerprints, cellular samples, and DNA profiles after criminal proceedings against them had ended without conviction.

Decision: The European Court of Human Rights found a violation of Article 8 of the European Convention on Human Rights, which protects private and family life.

The Court emphasised the sensitivity of genetic material and the implications of retaining biological samples and DNA profiles.

HUDOC

Legal principles:

Biological and genetic information can engage the right to privacy.

Retention can constitute an interference even when the information is not publicly disclosed.

Indefinite, broad retention requires careful scrutiny.

Legal systems must consider the status of the individual and the purpose of retention.

Application to biosurveillance: A public-health authority might seek to retain identifiable genomic samples long after an outbreak has ended. S. and Marper supports scrutiny of whether the duration and scope of retention are justified, particularly where less intrusive alternatives exist.

Significance: This is one of the most directly relevant European authorities for governance of DNA databases and long-term biological-data retention. Its precise holding concerns criminal-justice databases, not public-health surveillance generally.

Case 3: Big Brother Watch and Others v. United Kingdom (2021)

European Court of Human Rights · Grand Chamber · Applications Nos. 58170/13, 62322/14 and 24960/15

Facts: The case challenged aspects of the United Kingdom's bulk interception and communications-data acquisition systems.

Decision: The Court found violations of Article 8 in relation to the bulk interception regime and the regime for obtaining communications data from communications service providers. It also found Article 10 violations concerning freedom of expression.

HUDOC+1

Legal principles:

Broad surveillance requires effective safeguards against abuse.

Oversight should extend across the full surveillance lifecycle.

Independent authorisation and supervision are important.

Selection criteria, data access, onward transmission, storage, and deletion require controls.

Intrusiveness and the level of safeguards must be assessed together.

Application to biosurveillance: Consider a national system combining hospital records, laboratory results, genomic databases, and mobile-device data. Even if the initial collection has a legitimate objective, unrestricted searching, onward sharing, or indefinite retention can create separate legal concerns.

Significance: The judgment supports an end-to-end governance approach rather than treating initial authorisation as sufficient for every subsequent use. It concerns communications surveillance; its application to biosurveillance is analogical.

Case 4: Carpenter v. United States (2018)

Supreme Court of the United States · 585 U.S. 296 (2018)

Facts: Law enforcement obtained historical cell-site location records covering approximately 127 days without a warrant supported by probable cause.

Decision: The US Supreme Court held that government acquisition of the historical cell-site records at issue constituted a search under the Fourth Amendment and generally required a warrant supported by probable cause, subject to applicable exceptions.

Supreme Court+1

Legal principles:

Technological advances can create privacy concerns that older legal rules do not adequately address.

The fact that data is held by a third party does not automatically eliminate constitutional protection.

Comprehensive records of a person's movements can reveal highly sensitive patterns of life.

Application to biosurveillance: A disease-monitoring platform might combine location information with infection status to infer visits to clinics, religious sites, workplaces, or private residences. Carpenter illustrates why the aggregation and precision of digital records matter when assessing surveillance powers.

Significance: It is a leading US authority on privacy in historical location records. It does not establish that every request for health or location data requires a warrant, nor does it decide the legality of public-health surveillance systems.

Case 5: K.S. Puttaswamy (Retd.) v. Union of India — Aadhaar judgment (2018)

Supreme Court of India · (2019) 1 SCC 1 · Judgment delivered 26 September 2018

Facts: The Court considered constitutional challenges to the Aadhaar identification system, including questions concerning privacy, authentication, data collection, and the use of identity information by public and private entities.

Decision: The Court upheld the Aadhaar framework in substantial part while striking down or limiting particular provisions and uses. The majority's conclusions differed across issues, so the judgment should not be read as an unrestricted endorsement of all forms of centralised data collection.

Relevance to biosurveillance:

Large-scale databases raise questions about the scope of collection and permissible uses.

Linking multiple databases can increase the risk of profiling.

Legal authorisation does not eliminate the need to examine specific uses and safeguards.

Constitutional review must consider the particular measure and its practical effects.

Significance: The Aadhaar judgment is relevant to debates about centralised health identifiers, linked genomic records, and digital public-health infrastructure. Its principles must be applied in light of the specific constitutional issue and statutory framework involved. The underlying privacy principles originate in the 2017 Puttaswamy decision.

Sci API

5. Indian statutory framework

India's biosurveillance governance framework is not contained in a single statute. Depending on the programme, it may involve constitutional rights, public-health legislation, data-protection requirements, information-security rules, and specialised biomedical or research regulations.

A. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 provides a statutory framework for processing digital personal data. Its official text recognises both individuals' interest in protecting personal data and the need to process data for lawful purposes.

India Code+1

For biosurveillance, the relevant questions include:

Whether the information qualifies as digital personal data under the Act.

Which entity determines the purposes and means of processing.

Whether a valid legal basis applies.

What duties, exemptions, and safeguards apply to the particular processing.

Whether applicable commencement notifications bring the relevant provisions into force.

Important qualification: The Act provides for commencement through government notification, including different dates for different provisions. Its applicability must therefore be assessed against the relevant commencement notifications and the facts of the surveillance programme rather than assuming every provision is already operative.

B. Constitutional protection under Article 21

Article 21 protects life and personal liberty. Read with the privacy jurisprudence in Puttaswamy, it provides an important basis for examining disproportionate state surveillance.

A challenge may concern, for example, the collection of identifiable health data without sufficient legal authority, excessive retention, or a surveillance measure that imposes unjustified restrictions on personal liberty.

C. Epidemic Diseases Act, 1897 and Disaster Management Act, 2005

These statutes may provide relevant powers in particular public-health emergencies and disaster-management circumstances.

However, their applicability depends on the statutory provisions invoked, the responsible authority, the circumstances, and any applicable rules or directions. They should not be treated as blanket authorisation for every form of digital, genomic, or population-wide surveillance.

D. Biomedical research and genomic data

Research involving human participants, biological samples, or genomic information may also engage ethical review requirements, informed-consent rules, institutional policies, and specialised regulatory standards.

A distinction is essential between:

Surveillance conducted under a public-health mandate.

Research involving human participants.

Clinical diagnosis and patient care.

Criminal investigation using biological evidence.

The legal basis and safeguards can differ substantially between these activities.

6. Governance duties and accountability mechanisms

A defensible biosurveillance programme should translate legal principles into operational controls.

These are recommended governance practices. Whether a particular measure is legally mandatory depends on the applicable legislation, regulations, and judicial decisions.

Who may be accountable?

1. Public-health authority

May be accountable for unlawful collection, excessive retention, unjustified disclosure, or decisions made beyond its legal powers.

2. Laboratory or research institution

May face contractual, regulatory, professional, or other liability for negligent handling, inaccurate reporting, or breaches of applicable research and confidentiality obligations.

3. Technology provider

May be responsible for failures within its contractual or statutory duties, such as inadequate security, defective systems, or improper processing.

4. Data-sharing recipient

May incur responsibility for using information outside authorised purposes or disclosing it without a valid legal basis.

5. Oversight body or decision-maker

May face judicial scrutiny where a review process is ineffective, a decision is arbitrary, or statutory duties are not properly discharged.

Responsibility is not automatically shared equally among these actors. It depends on their respective powers, duties, conduct, causation, and the remedies available under the governing law.

Current position of the DPDP framework as of November 2026

An important update to the statutory discussion above is that India notified the Digital Personal Data Protection Rules, 2025, and a phased commencement notification for the Act in November 2025. Therefore, it is no longer accurate to describe the entire framework as awaiting commencement. However, many substantive provisions are scheduled to commence 18 months after the notification, in May 2027.

E-Gazette+1

For biosurveillance governance, this means that legal analysis must distinguish between provisions already in force and provisions whose commencement is still pending. The applicable rules, exemptions, and other existing laws must also be examined.

7. Hypothetical case study: unlawful genomic biosurveillance

Suppose a state government creates a platform that combines hospital records, DNA profiles, laboratory results, and mobile-phone location information to predict infectious-disease outbreaks.

The platform mistakenly identifies a group of residents as likely carriers of a dangerous pathogen. Authorities share the results with employers and law-enforcement agencies, restrict the residents' movements, and retain their genomic records indefinitely.

The principal legal issues would include:

Potential remedies

Depending on the jurisdiction and facts, affected individuals might seek:

Judicial review of the government's decision.

A declaration that a particular surveillance practice is unlawful.

An injunction or other order restricting improper processing.

Correction or deletion of data where legally available.

Compensation or other statutory remedies where the applicable law permits them.

Independent investigation, audit, or regulatory enforcement.

These remedies are not automatic. A claimant would need to establish the applicable legal basis, relevant facts, standing, and the conditions for the requested relief.

8. Practical accountability model

A sound governance programme can be organised into six stages:

01

Authorise

Document legal authority, public-health objectives, and permitted uses.

02

Minimise

Collect only necessary information and justify any use of identifiable data.

03

Validate

Test scientific accuracy, model performance, and potential discriminatory effects.

04

Control

Enforce access restrictions, secure sharing, audit logs, and retention limits.

05

Review

Conduct independent oversight, periodic proportionality assessments, and human review.

06

Remedy

Provide complaint procedures, correction mechanisms, and lawful remedies for affected people.

9. Conclusion

The doctrine of data-driven biosurveillance accountability requires that public-health surveillance be lawful, scientifically reliable, proportionate, secure, and subject to meaningful oversight.

The principal judicial foundations include Justice K.S. Puttaswamy v. Union of India (2017), S. and Marper v. United Kingdom (2008), Big Brother Watch v. United Kingdom (2021), and Carpenter v. United States (2018). Together, these decisions illustrate the importance of privacy, justified retention, safeguards against surveillance abuse, and protection against intrusive aggregation of personal data.

In India, constitutional privacy principles, public-health legislation, and the phased implementation of the DPDP Act and Rules must be considered together. No single case or statute establishes a universal rule governing every form of biosurveillance.

The central proposition is that public-health necessity does not eliminate accountability. The more extensive, identifiable, predictive, and consequential a biosurveillance system becomes, the more important it is to establish clear legal authority, robust safeguards, independent oversight, and effective remedies.

For further legal research, a useful next step would be a focused analysis of Data-Driven Biosurveillance Accountability under Indian constitutional law, with additional Supreme Court and High Court decisions and relevant statutory provisions.