Secondary Commercial Use of Anonymized Health Data: Legality

Introduction

Secondary commercial use of anonymized health data refers to the use of health information for a purpose different from the original purpose of collection, where the data is subsequently used by commercial entities. Examples include pharmaceutical companies using anonymized hospital records to develop medicines, biotechnology firms training predictive models, and research organizations analyzing population-level data to improve diagnostic tools.

The principal legal questions are whether the data is genuinely anonymized, whether the original collection and later use were lawful, whether consent or another legal basis is required, and whether commercial use violates privacy, confidentiality, or research-ethics obligations.

Anonymization reduces privacy risks by removing identifiers, but it does not automatically make every secondary use lawful. Data may remain identifiable through linkage with other datasets, and commercial use may exceed the permission given at the time of collection.

Legal Framework in India

1. Anonymization and data protection

The Digital Personal Data Protection Act, 2023 defines personal data in relation to an identifiable individual. Data that has been irreversibly and effectively anonymized so that an individual cannot reasonably be identified may fall outside the Act’s personal-data scope. However, merely removing names or replacing them with codes is not necessarily anonymization: if the data can be linked back to a person, it may remain personal data. The Act’s provisions are subject to a phased commencement schedule, so their operative status must be checked for the relevant date.

India Code+2

2. ICMR ethics guidance

The ICMR National Ethical Guidelines address secondary use of stored health data and biospecimens. They distinguish anonymous or irreversibly de-identified information from coded or reversibly anonymized material. Ethics committee review may be required to determine whether consent can be waived, whether the new use is consistent with the original consent, and whether adequate safeguards exist.

cidp-cro.com+1

3. Commercial research and consent

The ICMR guidance on ethical use of leftover, irreversibly de-identified clinical samples specifically addresses future product development and commercial purposes. It requires that the material be genuinely non-identifiable, that institutions retain appropriate custodial responsibilities, and that companies communicate transparently with hospitals or institutions. It also encourages attention to affordability and broader access to resulting technologies.

ICMR

Case Laws

There is no settled Indian Supreme Court judgment specifically determining the legality of commercial use of irreversibly anonymized health datasets. The following authorities provide the relevant legal principles.

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1

The Supreme Court recognized privacy, including informational privacy, as a fundamental right. It also distinguished anonymity from privacy and acknowledged that anonymized hospital data may legitimately be analyzed for public-health purposes if individuals’ identities are protected. This supports responsible use of de-identified health data while requiring safeguards against unauthorized identification or disclosure.

Indian Kanoon+1

2. Samira Kohli v. Dr. Prabha Manchanda (2008) 2 SCC 1

The Supreme Court held that medical consent must be informed and related to the procedure proposed. Although the case concerned medical treatment rather than commercial data use, it supports the principle that authorization for one purpose should not automatically be treated as authorization for a materially different purpose. Where data remains identifiable, a new commercial use may require consent or another lawful basis.

Indian Kanoon

3. Moore v. Regents of the University of California, 51 Cal. 3d 120 (1990)

The California Supreme Court considered commercial development using a patient’s biological materials without full disclosure of researchers’ financial interests. The majority rejected the patient’s conversion claim over removed cells but allowed informed-consent and disclosure-related claims to proceed. Although not binding in India and involving tissue rather than anonymized datasets, the case is relevant to disclosure of commercial interests and the distinction between material ownership and a person’s right to informed disclosure.

Indian Journal of Medical Ethics

Legal Limits and Conclusion

Secondary commercial use is more defensible where data is genuinely and irreversibly anonymized, the original collection was lawful, the use is ethically reviewed where required, and reasonable safeguards prevent re-identification. Additional scrutiny is appropriate for genomic data, rare diseases, small datasets, and combinations of records that could reveal identity.

Anonymization does not excuse unlawful collection, breach of confidentiality, misuse of contractual restrictions, or violation of research-ethics obligations. Where data is only coded or pseudonymized, the original consent and applicable data-protection requirements remain important. Commercial use should also address conflicts of interest and any commitments concerning benefit-sharing.

In conclusion, Indian law does not impose a blanket prohibition on secondary commercial use of anonymized health data. The legality depends on genuine anonymization, lawful collection, research ethics, privacy safeguards, and the nature of the commercial purpose. Puttaswamy supplies the central constitutional privacy principle, while ICMR guidance provides the more direct ethical framework for secondary health-data use.