TRAIT-BASED IDENTITY FRAGMENTATION: LEGAL FRAMEWORK, INDIVIDUAL RIGHTS AND JUDICIAL INTERPRETATION

1. INTRODUCTION

Trait-Based Identity Fragmentation refers to the legal and technological problem arising when an individual's identity is divided into separate characteristics, attributes, identifiers, or behavioural profiles across different institutions, databases, digital platforms, biometric systems, healthcare records, and commercial organisations.

An individual's identity may consist of personal information, genetic characteristics, biometric identifiers, gender identity, ethnicity, professional attributes, financial behaviour, medical history, and social characteristics. When these characteristics are independently collected, classified, stored, or interpreted, they can produce incomplete or conflicting representations of the same person.

For example, a person's biometric identity may be associated with one database, medical identity with another, and financial or employment identity with separate platforms. This fragmentation can result in mistaken identification, discrimination, privacy violations, exclusion from services, and disputes concerning personal autonomy.

Trait-Based Identity Fragmentation is not an independently established legal doctrine. Its regulation must therefore be understood through constitutional privacy, data protection, equality, identity rights, consumer protection, and information technology law.

2. LEGAL FRAMEWORK GOVERNING IDENTITY FRAGMENTATION

In India, several legal frameworks address different aspects of identity fragmentation.

A. CONSTITUTIONAL PROTECTION

Article 14 guarantees equality before the law and protection against arbitrary state action.

Article 19 protects applicable freedoms, including expression and association, which may be affected by identity-based profiling.

Article 21 protects life and personal liberty, encompassing privacy, dignity, and individual autonomy.

These constitutional protections become relevant when government agencies or private entities create fragmented identity profiles that produce arbitrary classifications or interfere with individual rights.

B. DIGITAL PERSONAL DATA PROTECTION FRAMEWORK

The Digital Personal Data Protection Act, 2023 establishes obligations concerning digital personal data processing.

Its relevance includes:

Lawful processing of personal data.

Consent and specified legitimate uses.

Accuracy and completeness obligations where applicable.

Security safeguards against personal data breaches.

Rights available to data principals.

Accountability of data fiduciaries.

Fragmented identity databases may create compliance problems where personal information is inaccurate, inconsistently maintained, or processed beyond its permitted purpose.

C. INFORMATION TECHNOLOGY FRAMEWORK

The Information Technology Act, 2000 provides relevant protections concerning unauthorised access, identity-related offences, and misuse of computer resources.

Section 66C addresses identity theft, while Section 66D addresses cheating by personation using computer resources.

D. BIOMETRIC AND GENETIC IDENTITY

Biometric and genetic characteristics require particularly careful treatment because they may reveal highly personal information. Their collection, processing, sharing, and retention can raise constitutional privacy and data protection concerns.

3. IMPORTANT CASE LAWS

1. JUSTICE K.S. PUTTASWAMY (RET'D) V. UNION OF INDIA (2017)

Direct constitutional authority.

The Supreme Court recognised privacy as a fundamental right under Article 21 and other constitutional freedoms. The judgment established informational privacy and individual autonomy as important constitutional interests.

Relevance: Fragmenting an individual's identity across multiple databases without appropriate legal justification may interfere with informational privacy and personal autonomy.

2. NATIONAL LEGAL SERVICES AUTHORITY V. UNION OF INDIA (2014)

Direct analogous authority.

The Supreme Court recognised transgender persons' right to self-identify their gender and protected gender identity under constitutional guarantees.

Relevance: Organisations cannot automatically treat administrative classifications as overriding an individual's legally protected identity and dignity.

3. JUSTICE K.S. PUTTASWAMY V. UNION OF INDIA (AADHAAR CASE) (2018)

Direct analogous authority.

The Supreme Court examined the constitutional validity of Aadhaar and the relationship between biometric identification, privacy, proportionality, and state welfare objectives.

Relevance: It provides important principles for evaluating centralised identity systems, biometric databases, and the proportionality of identity-based data collection.

4. SHREYA SINGHAL V. UNION OF INDIA (2015)

Analogous authority.

The Supreme Court struck down Section 66A of the Information Technology Act because of its unconstitutional restriction on freedom of expression.

Relevance: Digital identity systems and platform classifications must operate within constitutional limitations and cannot arbitrarily restrict protected expression.

5. R. RAJAGOPAL V. STATE OF TAMIL NADU (1994)

Direct constitutional privacy authority.

The Supreme Court recognised the right to privacy concerning personal matters and restricted unauthorised publication of private information, subject to applicable legal qualifications.

Relevance: Separately collected personal characteristics cannot automatically be treated as freely publishable or disclosable information.

6. PEOPLE'S UNION FOR CIVIL LIBERTIES V. UNION OF INDIA (1997)

Analogous constitutional authority.

The Supreme Court recognised constitutional protections against arbitrary telephone interception and emphasised procedural safeguards.

Relevance: Uncontrolled collection and aggregation of personal information can undermine privacy and individual security.

4. PRINCIPAL LEGAL PROBLEMS

Identity fragmentation can produce several legal consequences:

Misidentification: Conflicting records may cause incorrect attribution of identity.

Discrimination: Automated systems may classify individuals through isolated personal characteristics.

Privacy violations: Information may be shared across institutions without an appropriate legal basis.

Identity theft: Fragmented identifiers may facilitate impersonation and fraudulent transactions.

Administrative exclusion: Inconsistent records may prevent access to welfare, banking, healthcare, or employment.

Loss of autonomy: Individuals may lose meaningful control over how their personal characteristics are represented.

5. COMPLIANCE AND REGULATORY REQUIREMENTS

Organisations managing identity-related information should implement:

Accurate identity verification and correction procedures.

Purpose limitation and data minimisation.

Appropriate consent and lawful processing mechanisms.

Access controls and encryption.

Security audits and breach-response procedures.

Clear policies for biometric and genetic information.

Mechanisms for correcting inconsistent personal records.

Human review of consequential automated identity classifications.

Retention and deletion policies consistent with applicable law.

Organisations should also ensure that separate identity attributes are not used to create discriminatory classifications or deny legally protected rights.

6. LEGAL REMEDIES AND LIABILITY

Affected individuals may seek appropriate constitutional remedies under Articles 32 and 226 where fundamental rights are implicated. Depending on the circumstances, statutory remedies may also arise under the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, consumer protection legislation, and other applicable laws.

Civil liability may arise where actionable negligence, breach of confidence, contractual violations, or other recognised legal wrongs are established. Criminal liability may apply in cases involving identity theft, cheating by personation, or unauthorised access.

7. CONCLUSION

Trait-Based Identity Fragmentation represents an important emerging challenge in digital governance, biometric identification, artificial intelligence, healthcare administration, and personal data management. Although Indian law does not recognise it as a separate legal cause of action, existing constitutional and statutory protections provide a framework for addressing its consequences.

The principles established in Puttaswamy, NALSA, the Aadhaar judgment, and other judicial decisions reinforce privacy, dignity, equality, informational autonomy, and protection against arbitrary classification. Effective regulation requires accurate identity management, lawful information sharing, transparent classification systems, and meaningful individual control over personal information.

Ultimately, an individual's identity must not be reduced to disconnected data attributes that undermine legal personality, dignity, equality, or fundamental rights.