‘The glass ceiling is true as it stands, when it comes to the legal profession’: In Conversation with Arya Tripathy, Partner PSA Legal Counsellors

A prominent legal name in the technology and data privacy space, Ms. Arya Tripathy graduated from Hidayatullah National Law University in 2011. Her advisory focus spans diverse industries including life sciences, defence, IT/ITES, technology, media, automobiles, heavy manufacturing, and the social impact sector. Ms. Tripathy brings extensive expertise in business and commercial law, specializing in cross-border mergers and acquisitions, joint ventures, corporate governance, and regulatory compliance matters. She holds certification as an International Privacy Professional (Asia), with substantial experience in advising global and national clients on data protection and privacy laws across EU, Singapore, Hong Kong, and India. She also actively contributes to her firm’s pro-bono services and collaborates with policy think-tanks, non-profits, and social impact companies on legal matters. Arya is a member of prominent legal associations such as the ITechLaw Association and the Inter-Pacific Bar Association, where she serves as the Chair of the I-Win Committee and Co-Chair of Next Generation Committee, respectively.

1. Could you give the readers a glimpse into your journey as a law student? What was your motivation to study law?

I am what one would call an accidental lawyer; it happened just by chance. I took an offbeat path in terms of what I wanted to do after Class 10th. I decided to study Commerce in 11th and 12th, but I have always had an analytical brain and I have loved debating; in my higher secondary school I was a State-level debater in the State of Odisha. I realized early on that themes such as politics, current affairs, socio-economic factors, etc. interested me a lot and it worked very well with my analytical mind. This combination later helped me crack my law entrance exams without much preparation because the papers back then were based on logical reasoning, legal reasoning and general knowledge. Therefore, in hindsight law was a natural fit even though it was an accident.

Law school is a very breezy experience which lasts for five years. It is only after you are done with it and enter the real world that you realize that it is a different ball game altogether. Law school for me has been a wonderful experience. I was always academically inclined, I mooted a lot, researched and wrote extensively, in fact I was the head of the editorial board of my University (Hidayatullah National Law School). I am inherently a competitive person; I expect the best from myself, and law school gave me a chance to work towards that. I was a straight ‘A’ student and I absolutely loved studying the theory of law. However, while law school gave me several key skills, what it really taught me was the importance of team spirit and building a network. It is a skill that cannot be emphasized enough, we are in a profession where working as a team is important. Law school teaches you to build the necessary skills to be a part of a team, contribute to the team and to win as a team. The network that you create in law school lasts you through your entire career. That aside, law school is like any college where you have a lot of fun and make friends.

2. While researching your work I noticed that you have written heavily on issues from a constitutional perspective. How did that initial interest and perspective aid you when you diversified your area of practice?

My favourite subjects throughout law school have been Constitution, Jurisprudence and Legal Methods. The reason being that these subjects are the closest to the philosophy of this discipline. The Constitution’s basic structure doctrine is considered as the grundnorm which is a sociological and jurisprudential concept. It sets out the regulatory ecosystem for different jurisdictions. The Kesavananda Bharati judgment¹ declared the basic structure of the Constitution as a grundnorm, that cannot be changed without a proper process.

If I have to analyze a particular law or give advice on it, I also have to be able to ascertain if that law is within the remit of the Constitution. While there is prevalent opinion that understanding the Constitution is only of relevance if one is a litigating lawyer, I personally believe that every student of law should be well versed with the Constitution. The Constitution does not just provide the basic framework, but it also lays down the ethical norms for a lawyer to apply the law.

To give you an example of the role that the Constitution plays, look at the recent Ministry of Information and Broadcasting directive that requires advertising agencies to submit a declaration, which was issued in furtherance of the Supreme Court order. Under Article 141 of the Constitution a ruling of the Supreme Court is given effect as a law. The order of the Supreme Court in this particular case states that the requirement for a declaration is laid down in various legislations such as the Drugs and Magic Remedies (Objectionable Advertisements) Act, 1954 and the Rules, the Drugs and Cosmetics Act, 1940, the Consumer Protection Act, 1986, and Food Safety and Standards Act, 2006.² This means that there might be certain advertisements that do not fall under any of these legislations. However, the MIB directive is a blanket directive.

In this case in order to assess the consequence and risk of non-compliance, one has to be able to first ascertain if the law is a good law or not to begin with. If it is a bad law and there is non-compliance there is a possibility of challenging its validity and legality. All of this cannot happen without knowing the Constitution.

Similarly, most of the legislation today provides for the constitution of an executive/regulatory body. To understand the ambit within which such an executive can exercise its quasi-legislative power, one must again know and understand the Constitution.

It is for this reason that I continue to be a student of constitutional law and I thoroughly enjoy writing from a constitutional perspective while analyzing the law.

3. A couple days prior to this interview there were reports by several EU news outlets and international media regarding the tech giant Meta’s use of users’ publicly available personal data to train its AI models. Bringing this a little closer home, is the Digital Personal Data Protection Act, 2023 (DPDPA) well equipped to tackle a situation such as this?

To answer this question, I would like to provide a brief background to the law that you mentioned. The Digital Personal Data Protection Act, 2023 is the first legislation in India that caters to one part of informational privacy called data protection. Informational privacy in today’s digital age represents a fundamental facet of privacy which in 2017 was also recognized as a fundamental right by the Supreme Court.³ In the very same case the Supreme Court also highlighted the need for a law to regulate the processing of data to ensure informational privacy.

The DPDPA is a generic law it does not govern a specific sector. As is the nature of a generic law, it is driven by a varied set of principles that can be applied to any new technology irrespective of whether it is regulated by a sectoral law or not. The DPDPA is thus, sector agnostic in this aspect, which means that a telemedicine software as a service (SAAS) provider, a fintech company, or even a large language model which is using data to train, all will have to comply with DPDPA. I do not think we need any specific new regulation to cater to the situation of use of data to train large language models. This is because the fundamental principles governing the collection data are consent and legitimate use. We are one of the most consent centric data regimes in the world, which is to say that the consent threshold is very high. Unlike jurisdictions such as the EU where certain legitimate purposes or repurposing of data are permissible for collecting data, the same is not provided for in India. Hence, in the Indian context if personal data sets of individuals are to be used to train large language models, a consent form will have to be issued specifying the use/purpose for which data is being collected.

A bigger question that needs to be answered is the need for such personal data for training large language models. Take for example a large language model that has to give conversation ques on gourmet food. For the model to provide answers it need not necessarily reveal the order history of an individual on a food delivery app. The answer can be based on an aggregated set of data. This question is fundamental in order to ascertain whether the collection or processing of data is in compliance with the data minimization and purpose limitation requirements.

To simplify it with reference to this particular case and from a technological perspective two questions need to be answered. One whether the processing of personal data is necessary for training large language models. Two, if the answer to the previous question is a yes, whether consent for the specified purpose of training as required under the DPDPA has been obtained.

4. Some months back the EU issued a set of guidelines for regulation of artificial intelligence (AI). India at present does have any set of formalized guidelines to regulate AI. If there were a few factors that should be considered by policymakers or even one, what would they/it be and why?

To address the elephant in the room, it is my personal belief that niche technology is bound to be ahead of regulation or regulatory ecosystems. In fact, a large language model or an AI tool enabled through machine learning can progress up to 2-4 years in a span of one year. The approach therefore needs to set or lay down certain principles and then apply them to different sets of facts. The effort should be to bring out timeless or immortal principles. This is also reflected in several policy documents, papers, etc. on responsible AI.

If I had to pull out one specific principle for a country like India, it would be to prevent any kind of bias or discrimination. I say this because we are a diverse country, if we were to just take the example of language, we would find that in India we have minorities, we have various dialects and the Constitution itself recognizes 22 languages as the official language of the country. When that is put in the perspective of a country that is digitizing at an exponential rate, it is rather surprising that we do not even have an India specific large language model.

There are inherent issues of bias and discrimination from an input data standpoint that all organizations and sectors are facing either at the development stage or later on. This rings particularly true for the healthcare sector. For instance, say you feed the following prompt in Hindi “main pet se hoon” which in English we understand means “I am pregnant”. However, it is difficult for a large language model to make this translation 100% per cent accurate because there is no comparable for the colloquial language in the large language model. In this case there will also arise a need for a human element to ensure that the large language model gives accurate results, which can further augment the biases.

While I understand that it is not possible to truly eliminate bias and discrimination in this context, there should be steps in place that organizations can take to reduce the instances. For example, the benchmark for accuracy of AI predictions can be set at 95% before the production stage or mandatory use in a sandbox of a certain sample size.

5. In the specific context of children, what we find missing in the DPDPA is the presence of a refined approach to obtaining consent. It vests the power of consent solely with the parent or guardian and treats every child below the age of 18 in the same manner. Do you think there should be a change in the approach?

While the accessibility to the internet has increased and is no longer limited to a particular age group, setting the age-limit at 18 under the DPDPA from a uniformity standpoint makes sense. The Contract Act, 1872, Representation of the People Act, 1951, etc. define a child as any person under the age of 18. Take the example of platforms like the Metaverse, where there have been reports of people (i.e. avatars on the platform) being assaulted or abused. If we were to reduce the age-limit from 18 to 16 and the victim happens to be 17 years old, irrespective of the provisions under the IPC, the platforms will be able to deny responsibility to provide a safe space to its users, as the child agreed to the terms and conditions. There is thus a dichotomy when it comes to application.

This is not to say that a 17-year-old child cannot make a well-informed decision, however, the law has created a space which recognizes and protects a minor against a lapse in judgment.

Since the basis of processing data is consent, and our contractual laws recognize that free consent can be given by a person who is 18 or above, according to me the age of consent under the DPDPA does not need to be diluted, as it ensures alignment across various laws.

Today we see that the terms of use across platforms require that you are 18 and above because under the Contract Act, 1872, you cannot enter into a contract unless you are an adult. Thus, if we look at it from an implementation perspective, this practice or distinction is not new for organizations. All the Act is asking them to do is to have certain other measures in place to protect minors.

6. Under the DPDPA every data breach must be reported to the Data Protection Board and the impacted individuals irrespective of the magnitude. While the intent behind the provision may be to ensure transparency, what are your thoughts on such a blanket obligation?

If we look at data breach obligations in India, to get a complete picture we will have to refer to the directives issued by the Indian Computer Emergency Response Team (CERT-In). CERT-In defines a data breach in its FAQs as a breach that has resulted in the loss or theft of data. The DPDPA has gone ahead of this definition and made it a little more generic. Today a data breach refers to any unauthorized processing with or without intent. For a data breach to occur any of the following need to be compromised, namely, confidentiality, integrity and availability of the data assets. Thus, if I have access to any information on my laptop that is only for my consumption, if I leave the laptop open and a colleague of mine happens to glance through my laptop, the access to such information will amount to a data breach under the DPDPA. From a literal interpretation standpoint of the DPDPA keeping aside the manner in which data breaches are reported today and the factors that organizations consider while reporting to CERT-In, the obligation under the DPDPA is an onerous one.

It is also important to understand that the occurrence of a data breach does not automatically result in a penalty. The breach needs to result in a loss or harm. That being said from a compliance standpoint, the organization will still need to report and thus allocate costs to create a streamlined and timely manner of reporting. The finer details will of course be further clarified in the subsequent rules.

7. On a slightly different note — heading a team currently, in your experience what do you think firms can do differently to ensure that women are better supported to handle leadership roles?

There are sensitivities and peculiar issues that women in particular face and men do not. The glass ceiling is true as it stands when it comes to the legal profession. It might sound a little GenZ, but sorority is a true concept, especially when working with younger and senior lawyers.

If I were to talk about my personal method, I believe I am relatively stricter with my female colleagues than my male colleagues. The reason being I have in the past found myself in situations where I have been mansplained in the middle of a negotiation, meeting, etc. which can lead to one questioning their own capabilities. I want my female colleagues to build up on their strength to face counterparts who might treat them a certain way because they are women. We need strong leadership, where women stand by their juniors and provide them with opportunities to exhibit their capabilities.

It is also important to acknowledge that there is a need to strike a balance between one’s professional and personal life. Often, it is women who have to maintain this balance more than men. Issues such as these will only fall into place when there is strong leadership, when there is a proper segregation of what is expected from one in a professional capacity.

Lastly mentoring is essential. It is different from training or improvising skillsets; it is more holistic. The impact is on the personality. Which is where I started, I want my female juniors to be in a position where they can confidently tell a senior that they know what they are talking about; or hold their ground in the middle of a negotiation when they are being mansplained. That sort of confidence only comes with a little bit of pressure testing, which allows one to withstand the pressures that come with the job.

8. Having spent a while in this profession, how do you keep yourself motivated and protect yourself from burnout?

The legal profession is a very demanding profession. My only advice to anybody joining this profession is to think twice before committing because this job will take 80% of your time on a daily basis.

I believe burnout tends to happen for two reasons. One when the expectations are not set correctly. The expectations of the profession need to be set out in terms of what are the pros of the profession and what are the cons. One needs to consciously realize if they want to do this job.

Two, when you do not make a distinction between your personal space and professional space. Knowing yourself as a person and knowing yourself as a professional are two different things. This will allow you to segregate both parts of your life while also putting certain value systems around them which will in turn allow you to prioritize. Burnout is a direct function of not being able to prioritize things.

Something that is often forgotten when going through a burnout is communication. If you feel like you are going through a burnout phase the right, ethical, honest thing to do is to inform your team that this is happening to you. Take time off, be it a day or a week. That is a more proactive approach versus continuing to work and not giving your 100%.

I am a strong advocate for leaves being granted on mental health grounds. We are dealing with an information overload, there are so many laws that we studied in law school that are no longer effective and it can get difficult to keep up sometimes. While this is an organic process, people need to remember to be kind to themselves and those around them.

As far as I am concerned, I maintain a very strict distinction between my personal and professional life. If I am working for 12 hours straight, I will take a break for a few hours during which I might not even think about work. Furthermore, my expectations for this profession are extremely clear.

9. Lastly, in the age of AI if there is one piece of advice that you could give to young graduates and professionals in order to allow them to add value to their work, what would it be?

I will explain this with a hypothetical situation. If I ask ChatGPT to give me a note on an indemnity clause, it will list out Sections 124 and 125 of the Contract Act, 1872, give me a draft clause and probably a three-line explanation. However, what AI does not answer yet is practical enforcement and that is where the skill add comes. If I send the ChatGPT produced answer to the client, I am adding no value because even the client can use ChatGPT to get the same answer without my assistance. The value add in this case is qualitative.

AI is probably 95% accurate but there is still 5% that is missing and that is where the junior lawyer needs to work. Similarly, if a research proposition that would ideally take an A0 four hours and an additional fours to draft an opinion, AI can produce the research in 30 minutes. What the A0 now needs to do is increase his/her efficiency, reduce the additional four hours to maybe one and work on the missing 5%. I would encourage all my juniors to be familiar with the technology and use it to their advantage in their work.