BEYOND CONSENT: ACCOUNTABILITY, THE ‘GOLDEN HOUR,’ AND THE NEW FRONTIER OF DATA PROTECTION

BEYOND CONSENT: ACCOUNTABILITY, THE ‘GOLDEN HOUR,’ AND THE NEW FRONTIER OF DATA PROTECTION AUTHORED BY - ASWATHI.V.S Guest Faculty at School of Law Pondicherry University, CO-AUTHOR - NIHALA JASMIN K K Practising Advocate ABSTRACT The Digital Personal Data Protection (DPDP) Rules, 2025 and the Information Technology (Intermediary Guidelines) Amendment Rules, 2025 herald a new chapter in India’s digital social contract. This paper examines the growing problem of online theft of money and argues that our existing legal frameworks are becoming increasingly inadequate in response to a new form of invisible crime. This research critically examines the tripartite relationship between the citizen, bank and platform. Particularly, how the loss is not only unjustly borne by the citizen but also by the bank and platform as well. Initially, we critique the notice-and-consent model, which has been a useful shield for the powerful for long. The Puttaswamy court judgment that enshrines privacy as an intrinsic facet of one’s identity and dignity under Article 21 provides the crux of the argument. This dignity is violated when “consent” is manufactured through Dark Patterns or hijacked through vishing powered by AI. Amidst the new standard of real-time deepfake impersonation, the age-old ‘reasonable man’ standard in law is under siege if the human mind can no longer tell the difference between a son’s voice and that of a machine clone ‘consent’ is vitiated initially in law. The research also challenges the “Safe Harbor” safeguards normally enjoyed by social media intermediaries. The 2025 Amendments have, in our view, created a situation whereby platforms are expected to act as “proactive gatekeepers” owing to rules such as Rule 3(3) to label synthetic content in metadata. This paper shows the emerging judicial consensus that in cases of fraud a shift in onus should take place from the victim to the Data Fiduciaries who have the technical capability to prevent such frauds by analyzing the landmark judicial decision in Hare Ram Singh v. RBI (2024). The research develops a "Proportionality-based Liability Framework" by combining the criminal deterrents from the Bharatiya Nyaya Sanhita 2023 with the DPDP Rules which set their regulatory requirements. It also tend to establish that State operations become responsible for damages when emergency systems break down during the essential "Golden Hour period" while platforms should be held Strictly Liable for their failures to maintain algorithmic safety. This study provides a plan for a digital world where individuals are more accountable and information privacy is a reality rather than merely a regulation. Key words: Data Protection, privacy, fraud, safe harbour, Golden hour period. INTRODUCTION The digital economy has experienced rapid development which has caused people to define their identity through digital data and biometric information and artificial markers instead of using their physical existence. The new system provides businesses with exceptional operational efficiency yet it has created a new crime category which law enforcement agencies cannot address because traditional legal methods no longer apply. The paper argues that AI-driven financial fraud has reached epidemic proportions because the digital social contract between different groups failed to execute its monitoring responsibilities . The Indian legal system used Article 21 to protect physical freedom until the Puttaswamy decision brought a new requirement to interpret "Informational Self-Determination" as a fundamental element which supports human dignity . The research evaluates Digital Personal Data Protection Rules 2025 and IT Intermediary Amendment Rules 2026 to demonstrate how the "notice-and-consent" system operates as a tool which companies use to create user consent through Dark Patterns . The central argument posits that in the face of machine-speed deception like AI-vishing, the "Reasonable Man" standard is a legal fiction . The study introduces a liability system which depends on proportionality to determine responsibility for losses. The framework establishes a three-part system which holds Banks accountable as fiduciaries and Platforms accountable as strict-liability gatekeepers and the State accountable as an administrative guarantor who protects victims during the "Golden Hour" period . 1. The Constitutional Bedrock Informational Privacy as a Fundamental Right 1.1. The Evolution of Jurisprudence: From Freedom of Movement to Digital Identity In the past, the Indian courts looked at Article 21 in a narrow, physical way. During the A.K. Gopalan era in the 1950s, "personal liberty" meant little more than not being in physical chains. But as our lives moved into the digital economy, the law had to change what it meant by "body." Our digital selves—our data, our voices, and our footprints—became just as real as our physical selves. The change really started with Maneka Gandhi (1978) , when the Supreme Court said that any state interference with freedom had to be "just, fair, and reasonable." That order is our main protection in the world today. It makes sure that a person's digital trail, which includes things like voice patterns and biometrics, is more than just technical data. These aren't just bits of information; they are important parts of who we are and what we stand for . 1.2. The Post-Puttaswamy Model and the Right to Information Self-Determination The landmark nine-judge bench ruling in Justice K.S. Puttaswamy v. Union of India marked the turning point for a digital right to privacy. The Court went beyond the passive "right to be let alone" and came up with the strong idea of Informational self-determination. This principle says that people have a natural right to decide who can see and use their personal information. The Court ruled that privacy is an inherent aspect of human dignity. This means that when someone's data is used for something like making a deepfake, it is not only a financial loss but also a direct attack on that person's dignity and their right to keep their real public and private identity. 1.3. The Proportionality Test protects the rules. The Puttaswamy judgment did more than just say that people had a right; it also set up a strict three-part test to see if any state-mandated invasion of privacy, like e-KYC or mandatory metadata tracking, was okay. First, the measure must be legal, which means that there must be a clear set of laws that support it, like the Digital Personal Data Protection (DPDP) Act of 2023. Second, it needs to have a good reason, like keeping the country safe or stopping financial fraud. The third requirement is proportionality, which means that the state must use the "least restrictive" means to reach its goal. This framework is needed to look at AI-based fraud-tracking systems and make sure that the search for safety doesn't turn into an unconstitutional state of total surveillance . 1.4 When AI Hijacks Our Brains: The Death of Real Choice In the world we live in now, the most important part of our rights under Article 21 is the simple freedom to make our own choices without someone else pulling the strings. But AI-vishing and deepfakes have completely broken that. We aren’t just talking about a simple scam here; we’re talking about a "fake reality" that's designed to mess with our heads. The law specifically the Indian Contract Act says that "consent" is only real if you give it freely . If you aren't being lied to or tricked, you’re in control . But when you hear a family member’s voice created by a machine begging for money, you aren't actually "choosing" to send that cash. Your brain is being hijacked. You’re reacting to a manufactured nightmare, not making a logical decision. The Delhi High Court finally called this out in the Hare Ram Singh v. RBI case last year. They basically told the banks to stop blaming the victims for being "careless." The Court finally realized that when AI manipulates the way a human being thinks, it’s not just a technical error it’s a direct attack on our dignity and our right to be the masters of our own minds. 2. Statutory Framework, The DPDP Rules 2025 & IT Act Amendments 2.1 Institutionalizing Agency in the Digital Age The Digital Personal Data Protection (DPDP) Rules 2025 official notification marks the conclusion of the period during which digital contracts existed as non-negotiable agreements. Data Fiduciaries must now provide Standalone Notices under Rule 3 which must be shown separately from all other content including general terms and conditions . The notices must be presented as separate items which must be translated into local languages and which must provide detailed information about the data being collected and its intended use . The law establishes a total ban on "Bundled Consent" which forces users to accept complete privacy policies through a single click . Rule 3 mandates that organizations must obtain user consent through specific purposes which makes all consent obtained through "Dark Patterns" and complicated legal language invalid from the start . The Consent Manager framework establishes a protection system which Rule 4 establishes as official protection . The regulated entities function as fiduciaries for citizens by providing an interoperable platform which enables users to manage their consent across multiple services while maintaining control over their personal information. 2.2 From Passive Pipes to Proactive Gatekeepers: IT Amendment Rules 2026 The IT Rules will change in 2026, and platforms will no longer have the broad "Safe Harbor" protections that Section 79 used to give them . The law now puts all AI-generated content, from deepfake videos to vishing audio, under the strict category of Synthetically Generated Information (SGI) . This isn't just a label. It makes intermediaries "gatekeepers" who have to find and tag this content with permanent metadata . If a platform doesn't include a label or a provenance marker, they lose their immunity . This change is huge when it comes to AI-driven financial fraud. If a platform doesn't flag synthetic content that later helps a scam, it goes from being a neutral host to being careless . Not labelling is not only a mistake according to the 2026 rules; it is also a crime of negligence . 2.3. The 3 Hour "Golden Hour" Mandate and the Civil Trail The "3-Hour Takedown Rule" is a big change to the rules for regulating SGI that came with the 2026 Amendments . The legislature has created a technical "Golden Hour" that is necessary for effective victim restitution by shortening the previous 36-hour window to just three hours . This law is important because it makes a legal connection to the Consumer Protection Act of 2019. If a fiduciary doesn't follow this faster timeline, it's now clear proof of a "deficiency in service ." When read with Rule 7 of the DPDP Rules, 2025, which says that people must be told about a breach within 72 hours, it becomes clear who is responsible for the "civil trail. " Because of this synergy, the burden of proof is on the entity that is technically better. This means that platforms are fully responsible for any financial loss that a consumer suffers because they didn't follow the rules . 3. AI-Driven Vishing-The Vitiation of Consent 3.1The Mechanics of AI-Vishing: Fake Identity and Deception Taking over. AI-vishing uses neural networks to create voice clones of a person through their voice pitch and speech patterns which can be extracted from two audio samples . People who want to scam others prefer AI-vishing because it enables them to create deceptive digital avatars who imitate actual people that their targets trust . Regular scams use people and generic scripts. The clones create an experience that tricks brains into believing everything appears normal when they function in real time. This ability makes it possible to create highly convincing attacks which use personal trust as a technical method to deceive people. The fraudster obtains victim information while taking complete control of their relational identity which results in a change of their thought process because detection methods based on common knowledge and digital literacy training become ineffective . 3.2The Doctrine of Vitiated Consent in Section 14 The main legal problem with AI-vishing is whether the victim's permission is valid . Section 13 of the Indian Contract Act of 1872 says that consent needs consensus ad idem, which means that everyone agrees . But Section 14says that consent must be "Free," and if it is gotten through "fraud"or "misrepresentation" it is not valid . In an AI-vishing situation, the victim's permission is based on a basic lie about who the other person is . The AI clone is made to get around decisional autonomy, so the consent it gets is not legally valid, which means that any financial transaction that follows is voidable . 3.3 Shifting the Burden: From Negligence to Institutional Fiduciary Duty The transition from traditional caveat emptor to institutional liability shows a required development which technical knowledge gaps between citizens and sophisticated fraudsters compel . The ability of Generative AI to create synthetic fraud with high accuracy establishes the need for legal systems to differentiate between authentic agreements and fraudulent contract inducements . The RBI Zero Liability Principle defines "unauthorized electronic transfers" as including transactions which use high-fidelity voice cloning technology . As per DPDP Act 2023 establishes a new relationship which identifies banks as "Data Fiduciaries" because they must maintain data protection at their highest responsibility . The Delhi High Court in Hare Ram Singh v. RBI (2024) established this principle by denying defendants the rights to blame victims for "gross negligence" when they fell victim to advanced social engineering tactics. Justice Dharmesh Sharma demonstrated that AI-driven scams function beyond human understanding therefore security responsibilities must shift to institutional systems . Banks need to build synthetic fraud detection systems through their proactive algorithms which protect users' digital rights according to Article 21 . 4. The Tripartite Liability Model 4.1. Financial Intermediaries: The Shift to Enhanced Fiduciary Duty The modern banking system has moved beyond its traditional scope of being a simple custodian of money and has developed into the role of a Significant Data Fiduciary. As per the RBI Master Directions, in conjunction with Section 8 of the DPDP Act, banks are under an elevated duty of care to protect the integrity of the financial ecosystem . The fiduciary duty in this instance arises in view of the failure of the system to identify and freeze "Mule Accounts," which are the lifeline of cyber-laundering. In the current AI-powered vishing attack, the "Reasonable Man" standard of prudent consumer behaviour is fast becoming obsolete; therefore, in the event that the bank's internal security mechanism fails to notify the bank of the unusual patterns of transactions that lie beyond the customer's historical data, the bank shall be held liable . According to the judicial dictum in the case of Hare Ram Singh v. RBI (2024) , the onus of proof will shift, and the bank will be required to prove that it has shown "extraordinary diligence" to prevent the depletion of money, or else it will be held liable for a statutory claim of deficiency in service under the Consumer Protection Act, 2019 . 4.2. Digital Platforms: The Doctrine of Strict Liability and Algorithmic Safety The Information Technology (Intermediary Guidelines) Amendment Rules 2025 have developed into a system that eliminates all "Safe Harbor" protections which digital platforms used to access . The platforms under new Rule 3(3) track their activities as they function between two states which define their role as "proactive gatekeepers" and "passive conduits" . The strict liability should apply because platforms fail to identify SGI and they use deceptive "Dark Patterns" to steal financial assets . All user-interface designs which platforms use to create artificial user consent through their operational functions need to be established as invalid from the beginning because this design approach removes all protective powers which platforms hold under their intermediary status . The law establishes financial liability for organizations which create links between algorithmic safety and complete financial losses because untagged deepfake content and fraudulent advertisements which escape platform moderation lead to "financial siphoning" activities that end with actual damages . The shift in economic risk from innovation now protects users who face vulnerability while shifting accountability to those advanced technical systems which gain economic benefits from the ecosystem. 4.3. The State: Administrative Liability and the "Golden Hour" Mandate The third element of the tripartite model is focused on the constitutional duty of the State to ensure that there is an effective remedy within the "Golden Hour," which is the first 120 minutes following the reporting of the crime when the recovery of the funds is still technically possible . The duty of the State is more administrative in nature and is dependent on the efficiency of the I4C/1930 Helpline (Indian Cyber Crime Coordination Centre) and the emergency response systems . If the citizen is punctual in reporting the crime, but the infrastructure of the State is inefficient because of technical delays, lack of coordination between the agencies, or system downtime, it amounts to a violation of the "Civil Trail" of accountability . In the expanded interpretation of Article 21 , the failure of the State to have an operational emergency digital response system results in the permanent dissipation of the victim’s assets which results in the inability to mitigate "identity theft" or freeze assets, the State will be held administratively liable for compensatory damages to ensure that the digital social contract is underpinned by a guarantee of administrative efficiency . 5. Judicial Trends and the Way Forward 5.1. Administrative Natural Justice The judicial system has increased its involvement in protecting digital security because the legal framework now uses a "Proportionality-based Liability Framework" for assessment. The banking industry during 2025 saw its operations diligently executed through the implementation of audi alteram partem legal right. The 2023 decision State Bank of India v. Rajesh Agarwal establishes a major legal precedent which has influenced high court rulings throughout 2025. The Supreme Court ruled that designating a bank account as "fraud" leads to "serious civil repercussions" which result in "civil death" for the account holder. The Court ruled that banks need to provide a show-cause notice before blacklisting or freezing accounts which requires them to issue a reasoned order. The judicial system needs a "Reasoned Order" because it prevents financial fiduciaries from using their authority without limits. The reasoned order requirement exists as a security measure which proves that the bank used its intellectual capacity to evaluate all information instead of relying on automated systems and vague police warnings. The courts expanded their interpretation of this principle to handle the complete account freezing situation which emerged during the 2025 period. Since it is "unjust and unwarranted display of power" the Delhi High Court ruled in Malabar Gold and Diamond Ltd v. Union of India (2026) that freezing an entire account for a disputed amount is against the law. The current trend in the courts makes it clear that banks are "Significant Data Fiduciaries" whose job it is to stop fraud, but they are also administrative bodies that must follow the principles of natural justice. 5.2The Post-Facto Safeguard The research acknowledges the inherent tension between the "Golden Hour" requirement for immediate action and the deliberate pace of natural justice. Under the emerging "Way Forward" suggested by recent 2025-2026 rulings such as those by the Allahabad and Delhi High Courts posits a hybrid model of Proportionality, which says while a "debit freeze" may be initiated in the immediate wake of a cyber-report to prevent the dissipation of assets, it must be strictly limited to the disputed amount rather than the entire corpus of the account. The emergency provisions of Section 106 of the BNSS will lead to an account freeze which requires both the investigating agency and the bank to notify the jurisdictional magistrate within 24 hours while they must give the account holder a "Reasoned Notice" which started to enforce a strict "post-facto" transparency requirement by the courts. The "Civil Trail" of accountability maintains its strength because the system combines fast results with fair outcomes. The bank becomes a transparent intermediary that must prove its actions according to Articles 19 and 21 of the Constitution which protect citizens' rights to trade and earn a living. 5.3 Beyond "Petty Theft" to Organized Fintech Crime Digital fraud enforcement faces major difficulties because courts have traditionally treated digital fraud as single instances of "cheating" or "petty theft." Section 111 of the Bharatiya Nyaya Sanhita (BNS) which launched in 2023 establishes "Organized Crime" as a criminal category. The statute now formally recognizes cyber-crimes and economic offenses like mass-marketing fraud and financial institution defraud schemes as organized criminal activities. The law recognizes current digital fraud operations as organized criminal networks which use advanced AI technology and international mule-account systems to defeat conventional security measures. Section 111 of BNS establishes that any member of a syndicate who commits "continuing unlawful activity" will face extreme penalties which include life imprisonment and financial penalties that exceed basic restitution requirements. The law now considers digital fraud as organized crime because it operates through complete systems which endanger both state financial security and individual citizen rights. 5.4 The Necessity of a Unified Fintech Crime Code In order for the "Proportionality-based Liability Framework" to be fully functional, India must have a "Unified Fintech Crime Code" since the current legal framework is still too fragmented among the IT Act, BNS, and DPDP Rules. This code would integrate the various definitions of digital fraud, platform negligence, and fiduciary duty into a single, harmonious legal document. The need for such a code is evident during the "Golden Hour" of a cyber-attack, the victim should not have to contend with a complex of jurisdictional overlaps between criminal law (BNS) and civil regulations (DPDP). The Unified Code would establish a seamless process for both the criminal prosecution of the perpetrator and the civil compensation of the aggrieved party. It would require that a "Deficiency in Service" on the part of a bank, as defined in the historic Hare Ram Singh v. RBI (2024) case, automatically initiate a targeted recovery procedure. In this way, we can ensure that the "Civil Trail" of responsibility is as rapid and automated as the fraud itself. Suggestions • The Friction-by-Design requirement forces a 15-minute verification delay for voice command transactions and third-party link transactions to defend against AI-vishing threats which create immediate pressure. • The IT Amendment Rules 2026 should be revised to create strict liability requirements for platforms whose algorithms increase fraudulent activities because these platforms will be treated as partners in criminal activities. • The Digital Indemnity Fund creates a national fund which payment providers will fund to deliver immediate payments that protect the State’s obligation as an administrative guarantor under Article 21. • The Unified Fintech Crime Code should include a "Reverse Onus" provision that requires banks to prove their "AI-resilient" systems after synthetic fraud has been established against them. Conclusion The criminal world now experiences a new phase because advanced AI technology has become part of its operations, which transforms cyber-fraud from its former status as "petty theft" to a new serious danger that endangers the financial stability of the Republic. The research findings in this paper demonstrate that the crisis solution requires a complete system of responsibility which needs to be implemented through unified rules instead of existing disconnected laws. The two court cases of Hare Ram Singh v. RBI (2024) and SBI v. Rajesh Agarwal demonstrate that courts now agree that whenever people lack technological knowledge their technical abilities should determine legal responsibilities. The 2026 IT Amendments introduce "Proactive Gatekeeping" which replaces "Safe Harbor" protections to establish new standards for intermediary liability in digital business operations that generate profits. The way forward lies in the formalization of a Unified Fintech Crime Code and the rigorous enforcement of the 3-Hour "Golden Hour" Mandate. India can establish a "Civil Trail" of accountability that operates with fraud detection speed through the combination of Section 111 criminal deterrents from the BNS 2023 with DPDP Rules administrative requirements. The digital age requires regulatory frameworks which will safeguard digital property rights of citizens as this protection represents an essential constitutional right. The law needs to protect privacy and property as essential human rights if we want to maintain Article 21 protection.