Artificial intelligence (AI) systems increasingly mediate decisions affecting individuals and societies. Existing data protection frameworks address certain privacy-related harms, particularly those arising from data leakage, re-identification, and profiling. However, they inadequately capture a more fundamental risk: unreliable or unjustified inference produced by AI systems even when data collection and processing are legitimate. This article argues that modern AI raises distinct concerns of construct validity, confounding, representativeness, distribution shift, and fairness trade-offs that require specialised regulatory attention. In the context of AI, transparency and explainability acquire distinct and significantly more challenging meanings than in conventional software. A substantial body of work in critical data studies and the measurement-theoretic literature has diagnosed these epistemological limitations. This article's contribution is to derive from that diagnosis a structured and operationalizable regulatory framework. We argue that validity of inference should function as a precondition for proportionality assessment and deployment approval --- a move that existing frameworks, including the EU AI Act's domain-based risk tiers, do not make. We ground this argument in the constitutional principle of informational self-determination articulated in the Indian Supreme Court's \emph{Puttaswamy} judgement, extending its reach from data collection to the legitimacy of use of data. Effective governance must therefore incorporate AI-specific validity assessment, post-deployment monitoring, and proportionality assessments grounded in structured articulation of both epistemic risk and potential benefit.

翻译：暂无翻译