Authored By: Nainika Shivaram
Abstract
Justice K.S. Puttaswamy v Union of India, in which justice Puttaswamy declared the right to privacy to be a fundamental right, has never encountered such challenges ever before in the digital age. The conflict between personal privacy and national security has been heightened with the advance of technology, as well as surveillance apparatuses of the state and the data-driven governance. The paper is a critical analysis of the legal framework that regulates privacy in India, including the Personal Data Protection Bill, 2019 (withdrawn) and the Digital Personal Data Protection Act, 2023 (DPDP Act) and the laws that regulate surveillance, including the Information Technology Act, 2000 and the Telegraph Act, 1885. It looks at court interpretation, international norms and consequences of unregulated state surveillance. The article proposes a more powerful and rights-based system of privacy to allow a stronger and fair approach to the balancing of individual freedom and state interest.
- Introduction
Digital era has changed the notion of privacy which was previously limited to the physical dimensions into a complicated game of data, technology and state power. In Justice K.S. Puttaswamy v Union of India (2017) 10 SCC 1, the right to privacy was held to be inherent in the right to life and liberty in Article 21 of the Constitution in India. But with the fast digitization, and comprehensive surveillance systems such as the Central Monitoring System (CMS) and the Aadhaar ecosystem, it becomes increasingly important to ask how far this right is being implemented. This paper examines the legal and ethical issues of individual privacy versus state surveillance in India, evaluates the major legislative and judicial trends, and suggests measures that need to be implemented to make the situation consistent with the international standards.
- The Indian Constitutional Right to Privacy.
The Puttaswamy case was a sea change in the Indian constitution since privacy was declared a right of the constitution. The Supreme Court determined that the concept of privacy embraces informational autonomy, body integrity, and dignity of the person based on the provisions of Articles 14, 19, and 21 of the Constitution.Based on the international guidelines such as the European Convention on Human Rights, the Court stated proportionality and necessity as prerequisites of state actions, which infringe privacy.
An actual implementation of this right, however, is controversial. The Puttaswamy ruling required a legal framework to govern data collection and surveillance but newer legislations have been criticized for their insistence on state dominance against individual rights. There was a gap in laws that regulated privacy and this resulted in widespread surveillance by the state due to a lack of a complete privacy law until the DPDP Act, 2023.
- Laws: Privacy and Surveillance.
3.1. Digital Personal Data Protection Act of 2023.
The DPDP Act, 2023 is the first comprehensive law in India that controls the data protection industry, replacing the annulled Personal Data Protection Bill, 2019. The Act is the attempt to govern the processing of personal data and provide persons with rights including data portability and erasure as well as obliges the data fiduciary to adhere to the rules.
General Exemptions to State Agencies: Section 17 of the DPDP Act offers an exception to state agencies where they are not expected to comply in situations that touch on national security, state peace, or preventing crimes. This is a dangerous provision which can lead to uncontrolled surveillance because it does not provide clear guidelines of proportionality or control.
Lack of Weak Oversight Mechanisms: There are no independent oversight mechanisms because the members of the Central Government are the ones who appoint members of the Data Protection Board, which was created by the Act.
Weak Personal Redress: The Act lacks solid measures to ensure that individuals can question the misuse of data by the state, which goes against the Puttaswomy requirement.
3.2. Surveillance Laws: History of Uncertainties.
The surveillance system India has is pre-digital and is based on the old laws such as the Indian Telegraph Act, 1885 and the Information Technology Act, 2000 (IT Act). The Telegraph Act section 5(2) also authorises interception of communications in case of a public emergency, or to protect the safety of the people, but does not have any provisions regarding procedure. Likewise, Section 69 of the IT Act permits surveillance on such grounds as national security and the preservation of the order, yet its wording is rather loose, which can be interpreted in different ways.The Aadhaar Act, 2016 in its turn complicated the situation. Although Aadhaar was aimed at welfare delivery, the Supreme Court invalidated the ability to access the services of the private sector, referring to privacy concerns (Aadhaar, 2018).
3.3. Central Monitoring System and Other Surveillance Mechanisms.
The Central Monitoring System (CMS), which has been in operation since 2013, allows mass surveillance without a judicial check.
- Judicial Review and the Proportionality Test.
The Puttaswamy case had a four-pronged proportionality test on actions of the state violating privacy: (1) legitimate aim, (2) rational nexus, (3) necessity, and (4) proportionality stricto sensu. The Supreme Court has given a guideline on telephone tapping in the case of the People union Civil Liberties v Union of India (1997) 1 SCC 301 but this is obsolete in the light of digital surveillance.
In recent cases, e.g. Internet Freedom Foundation v Union of India (before the Supreme Court), scrutiny is hampered by the constitutionality of surveillance laws and the abuse of Aadhaar. In K.S. Puttaswamy II, the Court confirmed the surveillance potential of Aadhaar by placing the interests of the state before the individual ones and weakening the individual rights.
- Foreign Lessons: The Indian Lessons.
Privacy laws such as the General Data Protection Regulation (GDPR) in the European Union offer solid provisions across the world. The GDPR includes more components that the DPDP Act of India does not: informed consent, minimization of data, and independent oversight.
The European Court of Human Rights has continuously imposed tough questioning on surveillance. The European Court of Human Rights in Big Brother Watch v United Kingdom (2018) has stated that bulk surveillance contravenes Article 8 of the ECHR unless it is supplemented with safeguards such as judicial authorization.
- Difficulty in Finding a Balance between Privacy and Interests of the State.
6.1. National Security vs. Personality Rights.
National security is a valid state interest, although its application can not be transparent. The exemptions of state agencies and the secrets of the programs such as CMS in the DPDP Act erode the accountability. These provisions are subject to abuse without a clear definition of what national security is and what is meant by the term public order.
6.2. Technological Challenges
Surveillance is increased by the emergence of artificial intelligence, the growth of big data, and facial recognition technologies. As an example, in India facial recognition in public places such as during protests is a concern of chilling the freedom of speech and assembly.
6.3. Public Awareness and Enforcement.
The lack of information on the rights to privacy, as well as the possibility of obtaining legal protection, makes the situation worse. The DPDP Act also lacks accountability since the government-controlled board has the ability to enforce their provisions unlike the GDPR that empowers individuals to do so by seeking remedies.
- Recommendations for Reform
Suggested reforms to make the privacy structure of India congruent with the constitutional requirements and international standards include:
Enforce the DPDP Act: Revise the Act to restrict state exemptions, give a narrow definition of national security, and create a standalone Data Protection Authority subject to judicial review.
Reform the Surveillance Laws: Repeal outdated clauses of the Telegraph Act and the IT Act with a new law on surveillance that includes proportionality, necessity and openness.
Revoke the Origins of New Technologies: Issue AI and facial recognition regulations, making sure they do not violate the foundations of privacy.
Increase Judicial Scrutiny: Have special courts/tribunals to examine surveillance orders to ascertain that they comply with the Puttaswamy proportionality test.
Raise Awareness of the People: Initiate campaigns to sensitize citizens on their privacy rights and remedies present.
- Conclusion
The right to privacy is guaranteed in the Constitution of India but the so-called digital age threatens this right because of the extensive surveillance and lack of legal regulation. Although the DPDP Act, 2023 is a positive move, its shortcomings, especially the exemptions of states and their ineffective supervision, invalidate its effectiveness. At the risk of learning the international frames and enhancing the domestic laws, India can set individual privacy against the state interests. The judiciary, legislature and civil society should also work together to make it possible that the promise of Puttaswamy comes true and that all citizens of the digital era are guaranteed of their dignity and autonomy.
- References:
(OSCOLA Citation Style) Below is the list of references formatted in OSCOLA (Oxford Standard for Citation of Legal Authorities) citation format, ensuring accuracy and consistency for easy copying:
- Justice KS Puttaswamy (Retd) v Union of India (2017) 10 SCC 1.
- Convention for the Protection of Human Rights and Fundamental Freedoms (European Convention on Human Rights, as amended) art 8.
- Digital Personal Data Protection Act 2023 (India), s 4.
- Ibid, s 17.
- Ibid, s 19.
- Indian Telegraph Act 1885 (India), s 5(2).
- Information Technology Act 2000 (India), s 69.
- Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act 2016 (India).
- Justice KS Puttaswamy (Retd) v Union of India (2018) 1 SCC 809.
- Ministry of Communications, Government of India, ‘Central Monitoring System’ (Press Release, 2013).
- Vrinda Bhandari, ‘India’s Surveillance State’ (2021) 35(2) Economic & Political Weekly 45.
- Puttaswamy (n 1) [325].
- People’s Union for Civil Liberties v Union of India (1997) 1 SCC 301.
- Internet Freedom Foundation v Union of India WP (C) No 44/2019 (Supreme Court of India).
- Puttaswamy (n 9) [200].
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L 119/1.
- Personal Information Protection and Electronic Documents Act, SC 2000, c 5 (Canada).
- Big Brother Watch and Others v United Kingdom App Nos 58170/13, 62322/14 and 24960/15 (ECtHR, 25 May 2021).
- Anushka Jain, ‘Facial Recognition Technology in India: Privacy Concerns’ (2022) 57(3) Journal of the Indian Law Institute 123.
- Digital Personal Data Protection Act 2023 (India), s 18.
