Right to Privacy

Context: The article highlights that despite judgment on the Right to Privacy, the government has continued to commission and execute mass surveillance programs. So, there is a need for Right based data protection law to regulate data surveillance through judicial oversight.     

In this context, let us understand the basics of the Right to Privacy Judgment, Justice Srikrishna Committee Report on “A Free and Fair Digital Economy & Protecting Privacy, Empowering Indians” and government’s surveillance programs.

Right to Privacy Judgment

Supreme Court in Justice K.S. Puttaswamy (Retd) vs Union Of India has ruled Right to Privacy as an integral part of Right to Life and Personal Liberty as guaranteed under Article 21 of the Indian Constitution. The Court held that these rights are recognized by the Constitution as inhering in each individual as an intrinsic and inseparable part of the human element which dwells within. However, the right to privacy is not absolute and the state can make a law to restrict the right to privacy. A law on the invasion of life or personal liberty must meet the three-fold requirement of 

1. Legality, which postulates the existence of law i.e.  state action must have a legislative mandate
2. Need, defined in terms of a legitimate state aim i.e. there must be a legitimate state purpose
3. Proportionality ensures a rational nexus between the objects and the means adopted to achieve them.       

This judgment forced the government to change its view on the privacy of citizens. This was further helped by Judgment in Aadhaar as it prohibited the authentication of Aadhaar details by private organizations including corporates. (eg Airtel, Vodafone, Reliance, etc.) 

Justice Srikrishna Committee Report 

• Ministry of Electronics & Information Technology (MeITY) in July 2017 constituted a ten-member committee of experts headed by former Supreme Court Judge, Justice B.N. Srikrishna to study various issues related to data protection in India and also to draft a Data Protection Law. 
• It submitted a report titled A Free and Fair Digital Economy Protecting Privacy, Empowering Indians. 
• The report has cited Puttaswamy Judgment and highlighted that the sphere of privacy includes a right to protect one‘s identity. This right recognizes the fact that all information about a person is fundamentally their own, and they are free to communicate or retain it for themselves. 
• This core of informational privacy, thus, is a right to autonomy and self-determination in respect to one‘s personal data and must be the primary value that any data protection framework serves.
• The data protection law has embodied the principle that the state must be a model data controller and prescribed a higher standard of observance for the state.  
• It has also created the Data Protection Authority (DPA) which will be an independent regulatory body responsible for the enforcement and effective implementation of the law. Broadly, the DPA shall perform the following primary functions: (i) monitoring and enforcement; (ii) legal affairs, policy and standard-setting; (iii) research and awareness; (iv) inquiry, grievance handling and adjudication. 

Mass surveillance steps were taken by the government (Steps taken in disregard to privacy & Draft law by the Committee) 

• Despite the judgment on the right to privacy, Aadhaar and a draft data protection law drafted by the Committee, the government continued to commission and execute mass surveillance programs on grounds of national security and with little regard to follow the three-fold requirement of legality, need and proportionality. 
• The Ministry of Home Affairs, in December 2018 authorized 10 Central agencies to “intercept, monitor and decrypt any information generated, transmitted, received or stored in any computer in India”.  This notification has been challenged in the Supreme Court.
• Ministry of Information Broadcasting had floated a tender for ‘Social Media Monitoring Hub’, a technical solution to snoop on all social media communications, including e-mail. The government had to withdraw the project following a petition in Supreme Court. 
• A request for a proposal for a similar social media surveillance program was floated in August 2018 by the Unique Identification Authority of India (UIDAI), which is presently under challenge before the Supreme Court. 
• The Income-Tax department has its ‘Project Insight’ which also has similar mass surveillance ends.    
• Storage of Data for Public Good and not on a rights-based approach
• The government sees the storage of individual data for the public good and does not take into account a rights-based approach. 
• This gives the government the right to use, monetize and exploit data in any manner it desires so long as it guards against security incidents such as breaches and unauthorized access. 
• This approach of the government is evident from this year’s Economic Survey as it appreciates the government’s efforts to sell and monetize the vehicle owners’ data in the Vahan Database and has asked to replicate the success with other databases.     

Need for Right based Data Protection Law

The Justice Srikrishna committee which has published the draft Personal Data Protection Bill uses a similar language of ‘free and fair digital economy’, with the digital economy being the ends and the notion of privacy merely shaping the means to achieve the ends. 

The author highlights that this idea misinterprets the committee report as only to seek economic ends by using stored data. Thus, there is a need for rights-based data protection law which – 

• includes comprehensive surveillance reform prohibiting mass surveillance
• provides for judicial oversight mechanism for targeted surveillance
• recognizes the principle that the state ought to be a model data controller as it deals with its citizens’ personal information