Article-21 Right to Privacy

The Right to Privacy, though not explicitly stated in the Constitution, gained prominence with the coming of the internet. Privacy is acknowledged as a fundamental right with the judgement of the Supreme Court in K.S. Puttaswamy Vs Union of India (2017) (“Aadhar Judgement”). With this all persons in India were entitled to a right to privacy. To secure this right, the government passed the Digital Personal Data Protection Act, 2023 to safeguard personal data processed in India, imposing restrictions on storing and handling of data of Indian users.

The Aadhar judgement challenged the provisions of the Aadhar Act where biometric data of people was connected to their Aadhar ID. This Aadhar ID would be the document required to get all direct transfer benefits from the government under various schemes. The biometric data was used so that no duplication can be done of beneficiaries and corruption can be curbed. The Supreme Court in this case ruled that privacy is a fundamental right with the meaning of Article 21. So while the right is not explicitly written in the Constitution, due to recent technological developments, it came to be recognised. The importance of privacy was also recognised in the PUCL vs Union of India, 1997 (telephone tapping case) where the Supreme Court stated that individuals have a right to privacy regarding the content of their telephone communications.

Privacy is a Human right enjoyed by every human being by virtue of their existence. A comprehensive legal definition of “privacy” does not exist currently since its ambit and avenues are still coming to light as technology becomes intertwined with our lives. It emanates from the right to have dignity. It includes the right to be left alone and have solitude.

• Philosophy: It is based on the idea that certain inherent choices about ourselves and our practices are inseparable from the human personality. And we should be able to control this information about us and to choose whom and well we share this. This ‘private information’ however is not exceedingly threatened since technological companies know a lot of our information as we have social media, make purchases online, browse and search content etc.
• Dimensions of Privacy: it includes various aspects like bodily integrity, personal autonomy, control over personal information, safeguarding against government interference and preserving the freedom to dissent, move, or think.
  • Prohibition on Recording Phone Conversations: Chhattisgarh High Court in 2023 held that recording of telephonic conversation without consent violate ‘right to privacy’ under Article 21. Hence, such recordings cannot be submitted as evidence in court.

Article 12 of the Universal Declaration of Human Rights 1948 (“UDHR”) and Article 17 of the International Covenant on Civil and Political Rights, 1966 (“ICCPR”) provide legal protection against "arbitrary interference" with one's privacy, family, home, correspondence, honour, and reputation.

In 2017, a 9 judge bench of the Supreme Court held the following:-

• Issue before the Court: Whether Aadhar, a government scheme in which residents get a unique ID number after giving their biometrics and demographic details, violates the right to privacy?
• Fundamental Rights: Right to privacy is a fundamental right, protecting it as an integral part of the right to life and personal liberty under Article 21 and as part of the freedoms guaranteed by Part III of the Constitution.
• Privacy Defined: Privacy protects individual autonomy and recognizes an individual's ability to control crucial aspects of life.
• Reasonable Restrictions: However, the court clarified that the right to privacy is not absolute and is subject to reasonable restrictions imposed on fundamental freedoms under Part III of the Constitution.
• Test to Check Violation of Privacy: Any law encroaching upon privacy will be scrutinised based on the test of proportionality i.e.
  • whether there exists a law which places restrictions on right to privacy
  • Whether the law is necessary and has a legitimate aim i.e. whether there is a rational connection between the aim and the means taken to achieve them
  • Whether the law is proportional, i.e. it should have the least amount of intrusion on the right to privacy.
• The Supreme Court overruled M.P. Sharma case (1954) and Kharak Singh case (1962), which denied constitutional protection to the right to privacy.
• The court upheld the constitutional validity of the Aadhaar Act on the grounds that it does not violate the fundamental right to privacy. It does not establish pervasive surveillance but ensures data protection and security.
• Impact: The court struck down certain provisions of the Act and recommended changes, leading to the enactment of the Aadhaar and Other Laws (Amendment) Act, 2019.

A committee was setup after the KS Puttaswamy judgment in 2017 to discuss the method to protect the right to informational privacy of Indians, under Justice BN Srikrishna. In its report, the committee submitted a Draft Data Protection Bill and certain recommendations which included:-

• Only necessary data should be collected from individuals online.
• Data should be processed only for uses which are clearly stated and lawful.
• Exceptions in data protection law should be there for government on grounds of ‘prevention of offence’.
• Data Localisation: Data of Indian people should be stored on devices in India only.
• Setting up of a Data Protection Authority.
• Right to be forgotten i.e. every person should have the right to remove all their data from the internet and in doing so “be forgotten”.

• Aims to regulate personal data that is processed, collected, stored while we use digital services.
  • To enhance the ease of living for individuals and ease of doing business for businesses through a uniform data protection law and guidelines.
  • Enable innovation and the digital economy in India.
• Right to Privacy: It stops businesses from misusing this personal data which would violate the right to privacy of an individual.
• Application: It applies to all data that was originally collected in India or elsewhere.
• Data Localisation: The Act also limits the storage of data of Indian users in servers located in India.
• Obligations of Data Fiduciaries: Data Fiduciaries are companies/ government/ entities that collect, store and process data of individuals.
  • To safely store personal data.
  • To inform of data preaches the Data Principal.
  • To erase data is consent is withdrawn
  • To setup a grievance redressal system.
• Rights and Duties of Data Principal: Data Principal are people whose data is being taken and processed.
  • Right to know about the personal data which is being processed.
  • Right to erase of correct the data collected.
  • Right to grievance redressal
  • Right to nominate another person in case of death/ incapacity to exercise your right.
• Penalties: for violation of the Act.
• 7 Principles of the Act:
  • Consensual, lawful and transparent use of data;
  • Purpose limitation on the use of personal data so that it is only used for specific purpose
  • Data minimisation to collect only necessary data for the specified purpose
  • Data accuracy to ensure that data is correct and up to date.
  • Storage limitation so that data is not in storage forever and must be deleted after purpose is over.
  • Reasonable security safeguards must have been taken to protect it.
  • Principle of accountability through grievance redressal mechanism and penalties for violators.

In 2008, key amendments were done to protect data of people:-

• Section 72A made infringement of data privacy a punishable offence.
• Rules were enacted under the IT Act, 2000 to protect sensitive personal data only, like medical & sexual history and biometric information.
• While this was a useful step, it was not enough and the Data Protection Act was needed to provide protection.

• Origin: In 2010, the French legal system introduced “right to oblivion” which provided that criminal details of people who had served their sentence in prison, would not be published in the public sphere.
• Indian Context: In India the right to be forgotten is not provided explicitly in any law. However, introduced by the judiciary in K.S. Puttaswamy Case (2019) under Right to life /Article 21.
• Reasonable Restrictions: Supreme Court had stated that the ‘Right to be forgotten’ was subject to restrictions and cannot be used if the material in question was used for:
  • Exercise of right to freedom of expression and information
  • Fulfilling legal responsibilities
  • Execution of duty, which is in public interest or health
• In a 2021 case the Delhi High Court granted the right to be forgotten to an american-indian who had been accused in an offence and had later been acquitted. However, his name was being shown on search engines like Google. The Court held that this violated individuals' right to privacy under Article 21.
• In 2010 Odisha High Court, while examining the ‘right to be forgotten’ stated that it can be used as a remedy against victims of where their sexually explicit pictures or videos are made available online.

Right to information gives the right to individuals to seek data to hold the government accountable. It expands our access to knowledge. On the other hand, Right to Privacy gives government servants the right to not disclose information about themselves. While both the rights are not explicitly given in the Constitution, they are derived from Article 19 (Right to Freedom of Speech) and 21 (Right to Life). These rights are to be actively balanced by the Supreme Court while giving a judgement for optimal benefit of society and individual.

Right to Privacy gained constitutional recognition in India through the landmark Aadhar judgement (2017), where the Supreme Court said that it is a fundamental right under Article 21. It was recognised that all individuals have the right to be left alone, make decisions about their private choices and also should be protected against exploitation of their personal data. All this was recognised under the Right to Privacy. It also includes the right to be forgotten.

To realise these rights, the Central Government passed the Digital Personal Data Protection Act, 2023 to prevent exploitation of personal data by online businesses. This is in line with the global practice of introducing data protection like the European Union’s ‘General Data Protection Regulation’ (GDPR) which has been in force since April 2016. These protections are significant and efforts need to be made to implement these legislations on ground. Privacy is a crucial issue and an evolving one in the age of the internet. Hence, the government regulation will have to keep pace with the challenges which arise.