Five years after the SC upheld the right to privacy, why does India lack a data protection law?

A long-running legal battle over Section 377 of the Indian Penal Code was entering its final chapter in 2018. The colonial-era section, which criminalised “carnal inter­course against the order of nature”, had long terrorised those in same-sex relationships in India. It had been struck down as unconstitutional by the Delhi High Court in 2009, only to be restored by the Supreme Court four years later.

In 2016, several members of the queer community filed fresh petitions challenging the Supreme Court’s decision. By the time a five-judge bench sat down to hear final arguments in July 2018, the scales were tilted in their favour since a transformational event had taken place in the meantime.

In a verdict delivered on August 24, 2017, in the case of Justice KS Puttaswamy vs Union of India, the Supreme Court had unanimously declared the right to privacy a fundamental right of all Indians. It was only the 15th time in the court’s history that nine judges had come together to resolve a “generational question” that significantly impacted Indians.

Citing the Puttaswamy judgement, the Supreme Court went on to decriminalise same-sex relationships. “After the nine-judge bench decision in Puttaswamy, the challenge to…Section 377 IPC has been stronger than ever,” two of the judges wrote in their opinion. “Sexual orientation is also a facet of a person’s privacy and that the right to privacy is a fundamental right under the Constitution of India.”

This was one of the breakthroughs made possible by the Puttaswamy judgement. Yet, five years later, many of the hopes raised by the judgement stand belied. Significantly, the data protection regime that the nine-judge bench asked the government to create is nowhere in sight. This has provoked some to argue that the Puttaswamy judgement, in fact, shows the limits of the Supreme Court’s powers.

“Puttaswamy is a fantastic judgement,” Agnidipto Tarafder, a legal academic and privacy law expert, said. “But it lays bare that no matter how powerful the Supreme Court considers itself to be, it is really toothless unless the executive decides to back the court’s decision.”

The judgement

The Puttaswamy judgement emerged from a petition filed in 2012 by Justice KS Puttaswamy, a retired judge of the Karnataka High Court, challenging the mandatory imposition of Aadhaar, the unique 12-digit identification number assigned to Indians on the basis of their biometric data.

Puttaswamy argued that collecting data without adequate safeguards violated a person’s fundamental right to privacy. In response, the Centre contended that there was no fundamental right to privacy under the Constitution.

This argument led to the formation of a nine-judge bench, which held that privacy was a fundamental right of Indians that included, among other aspects, “personal intimacies, the sanctity of family life, marriage, procreation, the home and sexual orientation”.

“The court held that privacy permeated the entire fundamental rights chapter,” said Tarafder. “This paved the way for a number of litigations that were connected to privacy.”

In the United States, privacy had become the basis of granting the right to use contraception or to undergo an abortion. In India, apart from decriminalising homosexuality, the Puttaswamy judgement paved the way for verdicts that decriminalised adultery and increased the marital rape exemption age from 15 years to 18 years.

“Hopefully, in due course, the judgement’s impact will extend to legalising gay marriage and criminalising marital rape,” Tarafder said. “Numerous other fundamental rights litigation will be impacted by the Puttaswamy verdict.” Several contemporary issues, such as wearing the hijab and eating meat, all involve a privacy angle.

No checks on data collection and use

While the Puttaswamy case has positively impacted several judgements, experts say it failed on a crucial front: data protection.

“The judgement did not just recognise the right to privacy,” said Prasanna S, one of the advocates involved in the Puttaswamy litigation. “It was also a prescription for limitations on government powers.”

The judgement said that for any infringement of the right of privacy, a few conditions must be satisfied. One, there must be a law justifying the violation. Two, the state’s action must be for a legitimate purpose and three, the action must be proportionate, that is, it must be necessary and least intrusive.

However, Prasanna pointed out that none of this has transpired. For instance the government is still collecting data indiscriminately and even monetising it, Aadhaar is practically mandatory for several services and there is no data protection law yet, he said.

In the judgement, the court had stressed on the need for a data protection law and asked the Centre to take steps towards this. However, despite multiple rounds of deliberations over the past five years, which included three different versions of the bill based on varying inputs, on August 3 the government abruptly withdrew a data protection bill it had introduced in Parliament in 2019.

The lack of a law means that there are no checks and balances in how the government and private companies are collecting and using a person’s data. This becomes a concern at a time when there has been an increase in data breaches in India.

Meanwhile, surveillance has also increased. There are reports of various law enforcement agencies using facial recognition technology for identifying criminals, which experts say violates the Puttaswamy judgement. In August 2021, it was reported that Pegasus, a military grade spyware that was only sold to “vetted governments”, was allegedly used to snoop on journalists, politicians and activists in India and around the world.

On one hand, while the government is not passing a data protection law, it is expanding the information it is collecting about citizens. “Take something like the Criminal Procedure (Identification) Act, 2022,” said Usha Ramanathan, a privacy law expert, “where the government has sweeping powers in collecting a wide range of bodily information of not just convicts, but of any arrested person and even ‘any person’ as the magistrate deems fit.”

This law, “rides over privacy concerns in an extraordinary way, like such a right does not even exist”, she added.

Further, there are other ongoing concerns, such as the seizure of devices, Ramanathan said. “You keep your [entire] life on devices like mobile phones, laptops etc.,” she said. “And when an agency decides to investigate an individual, they seize these devices, laying bare the lives of the people before them.”

The law to protect such seizures is presently inadequate. This, she said, was illegal and “a blanket rejection of the idea of privacy”.

Court’s powers?

As landmark a ruling the right to privacy has been, its implementation has been ineffectual, indicating the limitations of the power of the Supreme Court.

Apart from the government not following its directions, experts say that the Supreme Court itself did not enforce its orders. “During the hearing, the Supreme Court kept passing orders saying stop implementation of Aadhaar till the case is decided,” Tarafder said. “But the Centre continued to push for Aadhaar.” While finally deciding on the constitutionality of Aadhaar in 2018, Tarafder said the Supreme Court glossed over this fact and in some ways congratulated the Centre for expansive coverage under Aadhaar.

Additionally, Prasanna pointed out that there were six contempt petitions filed before the Supreme Court saying that court’s directions were not being followed. “All of them were closed even without notices being issued,” he said.

Even in the Pegasus snooping case, the Supreme Court has not taken any concrete action, despite the case being pending for more than a year now.

“There is a cynical disrespect and disregard of the law that the state is repeatedly showing,” Ramanathan said. “It is for the court to be able to see it and decide how they are going to deal with it.”

A larger picture

Despite the flaws in the implementation of the judgement, one notable development that came from the judgement was introducing privacy in a common person’s lexicon.

“After denying the right to privacy, the tech world is now impelled to pay obeisance to privacy,” Ramanathan said, even when, very often, they carry on to violate this right. “Further, the government’s argument that there is no right to privacy acted as a wake up call to citizens, who became more vocal about asserting this right, and we began to hear a clamour all round asserting their [right to] privacy.”

Now, people are more wary of giving their data. “There is some kind of awakening. Some scepticism in how people look at data collection,” Prasanna said. “That is what caused a company like Apple to make an ad emphasising on privacy.”

But understanding the dangers of privacy being violated comes less intuitively when compared to other rights such as the freedom of speech. “When your speech is being infringed by a government order, you go and fight the order,” Prasanna said. “But with privacy, because you do not see the harms [of its infringement], you accede.”

In the face of these challenges, Ramanathan, who has been closely involved in the fight for privacy, believes that all rights, including the right to privacy, have to be perennially asserted for them to survive.

“Rights, as we know, are always fought for,” she said. “They are never given.”