One year ago, nine judges of the Supreme Court of India delivered their judgments in the matter of Justice KS Puttaswamy and Anr v Union of India and Ors. The case decisively moved the discussion forward on privacy as a value in the Indian polity. The nine judges were unanimous that privacy is a constitutionally protected right in India, and even cast it as a pre-requisite for the exercise of many other fundamental rights. At various points in the judgments, privacy was described as a primordial, basic, inherent, inalienable and natural right. Puttaswamy therefore raised hopes and quelled fears for many who worried that citizens’ rights to have control over their own bodies, decisions and preferences were being questioned. By staking the ground on the right to privacy for all Indians irrespective of income or status, the court placed the guarantee of individuals’ autonomy and liberty at the centre of the Constitutional scheme for the Indian State. It seemed that in August 2017, the Supreme Court had definitively defeated arguments that “Indians don’t care about having privacy” or that “poor people don’t need privacy”.
On Friday, the first anniversary of that pivotal Constitutional decision, India is still awaiting clarity on what it means in practice. What is the legal framework that will protect Indian citizens when they pick up the phone to speak to loved ones, pay for items electronically, apply for a job or take out state-supported health insurance? What is the action that authorities will take if a database is breached and details of citizens’ phone numbers, caste and religion, bank accounts, addresses and credit scores are handled without their knowledge or permission? The proof of the Puttaswamy pudding will lie in how robustly our privacy and personal information is protected in our day-to-day lives.
Aadhaar judgment
Two impending flashpoints will have a decisive impact on this scenario: the final decision of the Supreme Court on the legality of the Aadhaar project, and the passing of an Indian law on the protection of personal data. Indeed, one of the reasons for the Puttaswamy decision itself was the Aadhaar project – as it was referred to the constitutional bench on a narrow question (of whether privacy was a fundamental right), from the original eponymous case challenging the constitutionality of the Aadhaar project filed in 2012 by a retired Karnataka High Court judge. Six years after that original petition, over 30 other petitions challenging various aspects of Aadhaar have been tagged together, and final arguments from all parties have been completed before the Supreme Court. The final judgment is still awaited.
The absence of clarity on the legal position of Aadhaar at a time when its use to access government services (and in some cases private services) is increasingly mandated has created uncertainty for millions of people including government departments themselves. Rules and requirements can be uneven and changeable. To take one example, in January 2017, the Employee Provident Fund Organisation, which provides retirement pensions, mandated linking of Aadhaar to accounts into which pensions are received. For this, it set a deadline of June 30, 2017, which was then extended to September 2017. But in April, the Employee Provident Fund Organisation requested banks not to deny pensioners their funds for lack of Aadhaar linking. And in May, the Minister of State for Personnel made a statement that Aadhaar is not mandatory for getting a pension. Meanwhile, news of a major data theft from the Employee Provident Fund Organisation through the portal that links Aadhaar numbers with Employee Provident Fund account numbers have come to light recently, raising serious concerns about the large scale compromise of personal information. The incident shows how the question of informational privacy is intermingled with all service delivery itself in the modern day, albeit with harms that do not seem immediate but can weaken the system as a whole. It also highlights the ambiguity around the public’s rights and effective recourse in the context of one of the most ambitious public digital identity projects of our time. In the absence of clarity from the Supreme Court – confusion seems to prevail.
Such incidents also reveal the stark downside of not having clear obligations for data hygiene and security, user data rights, breach notification requirements (to inform people of how to protect themselves upon a breach) or a grievance process. There is essentially no clear and immediate consequence following a breach of an individual’s privacy. The heady optimism following Puttaswamy is beginning to wane in the absence of a practical law that enforces the rights it asserted.
Data protection law
Thankfully, momentum appears to be building for an Indian law on data protection: the second flashpoint that will tell if India has a real commitment to securing a fair digital economy. The Government of India has called for comments by September 10, 2018, on a draft Personal Data Protection Bill, submitted to it by the Committee on data protection chaired by Justice BN Srikrishna. The draft bill bravely attempts to create a paradigm where entities take “fiduciary” responsibility – akin to doctors, priests and lawyers – when they handle personal data of individuals.
Unfortunately, it falls short of setting out a clear standard or criteria against which to assess if such fiduciary responsibility for “fair and reasonable processing” has been met. It also shies away from articulating a right to informational privacy, vests only limited rights for individuals, fails to call for a consumer-friendly grievance process or mandate that a future data protection authority should actively protect users through driving communication and awareness (for instance, in the aftermath of a major breach). The final shape of this legislation will directly impact the extent to which our right to privacy is enforceable and enforced.
And so, one year from Puttaswamy, India finds itself on the cusp of real clarity about whether the right to privacy will have teeth in the country. Despite the apparent disarray, there is cause for optimism, if we can stay true to the Constitutional scheme that Puttaswamy reminded us of. One with individual liberty at its heart, and a State accountable to preserve our best interests.
Malavika Raghavan is Project Head – Future of Finance Initiative at Dvara Research. Views expressed by the author are personal.