A Profound Exploration Of Privacy Rights And Data Protection In India
Author: LawSphereX
Category: Constitutional & Human Rights
Published:
Updated:
A PROFOUND EXPLORATION OF PRIVACY RIGHTS AND
DATA PROTECTION IN INDIA
Oliva Chakraborty, B.Sc. LL.B. (Hons.), KIIT-School of Law, KIIT University, Bhubaneshwar
ABSTRACT
Privacy has been widely recognised as the most crucial aspect of an individual's life as it protects one’s personal data from being misused. In India, the interpretations of privacy rights has evolved through a myriad of judicial decisions over the years. However, the concept of privacy got clarity in the year 2017 when the Supreme Court of India considered the right to privacy as the Fundamental Right in the Landmark case of Justice K. S Puttaswamy & Another vs. Union of India and Others [Writ Petition (Civil) No. 494 of 2012]. Through this historic ruling, the right to privacy was considered as an integral part of the Right to Life and Personal Liberty guaranteed under Article 21 of the Constitution, thereby giving a new meaning to the concept of privacy. The right to Privacy can only be implemented when the Personal Data of all individuals are safeguarded.
To protect such data from being misused, we need strong legal regulations as they pose serious threats to one’s private life. Data Protection laws were developed to protect and support the privacy rights of an individual But with rapid AI advancement, it has become very difficult to ensure such protection. Through this paper, the author has tried to address the various aspects of the Right to Privacy and Data Protection laws in our country, highlighting the meaning, need, evolution, and impact it offers post the landmark judgement. The paper carefully examines the legal framework related to these rights with special emphasis on the Personal Data Protection Bill of 2019 and the Challenges it still poses even after the current legislation. This analysis aims to determine whether these current regulations are strong enough to tackle every aspect of Data Protection and Privacy issues.
Keywords: Constitution, Data Protection, K. S Puttaswamy judgement, Privacy, Right to privacy
INTRODUCTION
In layman's language, Privacy refers to protecting an individual's private life from public interference and unauthorised access. The concept of privacy is not at all new1. It has been interpreted in many forms since ancient times. However, the landmark judgement of Justice K. S Puttaswamy & Another vs. Union of India and Others [Writ Petition (Civil) No. 494 of 2012]2 gave a new meaning to the overall concept of privacy. It expanded the definition of privacy by recognising it as the basic Fundamental right of humans. The right to Privacy is not defined in our Indian Constitution3. It was acknowledged as an integral part of the Right to life and personal liberty mentioned under Article 21 of the Constitution. Data Protection and Right to Privacy are closely connected to each other and often go hand in hand.
Data Protection are designed to safeguard the personal information of an individual thereby upholding once right to privacy. However, it is not exactly the same. According to Article 12 of the Universal Declaration of Human Rights4, Data Protection is more specific in nature as compared to privacy rights. It prevents misuse of the data. With the rapid growth of Artificial Intelligence 5in today's world which is heavily dependent on massive databases, it has become more crucial to protect our data from being misused. With the emergence of A. I, the creation of deep fake, images, audio, and also real-time video has become very common. These issues demands the need for strong Data Protection laws in our Country. If not regulated properly, it can pose serious threats to an individual’s private life.
In this paper, the author has tried to address different hues and shades of the Right to Privacy and Data Protection laws in our country. This paper carefully examines the evolution of these laws and the impact and dynamism it offers after the landmark judgement.
RIGHT TO PRIVACY- THE CONCEPT
Privacy is a key component of an individual's life. It has been interpreted in many forms. 1Rajat Pahuja, Right to Privacy in India: A Study, International Journal of Research Publication and Reviews, (May.31, 2024 10:00 AM), https://ijrpr.com/uploads/V4ISSUE4/IJRPR12089.pdf
2 https://indiankanoon.org/doc/91938676/
3 Sruti Devan, AN ANALYSIS ON DATA PROTECTION IN INDIA, Indian Journal of Integrated Research in Law, (May.31, 10:30
AM),
https://ijirl.com/wp-content/uploads/2022/03/AN-ANALYSIS-ON-DATA- PROTECTION-IN-INDIA.pdf
4 Adv. Ridhi Jindal, RIGHT TO PRIVACY AND DATA PROTECTION, (May.31, 2024 11:11),
https://www.linkedin.com/pulse/right-privacy-data-protection-ridhi-jindal-tr2gf/
5 Id
According to Duhaime’s Law Dictionary6, privacy means “An individual’s Right to control and access over his/her personal information”. While Justice Dickson defined Privacy as7 “The freedom of a man to ascertain when, how, and to what degree he or she will disclose private data”. But the Supreme Court of India in its landmark judgement on K. S Puttaswamy Vs Union of India solved the ambiguity8 regarding the interpretation of the term “ privacy”. The Supreme Court held the Right to privacy as the Fundamental right under Article 21 of the Indian Constitution. However, this right is not absolute, just like any other fundamental Right it can be subjected to reasonable restriction. This exception9 to the right to privacy includes reasonable restrictions based on national interest, threat to sovereignty, public order, decency, morality, contempt of court, or incitement of an offense.
Also, privacy can be subjugated when it conflicts with another fundamental right serving the public interest. In Our Country, there is no statutory definition of the right to privacy. Its meaning has been interpreted through various judgements and rulings. Supreme Court of India has extended the scope of Article 21 of the Constitution and has upheld that the right to privacy10 as a fundamental right too. The right to privacy has been considered as an integral part of the right to life and personal liberty mentioned under Article 21 of the Constitution. According to this Article11, every person, both citizen as well as non-citizen has the right to life and personal liberty. The State cannot take away these rights from any individual on any grounds except under certain scenarios.
Apart from India, This right to Privacy has received global recognition as well, addressing issues and facilitating to gain in-depth knowledge in this matter.
EVOLUTION OF THE RIGHT TO PRIVACY IN INDIA
There is no mention of the term Privacy anywhere in the Constitution. It has been interpreted through different judicial rulings. In the year 1954, the right to privacy should be considered as a Fundamental right or not came into notice. In the case of M. P. Sharma and Ors. v Satish
6 Poonam Rawat & Shreyash Agarwal, RIGHT TO PRIVACY AND DATA PROTECTION ISSUES IN INDIA,
International Journal of Creative Research Thoughts, (May.31, 2024 11:30), RIGHT TO PRIVACY AND DATA PROTECTION ISSUES IN INDIA, https://ijcrt.org/papers/IJCRT2008299.pdf
7 Id
8 Shubham Vitls, Evolution of Right to Privacy In India, Legal Service India,
https://www.legalserviceindia.com/legal/article-276-evolution-of-right-to-privacy-in-india.html
9 Devan, supra note at 3
10 Janvi Shukla, Right To Privacy And Data Protection Era, Legal Service India, (Jun.1, 2024 12:32 PM), https://www.legalserviceindia.com/legal/article-10664-right-to-privacy-and-data-protectionera.html#google_vignette
11 I NDIA CONST. art. 21
Chandra, District Magistrate, Delhi, and Ors12, the Supreme Court ruled in favour of the practice of search and seizure when compared with privacy In this case, the issue was whether the petitioner had a right to privacy when a search and seizure was conducted at his premise without any notice, violating his privacy. The Court in his reasoning referred to the 4th Amendment of the United States Constitution to guide its decision on the right to privacy concerning search and seizure operations. However, the court did not acknowledge a right to privacy in the context of Article 20(3) of the Indian Constitution, while leaving the question of a general right to privacy untouched.
Another Case dealing with the aspect of the Right to privacy is Kharak Singh vs State of UP (AIR 1963 SC 1295)13, The main issue in this case was whether nighttime surveillance of an accused violated their fundamental right mentioned under Article 21 of the constitution, thereby questioning their right to privacy. The Supreme Court ruled that such surveillance did violate Article 21 but the right to privacy cannot be explicitly mentioned as a fundamental right in the Constitution. Therefore, monitoring someone's movements does not violate any guaranteed fundamental rights. The court drew precedence from the A. K. Gopalan v State of Madras Case14, where it was stated that each Fundamental Right is limited to specific provisions and can't be expanded. So even if such surveillance violated Article 21, still right to privacy can't be included within the ambit of Fundamental Right.
In Gobind v State of M. P. (1975)15, the Supreme Court recognised the right to privacy as a fundamental right under Article 21 but stated it must develop on a case-by-case basis and is not absolute. Similarly, in R. Rajagopal and Anr. v State of Tamil Nadu (1994)16, the Court affirmed that the right to privacy is implicit in the right to life and liberty, protecting personal matters from being published without consent. However, this right may be limited if someone voluntarily enters into public controversy. In 1997, The Supreme Court ruling in the case of PUCL vs Union of India17, famously known as the telephone tapping case, demonstrated the increasing demand and recognition of the right to privacy. It also recognised the exceptions which are aligned with it. The Court stated that all
12 AIR 1954 SCR 1077
13 AIR 1963 SC 1295
14 AIR 1950 SC 157
15 AIR 1975 SC 1378
16 Rajat Pahuja, Right to Privacy in India: A Study, International Journal of Research Publication and Reviews, https://ijrpr.com/uploads/V4ISSUE4/IJRPR12089.pdf
17 AIR 1997 SCC 311
individuals have a privacy interest in their telephone conversations. Hence these conversations must be protected unless they harm the National Interest. The crystal clear clarity on the Right to Privacy answering all the questions and doubts was seen in the Landmark judgement of the K. S Puttaswamy case. In the case of Justice K. Puttaswamy v Union of India18, decided on August 24, 2017, the 9 Judge bench unanimously declared right to privacy as a fundamental right. This extended the purview to Article 21 by making the Right to privacy an integral part of Article 21. The case commenced in the year 2015, where a petition challenging the constitutionality of the Aadhar program, arguing it violated individuals' right to privacy was raised. Initially, a three-judge bench sought to decide on Aadhar's validity but faced a dilemma about the nature of the right to privacy.
The question was referred to a five-judge bench, then forming a nine-judge bench. With a 9:0 majority, the bench overturned the previous rulings, affirming the right to privacy as a fundamental right, marking a significant milestone in India's constitutional history.
LEGAL PROVISIONS RELATED TO RIGHT TO PRIVACY IN INDIAN
CONSTITUTION
There are no particular legal provisions defining the privacy rights of an Individual. The have been interpreted through a series of judicial decisions. The following legal provisions interpret the privacy rights of an individual.19 Article 19: This provision guarantees the right to freedom of speech and expression for all citizens. This right is specially mentioned under the sub-clause 1 of this article20. However, sub-clause (2) states that this right is not absolute and can be subjected to reasonable restrictions in the interest of India’s sovereignty, integrity and security Article 21: This Article guarantees the Right to life and Personal liberty to both its citizens and non-citizens which is an integral part of the Right to privacy. Article 21 states: “No individual shall be deprived of their life or personal liberty except according to the procedure
18 K.S. Puttaswamy v. Union of India MANU/SC/0911/2017
19 Rawat, Supra note at 6
20 I NDIA CONST. art. 19
established by law21.” This article is considered the cornerstone of freedom for the Indian people.
DATA PRIVACY AND DATA PROTECTION IN INDIA
Most of us might have come across the phrase “Data is the New Oil”. People can extract large profits by exploiting one’s data. Unlike Oil sharing someone's Data unauthorisedly is more dangerous than extracting oil. Due to rapid growth of A. I. and influence of Social media, it has become almost impossible to protect one's personal Data. The creation22 of deepfakes, images, videos and fake accounts is now a piece of a cake. All these are creating serious threats to the Personal Data of the individuals. Personal Data23 can be referred to as any Information such as the name, location, identification number, physical appearance, or anything which can help in identifying a person. There is no provision explaining what can be included under personal data and what can't. If these Personal Data are not protected well, they can cause infringement of one’s right to Privacy.
Data Protection and the Right to Privacy are closely connected to each other and can be interchangeably used. Data Protection is designed to protect the personal information of an individual thereby upholding one’s right to privacy24. However, it is not exactly the same. According to Article 12 of the Universal Declaration of Human Rights, Data Protection is more specific in nature as compared to privacy rights25. It prevents misuse of the data. The Current Data Protection and right to privacy laws are not enough for the Protection of one's private Data. With the advancement of Artificial Intelligence, the World has upgraded. With that the techniques for causing misuse of one’s personal data also have. So we need stronger laws that could tackle every aspect of privacy rights and data protection issues.
If these stronger laws are not formulated properly, it can pose a serious threat to one's right to privacy and can impact the society badly.
21 I NDIA CONST. art. 21
22 Jayanta Ghosh, PRIVACY AND DATA PROTECTION LAWS IN INDIA: A RIGHT-BASED ANALYSIS,
RESEARCHGATE, (JUN. 10, 2024 2:30 PM)
23 Komal Arora, Data protection and data privacy laws in India, Ipleaders, (JUN. 12, 2024 3:20 PM)
24 Jayanta Boruah &Bandita Das RIGHT TO PRIVACY AND DATA PROTECTION UNDER INDIAN LEGAL
REGIME, SSRN, https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3827766
25 Id at 4
LEGAL PROVISIONS RELATED TO DATA PRIVACY AND PROTECTION IN INDIA
The Information Technology Act of 200026 is the primary legislation in the country protecting the privacy of individuals in data and information transactions. This legislation was amended in 2008, adding provisions to enhance its effectiveness in protecting privacy. The provisions ensuring privacy in data-related issues are as follows27: Section 30: It necessitates the certifying authority to comply with safety processes to ensure the secrecy and privacy of electronic signatures. Section 43: This provision helps an individual to receive compensation for unlawful access to their private and personal data, including compensation for interference of one's computer or computer framework. This section was amended by the ITAA 2008. Section 43A (by ITAA, 2008): This is a new provision which has been added to provide compensation for the inability to preserve the data.
If any entity is responsible for unfair losses due to its negligence in applying and maintaining appropriate safety practices and procedures, then that entity is responsible for paying compensation to the affected person. Section 66: This provision is responsible for protecting sensitive information existing in a computer resource and makes any reduction in the value of information within a computer resource punishable. This includes activities such as hacking, copying, and transferring sensitive personal information. Section 72: This provision addresses the violation of confidentiality and privacy by government officers. A restricted execution of this section is applicable to individuals mentioned under the Act.
PERSONAL DATA PROTECTION BILL OF 2019
As a result of the Landmark judgement of the Supreme Court in the K.S Puttaswamy case, the Central Government appointed a Data Protection Committee under the Supervision of retired
26 Rawat, Supra note at 6
27Information Technology Act 2008, https://eprocure.gov.in/cppp/rulesandprocs/kbadqkdlcswfjdelrquehwuxcfmijmuixngudufgbuubgubfugbububjxcg fvsbdihbgfGhdfgFHytyhRtMTk4NzY=
Supreme Court judge, Justice B. R Srikrishna. 28 The next year, the committee released a draft highlighting the need and importance of the Right to privacy in an individual's life. Consequently, in July 2018, the committee released the final draft after making some changes in the name of the Personal Data Protection Bill of 2018. Later on in 2019, the Personal Data Protection Bill 201929 was introduced in the Lok Sabha with few modifications. Then on December 12, 2019, the Personal Data Protection Bill was referred to the Joint Parliamentary Committee for further examination30. Then after 2 years, the committee submitted its report with various recommendations and changes. The Recommendation of the Joint Parliamentary Committee was31: • Change of bill name to Data Protection bill to cover the non-personal data as well.
However, concerns were raised that it might dilute the original Purpose of the bill i. e protection of personal data • Earlier in the Personal Data Protection Bill, the role of stakeholders in the selection committee of the Data Protection Authority was restricted. This committee recommended to increase the representation of technical, legal, and academic experts in the selection of the Data Protection Authority. This would influence the authority's independence due to government appointed member32 • Earlier the PDP bill exempted the Government under the draft legislation for the protection of the National Interest. However, this report prepared by the JPC committee made a recommendation regarding the exemption of the government by adding a condition.
The Committee recommended that the Government may exempt itself from the provision of legislation only after a fair, just and reasonable procedure. 33 28 Rishab Bailey, Comments on the (draft) Personal Data Protection Bill, 2019, SSRN, (Jun. 14, 2024, 9:30 AM), https://papers. ssrn. com/sol3/papers. cfm? abstract_id=4051127
29 Id at 23
30 Right to privacy, Ipleaders, https://blog.ipleaders.in/different-aspects-of-right-to-privacy-under-article-21/ 31 Renjith Mathew, Personal Data Protection Bill, 2019 –Examined through the Prism of Fundamental Right to Privacy – A Critical Study, SSCTimes, https://www.scconline.com/blog/post/2020/05/22/personal-dataprotection-bill-2019-examined-through-the-prism-of-fundamental-right-to-privacy-a-critical-study
32 Id at 29
33 Farsana S, RIGHT TO PRIVACY: AN INDIAN CONTEXT, Times Of India,
https://timesofindia.indiatimes.com/readersblog/the-daily-roam/right-to-privacy-an-indian-context
The report made the recommendation regarding reporting of all data breaches within 72 hours irrespective of the type of Data involved. It also mandates the preservation of breach records. • Made recommendations to verify all social media handles to tackle fake news and treat al; social media intermediaries as publishers in particular contexts to address content from unverified accounts34 • To remove the guardian data fiduciary which previously aimed at protecting children’s data and to avoid diluting the safeguard objectives.
KEY OBJECTIVES OF THE PERSONAL DATA PROTECTION BILL 2019
The Bill was introduced to protect the privacy rights of an individual's personal data. It establishes the Data Protection Authority to protect individual Interests and prevents misuse of personal Data35. • It replaces Section 43A of the IT Act which mentioned the payment of compensation by the corporate bodies in case there is a failure to protect someone's data. It now focuses on how personal data is collected, processed, used, disclosed, stored, and transferred36. • It is applicable to personal data which are processed by the government, Indian companies, Indian citizens, or bodies incorporated in India. It also extends to foreign companies handling the personal data of the Indian Citizens37. • Transfer of Sensitive personal data can be made outside India for processing with explicit consent from the data subject and must continue to be stored in India38.
• The central government can exempt government agencies from the act in the interest of national sovereignty, security, or international relations.
34 Supra note at 29
35 Sougata Talukdar, PRIVACY AND ITS PROTECTION IN INFORMATIVE TECHNOLOGICALCOMPASS IN
INDIA, NUJSLawReview, (June 19, 2024 4:45 PM), https://nujslawreview.org/wp-content/uploads/2020/01/12.2- Talukda 36Rupinder Kaur, Surveillance and Privacy: A Ramification of Article 21, ijrrssonline,(JUN 19 2024 7:30 PM) https://ijrrssonline.in/Home.aspx
37 Id
38 Id at 23
IMPACT & IMPLEMENTATION OF THE BILL
After the commencement of the Right to Privacy as a Fundamental Right, this act has brought effective measures to address concerns related to the Right to Privacy. Due to this Act, people became more vigilant regarding their privacy rights and personal data protection. Protection of Personal Data is a very sensitive issue39. That’s why it should be tackled very carefully. With the advancement of technology, it is difficult to maintain the efficacy of this Act. Despite being inspired from GDPR, it does not give as much clarity as foreign law gives. GDPR provides more clarity and obligation for data removal compared to the bill40. As per many researchers, the Data Protection Bill of 2019 has a narrow definition and restriction on processing anonymous data41, but it allows the Union government to collect and use such data without regulation.
For example orders mentioned in clause 11 is very confusing as it gives too many exceptions to the consent before data processing. Apart from this detailed regulations42 regarding the enforcement of Clause 18 which states the procedure for data principals. The bill lacks a structure for notifying data 43principals about data removal, and the right of removal is also unclear. That’s why need practical legislation which can address these doubts and clear the ambiguity
DIGITAL PERSONAL DATA PROTECTION ACT, 2023
This is a new addition to the current legislation in India which was adopted in the year 2023, against the framework of privacy laws around the world concerning confidentiality and protection of personal data44. This Act came into force to address the loopholes and lackings of previous laws and regulations which were formulated to address the issues related to data privacy and Data protection. The concept of the DPDP Act was inspired from the European Union’s GDPR (General Data Protection Regulation)45 which has a wide recognition globally.
39 Trishaagarwal, Loopholes of the Personal Data Protection Bill, 2019, LegalServiceIndia,
40 https://www.legalserviceindia.com/legal/article-6384-loopholes-of-the-personal-data-protection-bill- 2019.html 41 Withdrawl of Personal Data, DRISHTIIAS, https://www.drishtiias.com/daily-updates/daily-newsanalysis/withdrawal-of-personal-data-protection-bill
42 Jai Khurana, Analyzing the impact of the Data Protection Bill on business,
Ipleader,https://blog.ipleaders.in/analyzing-the-impact-of-the-data-protection-bill-on-business/
43 Id
44Vatsal Gaur and Krishnan Sreekumar, A DAWN OF A NEW ERA FOR DATA PROTECTION IN INDIA: AN
IN-DEPTH ANALYSIS OF THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023, LEGAL500,
https://www.legal500.com/developments/thought-leadership/a-dawn-of-a-new-era-for-data-protection-in-indiaan-in-depth-analysis-of-the-digital-personal-data-protection-act- 45 The Digital Personal Data Protection Bill, 2023, Prsindia, https://prsindia.org/billtrack/digital-personal-dataprotection-bill-2023
The DPDP Act imposes strict obligations for the unlawful processing of personal data and also provides some exceptions to the government bodies. This act has replaced the limited provisions of the IT Act. The DPDP Act serves as the foundation for various other legislations such as the Digital India Act and other industry-specific laws surrounding privacy and data protection to increase46 India’s hike towards adopting Artificial Intelligence (AI) and other future technologies while protecting Personal Data. The Act may also helps Indian businesses to augment collaboration with other internationally located businesses under reciprocal arrangements while protecting Personal Data. Remarkably, this is the first-ever central law in India to use she/her pronouns instead of he/his while referring to individuals.
KEY FEATURES OF THE ACT
The DPDP Act presents numerous terms that clarify the roles and responsibilities within its framework. Data principals and data fiduciaries are some important concepts associated with this Act. An individual whose personal Data is collected47, processed, or stored is referred to as the Data Principal. On the other hand, Data fiduciary refers to an entity that determines the purpose and modes of processing the personal data. The role of a data fiduciary is analogous to a data controller in other data protection legislation - Under this act, there are certain provisions concerning exceptions to data protection rules in specific scenarios.
These exceptions aims at the protection of the sovereignty and integrity of India, ensuring national security, maintaining friendly relations48 with foreign states, upholding public order, and preventing incitement to commit offences - This DPDP Act extends its jurisdictions beyond Indian borders, applying to situations outside India. Also, the Act enforces no restrictions on international data transfers and
46 Id
47 Chanlang Ki Bareh, Reviewing the Privacy Implications of India's Digital Personal Data Protection Act (2023) from Library Contexts, RESEARCHGATE, https://www.researchgate.net/publication/377768426_Reviewing_the_Privacy_Implications_of_India's_Digital_ Personal_Data_Protection_Act_2023_from_Library_Contexts#:~:text=Abstract,Act%20on%2011th%20August %202023.
48 Id
provides that such transfers comply with its regulatory framework49. - This Act further guarantees specific rights to the data principals such as access to their data, the right to request erasure under certain circumstances, 50and the right to object to processing activities. Data fiduciaries have compulsions to sustain these rights and obey with strict standards to avoid penalties for non-compliance. These measures ensure a balanced approach to data protection, underlining accountability and transparency in data processing practices under the DPDP Act. Applicability of this act: This Act is applicable to those organisations that meet the following conditions: • The organisation which processes digital personal data must recognise the data principal to whom the collected data belongs. • The data collected by the organisation for processing must be in the digital form.
• Organisation processing the personal data must be within the jurisdiction of the Country. This act can be applicable outside the country as well only If the processing of personal data involves offering goods and services to the individuals in India.
IMPACT & IMPLEMENTATION OF THE ACT
The Central Government made a serious effort to secure every individual's personal data with this Act. From now onwards, Companies and other business entities handling Personal Data must develop standard operating procedures and train their personnel to comply with regulations such as cooperating with the Data Protection Officer51, hiring an Independent Data Auditor, etc. But the criteria for categorizing companies and start-ups as Data Fiduciaries need to be clarified, especially regarding factors related to net worth, assets, size, number of personnel, and qualifications. Not only this, there are many other issues related to its implementation which raises concerns. For example, Section 36 of the act grants the Central Government exclusive power to request “such information" from Data Protection Board,
49 Arora, Supra note at 23
50 Id
51 Ishwar Ahuja, Sakina Kapadia, Digital Personal Data Protection Act, 2023 – A Brief Analysis,
https://www.barandbench.com/law-firms/view-point/digital-personal-data-protection-act-2023-a-brief-analysis
fiduciaries or intermediaries suggesting potential surveillance, Additionally, Section 17(2)(a) 52permits the Union Government to exclude state agencies from complying with data protection rules, indicating selective application. Furthermore, the amendment53 of Section 8(1)(j) of the RTI Act disrupts the balance between privacy and the right to information, as it sanctions PIOs to reject requests citing personal data concerns. Apart from this, other approaches made under this Act are really appreciable because it has tried to address all issues with the advancing digital world. But still there are some ambiguity that raises concern. With time it will be clear whether implementation of this Act is practically possible or it is just an eye wash to gain legislative surveillance and control
NEED FOR RIGHT TO PRIVACY AND DATA PROTECTION IN INDIA
Privacy and data protection are indeed the most important issues in this contemporary society for a myriad of reasons54. • It is essential for one’s safety. If individual personal information such as addresses, phone numbers or any other schedules are exposed, they can become subject to physical harm or harassment. All these threats can extend beyond just unwanted calls or emails or can even lead to stalking, identity, theft, etc • Privacy asures that individuals can maintain their sovereignty over their own decisions without any influence. They are essential for preserving an individual's personal freedom. • Protection of privacy upholds an individual's dignity by preventing the distribution of sensitive and private information.
This is vital in maintaining one's reputation and mental well-being, as disclosure of personal details in public can lead to dishonor and harassment • Intimate details about one's life and relationships should be shielded to preserve faith and security in personal dealings. Breach of such privacy can erode relationships and can lead to emotional distress or manipulation.
52 India’s Digital Personal Data Protection Act, 2023: Data Privacy Compliance, INDIABRIEFING,
https://www.india-briefing.com/news/indias-digital-personal-data-protection-act-2023-key-provisions-
53 Id
54 Sukla, Supra Note at 10
Protecting personal data makes sure that individuals are not misrepresented or impersonated. Protecting their identity from misuse for fraudulent activities such as financial scams or false representation. • Cybercrime nowadays impacts a significant portion of the population, strong privacy laws and data protection measures are really in need. Apart from safeguarding individuals, these measures also encourage trust in digital transactions and interactions, essential for economic growth and societal development55. • Even for business and public sector, handling of customer data is very crucial. It has to be done carefully to prevent its misuse
PERSISTING CHALLENGES RELATED TO THE RIGHT TO PRIVACY AND DATA
PROTECTION IN INDIA
Even after significant developments in the field of the right to privacy and data protection, there remain persistent challenges that need to be addressed56. Technological Advancements and Data Proliferation The rapid advancement of technologies like 5G, LoT, and edge computing has increased the collection of personal data. This vast amount of data poses serious threats to the current privacy laws. The wide use of LoT devices gathers and transmits real-time data and creates serious threats for data breaches and unauthorised access. The independent data exchange in IoT ecosystems makes it more difficult to enforce consent and purpose limitations. Rise of Artificial Intelligence and Machine Learning57: AI and ML algorithms depends on on massive datasets to function efficiently.
This Ensures ethical use of data and maintains transparency, accountability, and fairness in algorithmic decision-making, which is quite challenging. Current legislation may not satisfactorily cover these aspects and unforeseen
55 Pahuja, supra note at 10
56 Janvi Sukla, Right To Privacy And Data Protection Era , LegalServiceIndia,
https://www.legalserviceindia.com/legal/article-10664-right-to-privacy-and-data-protectionera.html#:~:text=The%20right%20to%20privacy%20and%20data%20protection%20is%
57 Id
danger arising out of it. That’s why we need continuous refinements to keep up with the rapid pace of technologies. Globalization and Cross-Border Data Flow: The digital age facilitates rapid data transfer across borders resulting in the rise of significant challenges in regulating and protecting personal data on a global scale58. The lack of strict, clear regulations on cross-border data transfer, together with potential national security concerns complicates the overall enforcement of data protection laws, Evolving Cybersecurity Threats: The complexity of cyber threats is continuously evolving, making it challenging for data security frameworks to persist effectively59. Prominent cases related to data breaches, such as those involving Aadhaar or MOVEit, highlight the susceptibilities in the existing systems.
Legislation must continuously progress to provide instruments for rapid response and mitigation. Compliance and Economic Ramifications: Strict data protection regulations enforce momentous compliance responsibilities on businesses, particularly SMEs. The financial and operational burdens of compliance can choke innovation and competitiveness. Policymakers must balance hearty data protection with raising a lively economic environment that supports data-driven innovation.
CONCLUSIONS & SUGGESTIONS
The right to privacy and data protection in India has undergone noteworthy evolution, marked by judicial interpretations and landmark legislation. After the recognition of Right to Privacy as a Fundamental Right under Article 21 in the landmark case of K. S Puttaswamy Vs Union of India, has solidified the importance of Privacy and Data Protection. The Personal Data Protection Bill of 2019 and the subsequent Digital Personal Data Protection Act of 2023 are pivotal and noteworthy steps toward addressing privacy concerns in the digital age. However, despite these developments , challenges persist60. The rapid growth of technology, especially AI and IoT, poses continuous threats to data security. That’s why now our Country demand 58 The Future of Data Privacy: Navigating Trends and Challenges Beyond the Digital Personal Data Protection, Act, 2023, TAXMANN, https://www. taxmann.
com/research/company-and-sebi/topstory/105010000000023742/the-future-of-data-privacy-navigating-trends-and-challenges-beyond-the-digitalpersonal-data-protection-act-2023-experts-opini
59 Id
60 Supra note at 6
stronger laws which would clarify and address all loopholes of the present legislations. The laws should be formulated in such a way that would be able to anticipitate the unforeseen danger of the changing digital threats in order the save its citizens from danger. Suggestions Here are some of my opinions through which we can create a resilient framework that would address the current issues and anticipate future risks
1. we should implement advances in cybersecurity infrastructure including encryption,
detection systems, blockchain technology, etc to protect personal data from getting breached and unauthorised access
2. We should Encourage research and development in AI and machine learning to cultivate
protected algorithms that would prioritise data privacy, guaranteeing practical threat detection and response.
3. We should continuously review and update data protection laws to stay ahead of
technological progressions and emerging threats, ensuring they remain effective and relevant by developing specific regulations addressing the ethical use and accountability of AI and IoT in data handling to mitigate risks associated with these technologies.
4. We should work with international organisations to establish global data protection standards
and protocols, promoting consistency and security in cross-border data flows.
5. We should create an independent body that would be responsible for addressing the audits,
enforcing data protection regulations, ensuring compliance, and addressing violations effectively. This body should operate transparently and independently, free from political influence to build public trust and assurance
6. The Government should launch campaigns to raise awareness about privacy rights and the
importance of data protection, empowering individuals to safeguard their personal information
REFERENCES
1 Rajat Pahuja, Right to Privacy in India: A Study, International Journal of Research
Publication and Reviews, , https://ijrpr.com/uploads/V4ISSUE4/IJRPR12089.pdf https://indiankanoon.org/doc/91938676/
2. Sruti Devan, AN ANALYSIS ON DATA PROTECTION IN INDIA, Indian Journal of
Integrated Research in Law,https://ijirl.com/wp-content/uploads/2022/03/AN-ANALYSIS- ON-DATA-PROTECTION-IN-INDIA.pdf 3. Adv. Ridhi Jindal,
RIGHT
TO
PRIVACY
AND
DATA
PROTECTION,
https://www.linkedin.com/pulse/right-privacy-data-protection-ridhi-jindal-tr2gf/
4. Poonam Rawat & Shreyash Agarwal, RIGHT TO PRIVACY AND DATA PROTECTION
ISSUES IN INDIA, International Journal of Creative Research Thoughts, , RIGHT TO
PRIVACY
AND
DATA
PROTECTION
ISSUES
IN
INDIA,
https://ijcrt.org/papers/IJCRT2008299.pdf
4. Shubham Vitls, Evolution of Right to Privacy In India, Legal Service India,
https://www.legalserviceindia.com/legal/article-276-evolution-of-right-to-privacy-inindia.html
5. Janvi Shukla, Right To Privacy And Data Protection Era, Legal Service India,
https://www.legalserviceindia.com/legal/article-10664-right-to-privacy-and-data-protectionera.html#google_vignette
7. K.S. Puttaswamy v. Union of India MANU/SC/0911/2017
8. Jayanta Ghosh, PRIVACY AND DATA PROTECTION LAWS IN INDIA: A RIGHT-
BASED ANALYSIS, RESEARCHGATE, (
9 Komal Arora, Data protection and data privacy laws in India, Ipleaders,
10. Jayanta Boruah &Bandita Das RIGHT TO PRIVACY AND DATA PROTECTION
UNDER
INDIAN
LEGAL
REGIME,
SSRN,
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=382776
Information Technology Act 2008, https://eprocure.gov.in/cppp/rulesandprocs/kbadqkdlcswfjdelrquehwuxcfmijmuixngudufgbuu bgubfugbububjxcgfvsbdihbgfGhdfgFHytyhRtMTk4NzY=
11. Rishab Bailey, Comments on the (draft) Personal Data Protection Bill, 2019, SSRN,
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4051127 12. Right to privacy, Ipleaders, https://blog.ipleaders.in/different-aspects-of-right-to-privacyunder-article-21/
13. Renjith Mathew, Personal Data Protection Bill, 2019 –Examined through the Prism of
Fundamental Right to Privacy –
A
Critical Study, SSCTimes, https://www.scconline.com/blog/post/2020/05/22/personal-data-protection-bill-2019examined-through-the-prism-of-fundamental-right-to-privacy-a-critical-study/
14. Farsana S, RIGHT TO PRIVACY: AN INDIAN CONTEXT, Times Of India,
https://timesofindia.indiatimes.com/readersblog/the-daily-roam/right-to-privacy-an-indiancontext
15. Sougata Talukdar, PRIVACY AND ITS PROTECTION IN INFORMATIVE
TECHNOLOGICALCOMPASS IN INDIA, NUJSLawReview, (June 19, 2024 4:45 PM), https://nujslawreview.org/wp-content/uploads/2020/01/12.2-Talukda
16. Rupinder Kaur, Surveillance and Privacy: A Ramification of Article 21, ijrrssonline,(JUN
19 2024 7:30 PM) https://ijrrssonline.in/Home.aspx
17. Trishaagarwal, Loopholes of the Personal Data Protection Bill, 2019, LegalServiceIndia,
https://www.legalserviceindia.com/legal/article-6384-loopholes-of-the-personal-dataprotection-bill-2019.html 18. Withdrawl of Personal Data,
DRISHTIIAS,
https://www.drishtiias.com/dailyupdates/daily-news-analysis/withdrawal-of-personal-data-protection-bill
19. Jai Khurana, Analyzing the impact of the Data Protection Bill on business,
Ipleader,https://blog.ipleaders.in/analyzing-the-impact-of-the-data-protection-bill-onbusiness/
20. Vatsal Gaur and Krishnan Sreekumar, A DAWN OF A NEW ERA FOR DATA
PROTECTION IN INDIA: AN IN-DEPTH ANALYSIS OF THE DIGITAL PERSONAL
DATA
PROTECTION
ACT,
2023,
LEGAL500,
https://www.legal500.com/developments/thought-leadership/a-dawn-of-a-new-era-for-dataprotection-in-india-an-in-depth-analysis-of-the-digital-personal-data-protection-act- 21.The Digital Personal Data Protection Bill, 2023, Prsindia, https://prsindia.org/billtrack/digital-personal-data-protection-bill-2023
22. Chanlang Ki Bareh, Reviewing the Privacy Implications of India's Digital Personal Data
Protection Act (2023) from Library Contexts,
RESEARCHGATE,
https://www.researchgate.net/publication/377768426_Reviewing_the_Privacy_Implications_ of_India's_Digital_Personal_Data_Protection_Act_2023_from_Library_Contexts#:~:text=Ab stract,Act%20on%2011th%20August%202023. 23.Ishwar Ahuja, Sakina Kapadia, Digital Personal Data Protection Act, 2023 – A Brief Analysis, https://www.barandbench.com/law-firms/view-point/digital-personal-dataprotection-act-2023-a-brief-analysis
24. India’s Digital Personal Data Protection Act, 2023: Data Privacy Compliance,
INDIABRIEFING,
https://www.india-briefing.com/news/indias-digital-personal-dataprotection-act-2023-key-provisions-
25. The Future of Data Privacy: Navigating Trends and Challenges Beyond the Digital
Personal Data Protection,
Act, 2023,
TAXMANN,
https://www.taxmann.com/research/company-and-sebi/top-story/105010000000023742/thefuture-of-data-privacy-navigating-trends-and-challenges-beyond-the-digital-personal-dataprotection-act-2023-experts-opini