Evolution Of Right To Privacy As A Fundamental Right In India - A Detailed & Comparative Analysis
Author: LawSphereX
Category: Constitutional & Human Rights
Published:
Updated:
EVOLUTION OF RIGHT TO PRIVACY AS A
FUNDAMENTAL RIGHT IN INDIA: A DETAILED &
COMPARATIVE
ANALYSIS
Ipsita Tiwari, B.A. LL.B., School of Law, Justice and Governance, Gautam Buddha University, Greater Noida
ABSTRACT
It is evident from several definitions that Privacy means that solitude space of individual where unreasonable interference of others is restricted. The right to privacy is a fundamental aspect of human dignity, recognized across various legal systems globally. While nations such as the European Union, the United States, and Germany have well-established data protection frameworks, India has recently taken a significant step by enacting the Digital Personal Data Protection Act, 2023. This paper explores the conceptual foundations of privacy, its evolution as a fundamental right in India through judicial pronouncements, and a comparative analysis of privacy laws across different jurisdictions. In light of increasing digital dependence, particularly post-COVID-19, concerns regarding privacy breaches have intensified.
This paper also highlights the necessity for effective implementation of India's new privacy law and suggests measures to strengthen data protection mechanisms. Keywords: Privacy, Article 21, Fundamental Right, Digital Personal Data Protection Act, Comparative Analysis, Data Protection, Indian Judiciary, Global Privacy Laws.
I.
INTRODUCTION`
In a democratic country like India, Protection of individual’s privacy is crucial. But it is really saddening that even after the 75 years of Indian Independence, there do not exist sufficient protection of our Right to Privacy which is declared as a facet of Fundamental right to life and personal liberty under Article 21 of the Constitution of India by the hon’ble Supreme Court in various landmark rulings. Privacy of individual is not only a part of right of personal liberty but it also facilitates the Right to Freedom of speech and expression, which is apparently the core of Democracy. If there would be any unreasonable interference in the privacy of an individual, then it could bar the free flow of opinion, expression, information and association.
Therefore, it’s essential to protect the right to privacy to maintain the dignified life of human being and subsequently the democratic structure of a country. The Government of India shall be accountable to protect the privacy of its citizens from the undue interferences. India has also signed many international conventions & declarations on protection of Right to Privacy to enforce this essential right on international level. But it is evident that as per the current situation, there is an alarming need to focus on the domestic implementation of a specific legislation to protect the right to privacy from recurrent violations. II.
OBJECTIVE
Specific objectives of this research work are as follows: • To understand the meaning and importance of privacy as a fundamental part of right to life & personal liberty. • To study & analyse the evolution of Right to privacy in India through landmark rulings. • To compare the status of right to privacy in India with other nations • To provide certain suggestions regarding the protection of right to privacy. III. WHAT DO WE MEAN WITH PRIVACY AS A RIGHT?
The word ‘Privacy’ came from Latin origin- ‘privatus’, meaning “released”, “seclusion” or “separated from the rest”. Generally, Privacy is a state of individual where one wants seclusion from unwanted observation, interference or involvement of others. According to the New Oxford Dictionary, privacy refers to being free from public attention or exposure, as well as the state of withdrawing from social interactions or public interest. Similarly, the Cambridge Dictionary defines privacy as an individual’s right to keep personal affairs and relationships confidential. However, as a right, Privacy is defined by many jurists as the rightful claim of a particular person to decide the boundaries within which he desires to opens up with other people and his right over circumstances & time to indulge with others or communicate any information about oneself.
Though, Black’s Law Dictionary, “Right to Privacy is a general term encompassing various rights recognized to be inherent in concept of ordered liberty, and such rights prevent government interference in intimate private relations, or activities, freedoms of individual to make fundamental choices involving himself, his family, and his relationship with others”, there are numerous & varied definitions of Right to Privacy as conceptualized by several thinkers & jurists, so it’s a tough task to confine it in some specific words. Moreover, there are many aspects, or we can say types of privacy; some primary types of privacy are- Personal Privacy, Informational Privacy, Organizational Privacy & Decisional Privacy.
Personal Privacy: Personal Privacy, also known as Physical privacy, is a right of individuals which restricts the ability of others to experience a person through one or more of the five senses. If we say directly- “Personal privacy bars the exposure of one’s body to another with the aim to protect individual’s modesty & dignity in one’s personal space or solitude. ” Some instances that resembles personal privacy are as follows: • Individuals wear clothes, erecting walls or fencing, partition to prevent something, etc. , which aids in hiding one’s body from another. • Restricting access of home or any personal property to unauthorised people. • Decisions of family planning. • Restriction on capturing or sharing one’s picture or video without permission.
Decisions relating to one’s body or sex life, etc. Violations of Personal privacy include- Trespass1, Outraging the modesty of woman2, Rape3, Voyeurism4, Sexual Harassment5, etc. These offences would amount to breach of personal privacy under Article 21 of the constitution, and are punishable under IPC. Informational Privacy: Informational Privacy concerns with the issue of unauthorised storage & circulation or sharing of individual’s personal data. Personal Data includes- Name, Date of Birth, information about Family, Bank account details, Property details, Phone number, Address, etc. With the advances in today’s technology, almost every type of personal data is transparently & easily available on internet or other digital platforms, such as- Biometric impressions, personal photos & videos, voice, bank account details, e-mails, contact numbers, address, etc.
These contemporary types of PII (Personal Identifiable Information) are now-a-days stored through various means, like- Fingerprint scanners, face cameras & iris scanners, speaker recognition devices, etc. Various non-state entities, including social media platforms, search engines, email providers, and messaging apps, possess vast amounts of data about individuals. This includes information on their activities, financial transactions, personal and professional communications, health status, mental well-being, interests, travel patterns, expenses, and shopping behaviors. As the world shifts towards a digital economy and dependence on online services grows, people continue to leave increasingly extensive digital footprints, both consciously and unconsciously.
Though, this data is collected through aforesaid devices for better efficacy of services, communications & security, but if it would be misused then it would amount to breach of informational privacy of an individual. Moreover, Knowledge about a person gives a power over that person. The personal data collected is capable of effecting representations, influencing decision-making processes and shaping behaviour. This can have a stultifying effect on the expression of dissent and difference of opinion, which no democracy can afford. 6
1 The Indian Penal Code, § 441, No. 45, Acts of Parliament, 1860 (India)
2 The Indian Penal Code, § 354, No. 45, Acts of Parliament, 1860 (India)
3 The Indian Penal Code, § 376, No. 45, Acts of Parliament, 1860 (India)
4 The Indian Penal Code, § 354C, No. 45, Acts of Parliament, 1860 (India)
5 The Indian Penal Code, § 354A, No. 45, Acts of Parliament, 1860 (India)
6 Justice K.S. Puttaswamy (Retd.) & Anr. v. Union of India & Ors., (2017) 10 S.C.C. 1 (India)
Violations of Informational Privacy include- Stalking7, Morphing, Cyber Hacking8, Phishing, Spying, Fraud calls, Forgery9, etc. These offences are also punishable under different statutes. Organizational Privacy: As we know, there are uncountable organizations in various sectors which work in the world, such as- Educational organisations, Non-Governmental organisations, Investigation Organisations, Business or trade Organisations, Military Organisations, etc. These organisations have many confidential information and secrets which acts as a key for their efficient working & success. So, such confidential information and secret activities shall be protected from other organisations or people by adopting different methods and mechanisms, hereby the right of Organizational Privacy arises.
Decisional Privacy: Decisional privacy arise the rightful claim of individuals for the liberty to act according to their reasonable desires and make substantial decisions about their life, without undue interference of others or the state. The substantial decisions include- marriage by choice, adoption of child, sterilization, career or job choice, clothes or any fashion choices, etc. which affects the dignity, independence and confidence of an individual’s life. Here, individual does not include minors or person of unsound mind or incompetent to make rightful decisions. It is clear that if anyone makes unnecessary interference or restriction while exercising the right to take decision or choice, then that would be considered as a breach of Decisional Privacy of a person.
So now, we could easily infer the meaning of Privacy as a right before law from the above discussed descriptions and aspects of privacy. IV. EVOLUTION OF RIGHT TO PRIVACY IN INDIA India has traditionally been a communal society where cooperation has been more prominent than competition, and social bonds have been prioritized over solitude. This has led to debates on whether privacy holds significance in Indian culture. However, the notion that privacy is foreign to India is incorrect. Ancient Indian legal and philosophical texts, including the
7 The Indian Penal Code, § 354D, No. 45, Acts of Parliament, 1860 (India)
8 Information Technology Act, § 43, No. 21, Acts of Parliament, 2000 (India)
9 The Indian Penal Code, § 465, No. 45, Acts of Parliament, 1860 (India)
Dharmashastras and Hitopadesha, contain references to privacy. The Dharmashastras and their interpretations outlined privacy-related laws, emphasizing that rulers were responsible for upholding Dharma and respecting citizens' privacy. According to Hitopadesha, certain aspects of life, such as worship, family matters, and personal relationships, were meant to be kept confidential. Ancient Indian scholars also recognized the principle that "every man is a king in his own house," underscoring the idea of personal privacy. While there has been limited research on privacy norms in ancient Indian society, a careful examination of interpersonal obligations and social practices indicates the existence of rules that safeguarded individual privacy. The Dharmashastras played a vital role in establishing privacy laws in the Indian subcontinent, and monarchs were expected to uphold these principles.
Analyzing historical texts reveals that privacy was recognized and respected in ancient Indian society. For instance, Kautilya’s Arthashastra, written between 321 and 296 B. C. , provided a detailed framework to maintain confidentiality in ministerial consultations. From a historical perspective, privacy can be seen as a fundamental civil liberty essential for personal dignity and freedom. Moving forward to the 19th and 20th centuries, privacy became closely associated with the sanctity of one’s home and property. One of the earliest documents acknowledging this right was the Constitution of India Bill, 1895, which recognized a person’s home as an inviolable refuge. Later, the Commonwealth of India Bill, 1925, further emphasized protection from unwarranted intrusions. A similar concept was later reflected in the Nehru Report of 1928.
During India’s independence movement and the drafting of the Constitution, privacy was not explicitly included as a fundamental right. However, discussions on the matter took place within the Constituent Assembly. The formal drafting of the Constitution began in December 1946, and various committees were established to present recommendations to the Drafting Committee. At this stage, some sub-committees pushed for privacy to be recognized as a fundamental right. Eminent figures like K. M. Munshi, Harman Singh, and Dr. B. R. Ambedkar strongly supported its inclusion. Dr. Ambedkar’s draft included provisions that protected individuals from unwarranted searches and seizures, requiring judicial authorization for such actions. This proposal was reflected in the State and Minority Report. Over time, the Supreme Court of India has played a crucial role in shaping privacy rights.
Through various rulings, the judiciary has reaffirmed privacy as an essential aspect of the right to life and personal liberty under Article 21 of the Indian Constitution. Several landmark cases have contributed to elevating the right to privacy to its rightful status as a constitutional guarantee, ensuring its protection under Indian law. Now let’s discuss some of these cases that have discussed right to privacy and also those cases that have played an important role to provide Constitutional status to the Right to Privacy in India. 10 M. P. Sharma v. Satish Chandra11 Supreme Court held on the issue of ‘power of search and seizure’, that privacy cannot be brought under fundamental rights as it was something not related to the Indian Constitution. It was seen that the Supreme Court had a narrow interpretation in this case, limiting itself only to the prescribed statutory regulation.
Kharak Singh v. State of U. P. 12 A decade later, SC dealt with the issue that whether the surveillance under U. P. Police Regulation led to the infringement of fundamental rights or not and that did right to privacy come under fundamental right or not. The verdict denied that the right to privacy was a fundamental right and that it was not a guaranteed right under our Constitution and therefore the attempt to ascertain the movement of an individual merely in a way in which privacy is invaded is not an infringement of a fundamental right guaranteed under Part III of the Indian Constitution. And it however held that Article 21 (Right to life) was the repository of residuary personal rights and recognized the common law right to privacy. However in this case, Subba Rao, J. did say that privacy is a facet of Liberty. Govind v. State of M. P.
13 It upheld the validity of Madhya Pradesh Police Regulation Act of 1961, under reasonable restriction. The judicial approach was that there is an existence of right to privacy in terms of the different guarantees provided by Part III of the Indian Constitution. However, the Supreme 10 Sargam Thapa, The Evolution of Right to Privacy in India, 10 Int’l J. Human. & Soc. Sci. Invention, ser. 1, at
53 (2021), available at http://www.ijhssi.org/
11 M.P. Sharma v. Satish Chandra, A.I.R. 1954 S.C. 300 (India)
12 Kharak Singh v. State of Uttar Pradesh, A.I.R. 1963 S.C. 1295 (India)
13 Govind v. State of Madhya Pradesh, A.I.R. 1976 S.C. 1207 (India)
Court also observed that in the absence of legislative enactment, the right to privacy will necessarily have to go through a ‘case-by-case development’ because just one single case will be inadequate to see the exceptions and consequences of right to privacy. But one cannot deny the fact that this case did broaden the scope of Article 21 so that the right to privacy could fall into it. ADM Jabalpur v. Shivakant Shukla14 In this case before Supreme Court, Khanna, J. had observed: “Article 21 is not the sole repository of the right to personal liberty. No one shall be deprived of his life and personal liberty without the authority of laws follows not merely from common law, it flows equally from statutory law like the penal law in force in India. ” Maneka Gandhi v. Union of India15 Finally, in this case, Art. 21 of the Constitution were interpreted in a broader sense.
The Supreme Court stated that the term ‘natural law’ which included the right to personal liberty and rights of personal security were incorporated in Article 21 of the Indian Constitution. It was this case that saw a wide interpretation of the Fundamental Right called the Right to Life and it also helped the right to privacy to fall into the scope of Right to Life. R. Rajagopal v. State of Tamil Nadu 16 This was one of the first cases which elaborated the development and the span of right to privacy in a detailed manner. The apex court had held that the right to privacy was implicit to the right to life and liberty which Article 21 guaranteed. It further recognized that a citizen has a right to safeguard the privacy of his own, his family, marriage, procreation, motherhood, child bearing and education amongst other matters.
None can publish anything concerning the above matters without any consent and also that the right to privacy can be both an actionable claim and also a fundamental right.
14 R. Rajagopal Reddy v. Padmini Chandrasekharan, A.I.R. 1975 S.C. 1378 (India)
15 Maneka Gandhi v. Union of India, A.I.R. 1978 S.C. 597 (India)
16 R. Rajagopal v. State of Tamil Nadu, A.I.R. 1995 S.C. 264 (India)
People’s Union for Civil Liberties v. Union of India17 This case was related to phone tapping and so this case extended the right to privacy to communications. It was discussed that whether phone tapping could be considered as an infringement of right to privacy under Article 21 or not. The court also lay down regulations in terms of provisions in the country related to interception, like such orders were to be issued only by the home secretaries; necessity of the information was to be considered, etc. Further it capped two months onto the life of an interception order. The Supreme Court also stated that the question whether right to privacy could be claimed or not or has been violated in a given case would be depending on the facts of the said case. Selvi and others v.
State of Karnataka and others18 This Case made the Supreme Court to establish a difference between physical privacy and mental privacy and a connection between right to privacy and Article 20(3) (selfincrimination). Even though the criminal and evidence law provides the authority to interfere with the right to physical and bodily privacy in certain circumstances, but the same authority cannot be used to force a person "to impart personal knowledge about a relevant fact". It was also in this case that the intersection of the right to privacy with Article 20(3) (selfincrimination) was established. To make a statement is the result of a private choice of an individual's and so other individual should not have the scope to interfere with it.
To subject a person to various techniques such as narcoanalysis, polygraph examination and the Brain Electrical Activation Profile (BEAP) test might lead to the violation of the mental privacy of that individual if it is done without the consent of the individual. Justice K. S. Puttuswamy (Retd. ) & Anr. v. Union of India & Ors. 19 The verdict was the outcome of a petition challenging the constitutional validity of the Indian biometric identity scheme Aadhar. The question that was placed before the court was whether a right like right to privacy was guaranteed under the Constitution or not? Concisely, the one page order in this case, signed by all nine judges declares:
17 People's Union for Civil Liberties v. Union of India, A.I.R. 1997 S.C. 568 (India)
18 Selvi & Ors v. State of Karnataka & Anr, A.I.R. 2010 S.C. 1974 (India)
19 Justice K.S. Puttaswamy (Retd.) & Anr. v. Union of India & Ors., A.I.R. 2017 S.C. 4161 (India)
“The right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as a part of the freedoms guaranteed by Part III of the Constitution. ” The Court has unequivocally ruled that privacy has always been an inherent natural right, granting individuals the freedom to maintain control over their personal identity. The judgment highlights three key dimensions of the fundamental right to privacy: a) Personal/Physical Privacy – Protection against unwarranted intrusion into an individual's physical body. b) Informational Privacy – Safeguarding a person's mental space by allowing control over the dissemination of personal data and preventing unauthorized access by the State. c) Privacy of Choice – Ensuring autonomy in making fundamental personal decisions.
As Justice Nariman aptly explained, the first aspect pertains to an individual's bodily integrity, shielding them from unwarranted interference by the State. The second aspect, informational privacy, does not concern the physical self but rather a person’s thoughts, ensuring they have authority over their personal information and preventing its misuse. The third aspect upholds an individual's autonomy by safeguarding personal decision-making. These elements are interconnected and closely linked to human dignity, reinforcing the idea that privacy is essential to preserving an individual's self-respect and freedom. Privacy is an intrinsic aspect of every fundamental freedom enshrined in Part III of the Indian Constitution.
The Supreme Court has recognized privacy as an essential element of various fundamental rights, including the right to equality, freedom of speech and expression, and freedom of religion— all of which contribute to a dignified existence, subject to reasonable restrictions in the interest of public health, morality, and order. The Right to Privacy is not merely a tool for the State to regulate an individual's personal space but also a framework that enables the establishment of institutions to safeguard personal privacy. In today's digital age, privacy plays a crucial role in ensuring the meaningful exercise of freedom of expression. Recognizing the complexities involved, the Supreme Court has stressed the importance of enacting comprehensive legislation to protect the right to privacy. It acknowledged that the Government had already formed a committee, chaired by retired Justice B. N.
Srikrishna, in July 2017 to deliberate on a data protection framework. The committee’s report emphasized the need to balance citizens' rights and State obligations without undermining trade and industry. As a result, it proposed a draft for the Personal Data Protection Bill, 2019, aimed at establishing a robust legal framework for data protection in India. As a result of these due efforts, a fresh new law has been enacted by the Parliament on 11th August, 2023, i. e. the “Digital Personal Data Protection Act”, with the aim to protect he individuals from the breach of digital & informational privacy. V.
THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023
“The Digital Personal Data Protection Bill, 2023, which was introduced in Lok Sabha on August 3, 2023, by the Minister of Electronics & Information Technology has been passed by the Parliament i. e. , by Lok Sabha on August 7, 2023, and unanimously by Rajya Sabha on August 9, 2023; and has further received Presidential assent on August 11, 2023. The previous Personal Data Protection Bills of 2019 & 2022 being ascribed to numerous amendments, laced with several issues relating to data localization, transparency, compliance intensive, etc. , had been withdrawn by the Central Government. The said Bill came into being after the Supreme Court, in Justice K. S. Puttaswamy vs.
Union of India,20 upheld the ‘Right to Privacy’ as a part of the fundamental right-'Right to Life’ enshrined under Article 21 of the Indian Constitution and had suggested the CG to put in place an act/regime for protection of Personal Data. The primary objective of the Act is to establish a comprehensive framework for the Protection and Processing of Personal Data, as defined below: “The Act provides for the processing of digital Personal Data in a manner that recognizes both the rights of the individuals to protect their Personal Data and the need to process such Personal Data for lawful purposes and matters connected therewith or incidental thereto”. Below are the key highlights of the Act: Consent: It has been provided in Section 6 of the Act that Personal Data may be processed
20 Justice K.S. Puttaswamy (Retd.) & Anr. v. Union of India & Ors., (2017) 10 S.C.C. 1
only for the specified purpose and after obtaining the consent of the Data Principal (individual). Such consent has to be free, specific, informed, unconditional, and unambiguous with a clear affirmative action. Also, a notice must be given by the Data Fiduciary before seeking consent, containing details about the Personal Data to be collected and the purpose of processing. Rights and Duties of Data Principal: An individual whose data is being processed shall have certain rights as per Sections 12 to 14 which include the right to: (i) obtain information about processing, (ii) seek correction and erasure of Personal Data, (iii) nominate another person to exercise rights in the event of death or incapacity, (iv) for any grievance redressal and (v) withdraw her consent at any time during or after the processing of Personal Data.
Further, as per Section 15, Data Principals will be duty-bound and under an obligation not to: (i) register a false or frivolous complaint; (ii) suppress any material information while providing her Personal Data; and (iii) furnish any false particulars or impersonate in specified cases. The breach of said duties will attract a penalty as per the Schedule to the Act. Transfer of Personal Data outside India: Section 16 allows extraterritorial processing and transfer of Personal Data, except to such countries restricted by Central Government through notification. Data Protection Board of India: Central Government shall, in terms of Chapter V of the Act, establish a Data Protection Board of India, consisting of a Chairperson and other members. The Board will exercise and perform such powers and functions laid down in Sections 27 and
28 of the Act, which inter alia includes:
(i) directing urgent remedial/mitigating measures in case of any breach of Personal Data (ii) inquiring into such breach and (iii) imposing penalties as per the Act. Appeals: The Appeals against the decisions of the Board shall, as per Section 29, lie with the Telecommunications Dispute Settlement and Appellate Tribunal (TDSAT) established under the Telecom Regulatory Authority of India Act, 1997 (TRAI Act). Further, the Orders passed by TDSAT shall be appealable before the Hon’ble Supreme Court as per Section 18 of the TRAI Act. ”21 In this way, there are many more features which are present in the new legislation that deals with the protection of digital personal data of individuals living in our country. So, it’s a huge relief that finally the Indian legislature has made a particular & comprehensive law for the protection of privacy of individiuals.
But, yet there is a long for the effective implementation of this baby law. Moreover, this law only protects the breach of digital or informational privacy, so there is scope of enactment of more legislation that would be applicable comprehensively on all kinds of privacy violations. VI.
COMPARATIVE
ANALYSIS
OF STATUS OF RIGHT TO PRIVACY IN OTHER NATIONS The right to privacy is a fundamental human right recognized across the globe, albeit with varying degrees of implementation and enforcement. While some countries have robust legal frameworks to protect personal privacy, others struggle with ambiguous or inadequate regulations. This analysis explores how different nations approach privacy rights, examining their legal provisions, enforcement mechanisms, and challenges in safeguarding personal information. United States In the United States, the right to privacy is not explicitly mentioned in the Constitution but has 21 Ishwar Ahuja & Sakina Kapadia, Digital Personal Data Protection Act, 2023- A Brief Analysis, Bar & Bench (Aug. 22, 2023), https://www. barandbench. com (last visited Oct.
4, 2023, 6:04 PM) been inferred through various amendments, particularly the Fourth Amendment, which protects against unlawful searches and seizures. Landmark judicial decisions, such as Roe v. Wade, 410 U. S. 113 (1973)22, and Griswold v. Connecticut, 381 U. S. 479 (1965)23, have further established privacy as a constitutional right. Additionally, statutes like the Privacy Act of
197424 and the Electronic Communications Privacy Act (ECPA) provide regulatory
frameworks for data protection. However, concerns about mass surveillance programs run by agencies such as the NSA raise questions about the balance between national security and individual privacy. European Union The European Union (EU) has one of the most comprehensive privacy protection frameworks in the world. The General Data Protection Regulation (GDPR), enacted in 201825, sets strict guidelines on data collection, storage, and processing. It ensures individuals have the right to access, rectify, and erase their personal data. GDPR imposes heavy penalties on organizations that fail to comply, making it one of the strongest regulatory models globally. EU member states also have constitutional provisions that uphold privacy as a fundamental right, reinforcing their commitment to data protection.
United Kingdom The United Kingdom, although no longer part of the EU, still follows GDPR principles through the UK Data Protection Act 2018. The law governs how personal data is used by businesses, organizations, and the government. The Investigatory Powers Act 2016, however, grants intelligence agencies extensive surveillance powers, leading to debates over the extent of governmental oversight. Despite these concerns, the UK remains one of the most privacyconscious nations with strong legal safeguards in place. India India has recently made significant strides in privacy protection. The landmark Supreme Court
22 Roe v. Wade, 410 U.S. 113 (1973)
23 Griswold v. Connecticut, 381 U.S. 479 (1965)
24 Privacy Act, 5 U.S.C. § 552a (1974)
25 General Data Protection Regulation, Regulation (EU) 2016/679
judgment in Justice K. S. Puttaswamy (Retd. ) v. Union of India, (2017) 10 SCC 126, recognized privacy as a fundamental right under Article 21 of the Indian Constitution. Following this, the Digital Personal Data Protection Act, 2023, was enacted to regulate the processing of personal data, ensuring compliance with privacy norms. However, challenges remain, especially regarding state surveillance and data localization requirements. China China has a complex relationship with privacy. While the Personal Information Protection Law (PIPL), enacted in 202127, establishes strict data protection rules akin to the GDPR, the government retains significant control over personal information. The state's extensive surveillance network, including facial recognition and online monitoring, raises concerns about individual privacy.
In China, privacy laws primarily regulate corporate data practices, while government access remains largely unrestricted. Canada Canada's privacy framework is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA)28, which ensures the protection of personal information in the private sector. Provinces such as Quebec have additional privacy laws that offer stronger safeguards. Canada maintains a balanced approach, allowing government oversight while ensuring individual rights are not excessively curtailed. However, concerns have arisen regarding data-sharing agreements with the United States under intelligence-sharing alliances such as the Five Eyes. Australia Australia has enacted the Privacy Act 198829, which regulates the handling of personal data by government agencies and private entities.
The Notifiable Data Breaches scheme mandates organizations to inform individuals of data breaches that may affect them. However, laws such as the Telecommunications and Other Legislation Amendment (Assistance and Access) Act
26 Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1
27 Personal Information Protection Law of the People's Republic of China (PIPL), 2021
28 Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (Can.)
29 Personal Information Protection Law of the People's Republic of China (PIPL), 2021. [^8] Privacy Act 1988 (Cth) (Austl.)
2018 grant authorities the power to access encrypted communications, raising concerns about
privacy erosion. Brazil Brazil has strengthened privacy protections through the Lei Geral de Proteção de Dados (LGPD), which was inspired by the GDPR. The law applies to all personal data processing activities and grants individuals rights over their information. Enforcement mechanisms include the National Data Protection Authority, which monitors compliance. However, Brazil faces challenges in full implementation due to infrastructural and administrative limitations. Russia Russia has stringent data protection laws but also engages in significant state surveillance. The Federal Law on Personal Data requires companies to store Russian citizens’ data on servers within the country, ensuring state control over data. The government's expansive monitoring capabilities, including internet censorship and social media tracking, have led to concerns over privacy violations.
South Africa South Africa has implemented the Protection of Personal Information Act (POPIA)30, which sets out conditions for the lawful processing of personal data. The law aligns with international privacy standards and aims to enhance data protection rights. However, challenges persist in enforcement, particularly in rural and underdeveloped areas where digital literacy is low. In this way, The right to privacy varies significantly across nations, shaped by legal traditions, political systems, and technological advancements. While countries such as the EU, Canada, and Brazil emphasize strong legal protections, others like China and Russia maintain stringent state control over personal data.
As digitalization continues to evolve, the global conversation around privacy rights will remain dynamic, requiring continuous adaptation of legal frameworks to balance security, innovation, and individual freedoms.
30 Protection of Personal Information Act 4 of 2013 (S. Afr.).
VII. INTERNATIONAL CONVENTIONS & PROVISIONS OF RIGHT TO
PRIVACY IN INDIA The right to privacy is a fundamental human right recognized globally, ensuring protection from unwarranted intrusion by individuals, corporations, and governments. Various international frameworks, such as the UDHR, ICCPR, and GDPR, establish privacy safeguards, while national laws like India’s Digital Personal Data Protection Act, 2023, aim to regulate data security. However, enforcement challenges persist, highlighting the need for stronger legal mechanisms to protect personal information in an evolving digital landscape. Following are some Internation Conventions, Covenants & Provision that embraces “Right to Privacy” at global stage. The Universal Declaration of Human Rights (UDHR), 1948 The UDHR recognizes the importance of safeguarding an individual’s privacy from arbitrary interference by the state.
It upholds that personal matters, including privacy within one's home, family, and correspondence, should not be subjected to unwarranted intrusion. The International Covenant on Civil and Political Rights (ICCPR), 1966 Under the ICCPR, individuals are protected from arbitrary interference in their personal and family life, home, and correspondence. The covenant also ensures that a person’s honor and reputation are safeguarded against undue harm or infringement. The UNGA Resolution on Privacy in the Digital Age and the UNHRC General Comment (1988) The United Nations General Assembly adopted a resolution on December 18, 2013, emphasizing the necessity for legal oversight in state surveillance activities.
Similarly, the United Nations Human Rights Committee (UNHRC), in its 1988 General Comment on the right to privacy, stated that laws must be clearly defined and structured to ensure adequate protection against privacy violations. These resolutions stress that legal frameworks should be transparent and must uphold the right to privacy without unjustified governmental encroachment.
Guidelines of the Organisation for Economic Cooperation and Development (OECD) Established in 1961 as a consortium of 30 member states, the OECD formulated eight fundamental principles for data protection in 1980, which were later endorsed by the UK in
1981 These principles include
Collection Limitation Principle: Personal data must be gathered through legal and fair means, ensuring the individual's consent is obtained. • Data Quality Principle: Information collected must be accurate, relevant, and kept upto-date for its intended purpose. • Purpose Specification Principle: The purpose for which personal data is collected must be explicitly defined at the time of collection, and its use should be restricted accordingly. • Use Limitation Principle: Personal data should not be utilized beyond its specified purpose unless consent is granted by the individual or mandated by law. • Security Safeguard Principle: Proper security measures should be in place to prevent unauthorized access, misuse, modification, or destruction of data.
• Openness Principle: Transparency regarding personal data processing should be maintained, and details of the data controller should be publicly available. • Individual Participation Principle: Individuals must have the right to access their data, verify its accuracy, and request corrections where necessary. • Accountability Principle: The entity handling personal data is responsible for ensuring compliance with these principles. The Convention on the Rights of the Child (CRC), 1989 The CRC mandates legal protection for minors against any unlawful intrusion into their privacy. Countries that have ratified this convention are required to implement laws safeguarding children’s privacy. In India, legal provisions exist to protect minors’ identities,
particularly in cases involving juvenile offenders and victims of abuse. However, certain exceptions apply where privacy laws do not extend to minors under specific circumstances. The General Data Protection Regulation (GDPR) The GDPR, enacted by the European Union in 2016 and implemented in 2018, is one of the world’s most stringent privacy regulations. Its primary objective is to strengthen digital security and give EU citizens control over their personal information. Though the GDPR is an EU law, its influence extends globally, affecting any organization that processes data of EU residents. Chapter 3 of the GDPR enumerates the rights individuals possess concerning data privacy, imposing strict obligations on organizations to uphold these rights. Non-compliance with these regulations can lead to substantial financial penalties.
Data Protection in India India has recently taken legislative steps toward privacy protection by enacting the Digital Personal Data Protection Act, 2023. While this law provides a legal framework for data privacy, concerns remain regarding its effective implementation, especially given the challenges posed by rapid digitalization, globalization, and rising cyber threats. Ensuring strict enforcement of this law will be a significant challenge for the Indian government. Additionally, India has existing legal provisions under the Information Technology Act, 2000, supplemented by the IT (Reasonable Security Practices and Procedures and Sensitive Personal Information) Rules, 2011.
These regulations primarily safeguard sensitive personal data, such as: • Passwords • Financial details • Medical history and biometric data • Physical, physiological, and mental health conditions • Sexual orientation The protection under this law primarily applies to data managed by corporate entities, including banks, telecommunications companies, and healthcare institutions. However, information available in the public domain does not fall under the definition of "sensitive personal data. " Despite these advancements, India currently lacks a dedicated legislative framework that comprehensively protects other facets of privacy, such as decisional privacy (personal decision-making autonomy) and physical privacy (protection from unwarranted physical intrusions).
The country still has significant progress to make in ensuring comprehensive privacy safeguards that align with global standards. Hence, it is evident from the comparative analysis of other countries status on privacy laws that the effective implementation of the detailed & comprehensive legislation is urgently needed for the sake of safeguarding the fundamental right to privacy of individuals in India. VIII.
CONCLUSION & SUGGESTIONS
This analysis has provided an in-depth understanding of privacy as both a concept and a fundamental right. We traced its recognition under Article 21 of the Indian Constitution and examined its evolution through landmark Supreme Court rulings. Additionally, a comparative assessment of privacy laws across various nations—including Germany, the United States, Brazil, the European Union, Sweden, Canada, Australia, and Japan—highlighted diverse approaches to data protection and individual privacy. The COVID-19 pandemic accelerated the shift towards digital dependency, with virtual workspaces, online education, e-courts, and digital conferences becoming the norm. This surge in digital interactions heightened the risks of data breaches and unauthorized surveillance, reinforcing the urgent need for robust privacy safeguards.
In response, India enacted the Digital Personal Data Protection Act, 2023, a significant step toward strengthening data privacy. However, its success hinges on effective implementation and strict enforcement. To ensure meaningful protection of privacy rights, additional measures must accompany the enforcement of the Act: • Public Awareness & Education: Citizens must be informed about their privacy rights and the importance of data protection.
Data Protection Authority: An independent regulatory body should be established to monitor compliance and address violations. • Strict Legal Consequences: Severe penalties must be imposed for breaches to deter misuse of personal information. • Transparency & Accountability: Internal safeguards for data processing should be reinforced while ensuring independent oversight mechanisms. • Informed Consent Framework: Rather than a blanket "I Agree" option, users should have the ability to opt out of specific data processing activities, similar to GDPR provisions. • Data Minimization Principle: Inspired by Germany’s model, only essential data should be collected and retained. • Infrastructure Enhancement: Technological and administrative improvements are crucial for the seamless execution of privacy regulations.
At this critical juncture, India's ability to uphold privacy rights depends on how well it translates legislative intent into practical enforcement. If implemented efficiently, the Digital Personal Data Protection Act, 2023, could redefine India’s privacy landscape, fostering a secure digital environment while upholding individual dignity and autonomy in an increasingly data-driven world.
BIBLIOGRAPHY
Books or Sciptures Referred: • Dr. J. N. Pandey, Constitutional Law of India, Central Law Agency, Prayagraj, 59th Edition, 2022. • Ramanarayan Dutta Shastri Ram (translated by), Valmiki Ramayana, Yudha Kand, p. 1412 • Shreepad Damodar Satavalekar (ed. ), Mahabharata, Adi Parva, p. 1000 • Hargovind Sastri (ed. ), Manusmriti, p. 276. Statutes Referred: • The Constitution of India, 1950 • Indian Penal Code (Act No. 45 of 1860) • Information Technology (Act No. 21 of 2000) • IT (Reasonable Security Practices and Procedures and Sensitive Personal Information) Rules, 2011 • The Digital Personal Data Protection Act, 2023 (Act No.
22 of 2023) • The Universal Declaration of Human Rights, 1948 • The International Covenant on Civil & Political Rights, 1966 • Guidelines of Organisation for Economic Cooperation & Development, 1980 • Convention on the Rights of the Child, 1989 • The General Data Protection Regulation, 2018 • Privacy Act, 5 U. S. C. § 552a (1974)
Personal Information Protection Law of the People's Republic of China (PIPL), 2021 • Personal Information Protection and Electronic Documents Act, S. C. 2000, c. 5 (Can. ) • Personal Information Protection Law of the People's Republic of China (PIPL), 2021. [^8] Privacy Act 1988 (Cth) (Austl. ) • Protection of Personal Information Act 4 of 2013 (S. Afr. ). • The Data Protection Directive, 1995 • European Convention on Human Rights, 1950 Articles referred: • Sargam Thapa, The Evolution of Right to Privacy in India, 10 Int'l J. Humanities & Soc. Sci. Invention (IJHSSI), No. 2, Series-I, Feb. 2021. • E. J. Hutton, The Right of Privacy in the United States, Great Britain and India, in Comparative Human Rights (Richard P. Claude ed. , 1976). • Ishwar Ahuja & Sakina Kapadia, Digital Personal Data Protection Act, 2023- A Brief Analysis, Bar & Bench, Aug. 22, 2023, available at barandbench. com.
Websites referred: • https://indiankanoon. org • https://www. oneindia. com/ • http://www. ijhssi. org/ • https://www. indianexpress. com • https://www. iasexpress. net/ • https://www. barandbench. com/