The Digital Future

by Utkarsh Rai

In the winter session of the Lok Sabha, the government tabled the much-awaited Draft of the Data Protection Bill. The contents of the Bill have caused controversy among observers. Specifically, Section 35 of the Bill has raised alarm among observers because of the wide discretion that it grants to the executive, without setting down any criteria for this discretion. The Section notably allows the government to exempt any of its agencies from the ambit of the Bill, with this action only requiring a prior notification from the government.

In this regard, let us hypothesis the validity of such a Section if it remains on the Bill in its current form. For ease of analysis, let us reproduce Section 35 of the Bill in its current form.

 “Where the Central Government is satisfied that it is necessary or expedient, —

(i) in the interest of sovereignty and integrity of India, the security of the State, friendly relations with foreign States, public order; or

(ii) for preventing incitement to the commission of any cognizable offence relating to sovereignty and integrity of India, the security of the State, friendly relations with foreign States, public order,

(iii) it may, by order, for reasons to be recorded in writing, direct that all or any of the provisions of this Act shall not apply to any agency of the Government in respect of processing of such personal data, as may be specified in the order subject to such procedure, safeguards and oversight mechanism to be followed by the agency, as may be prescribed.”^[1]

Section 35 of the Bill lays down the exemptions under which the fundamental right to privacy under Article 21 of the constitution can be abridged. For this, let us briefly go back to the judgement of the court in KS Puttuswamy v Union of India^[2], which is the landmark judgement of the court with regards to the right to privacy and laid down the contours of this right as well as the principles to be followed in its restriction. The most basic, and simplest test, that any abridgement of Article 21 has to meet is that of the abridgement being “fair, just and reasonable”. In KS Puttuswamy^[3], Justice Bobde articulated this test:

“Under Article 21, the standard test at present is the rationality review expressed in Maneka Gandhi’s case. This requires that any procedure by which the state interferes with an Article 21 right to be “fair, just and reasonable, not fanciful, oppressive or arbitrary.”

A cursory look at the Section shows that there is no mention of fair, just & reasonable in the Section, with the agency free to prescribe any procedure for such actions.  This in itself is a major problem with the Section, since it grants the executive wide discretion to limit a data principal’s rights, without any mention of the standard safeguards that must also be in place to prevent abuse of these powers.

However, it has to be kept in mind that when it comes to privacy, the test for abridgement of the right is much narrower and more restrictive. This can be seen from the case laws dealing with matters of privacy, such as the case of Gobind vs State of MP^[4], as well as PUCL vs Union of India^[5]. This can be also be seen in the judgement, where one must point out that Justice Bobde’s articulation of the test under which privacy can be infringed under Article 21 being in the minority, with the other judges articulating more restrictive grounds for a limitation of the right to privacy under Article 21.

Let us first analyse the other judges understanding of the grounds under which the fundamental right to privacy can be restricted under Article 21. A common theme running through the different judges understanding of the grounds under which the privacy could be restricted was “proportionality”, and compelling state and public interest. This was to ensure that any grounds under which the right could be restricted were as narrow as possible and left no scope for abuse as a result of excessive discretion. In this regard, let us first look at extracts from the judgements of the different judges.

Justice Sapre, for example, articulated his own vision for grounds under which the right could be restricted:

“Social, moral and compelling public interest in accordance with law.” (emphasis supplied)^[6]

Justice Chandrachud, speaking for the plurality, also emphasised on the concept of proportionality:

“Proportionality is an essential facet of the guarantee against arbitrary state action because it ensures that the nature and quality of the encroachment on the right is not disproportionate to the purpose of the law.”

The concept of proportionality itself has been expanded upon by the Canadian Supreme Court in Andrews vs Law Society of British Columbia^[7]:

“The proportionality requirement, in turn, normally has three aspects:  the limiting measures must be carefully designed, or rationally connected, to the objective; they must impair the right as little as possible; and their effects must not so severely trench on individual or group rights that the legislative objective, albeit important, is nevertheless outweighed by the abridgment of rights.”

As can be inferred from the extracts of the judgement, the judges meant for any abridgements to the right to privacy to be narrow in its scope, and such that there was no scope for abridgements based on very vague objectives.

At this juncture, you could point out that the standards of proportionality as well as limited impairment of rights mentioned in these cases apply to the implementation of the law and are not required to be mentioned in the law itself. However, a cursory analysis of Chandrachud’s statement on proportionality in the judgement shows that this is because it was considered implicit that the law itself was framed in such a manner that these standards would be included in it. s we have seen from the wording of Section 35, that is not the case, in fact, the Section’s wording does not  even meet  the standards of the wider “fair, just and reasonable test”, let alone that of “proportionality”.

We shall now look at the PUCL v Union of India^[8] case, since the decision taken by the Court in that case is quite relevant to our scenario. Before we analyse this case, let us understand the context of the case. The case related to the increasing tapping of phones by the government, and the consequent increase in surveillance and violation of privacy that it brought about. In response, the government highlighted the validity of its actions in light of Section 5(2) of the Telegraph Act^[9], which gave the government wide discretion with regards to tapping the phones of individuals during “public emergencies” or in the interest of public safety if officials felt that such an action was necessary and expedient to ensure sovereignty and integrity of India, the security of the State, friendly relations with foreign states or public order or for preventing incitement to the commission of an offence. Thus, the key question in front of the court became the constitutional validity of Section 5(2) of the Telegraph Act. In this regard, the Court found that there were no rules framed under Section 5(2) of the Act for a procedure under which the Section could be exercised. On this point, the Court strongly reiterated that in the absence of a just and fair procedure regulating the exercise of the Executive’s power under Section 5(2), it was not possible to safeguard the rights of citizens guaranteed under Section 5(2) of the Act, it was not possible to safeguard the rights of the citizens guaranteed under Articles 19(1)(a) and 21 of the Constitution of India. This was further reiterated in the final order of the judgement, where the Court itself set down guidelines and safeguards under the Act, to ensure it fell within the exemptions granted to the State under Article 19(1)(a) and 21 of the Constitution of India, and requiring orders under the Section to come from either the Home Secretary of the Central or State Governments.

An analysis of the rest of the order would show certain key principles that flowed through the order and underlined the jurisprudence of the court with regards to wiretapping. Looking at the PUCL judgement, a few key themes that run through the rest of the order is the need for the authorities to consider whether the information sought through the order could be acquired through less invasive means. It also required any interceptions made under the order to be restricted to specific addresses, individuals and premises that were specified beforehand. The authority making the order has to keep a record of the intercepted communications, the extent to which the material was disclosed, copied, and number of copies made of the material, as well as the individuals to whom these communications were made. Again, it is obvious from the court’s order in the case that any intrusion into the person’s privacy could only occur under specific circumstances, and would have to be “proportionate” to its purpose. This understanding of privacy was further reiterated in the famous Puttuswamy judgement. It is thus safe to say that it is this understanding of privacy that is at the core of the Court’s jurisprudence in these matters and that any law regarding privacy must include procedural safeguards to ensure the wide powers of the executive under the clause could not be abused.  The PUCL case illustrates the thinking of the Court with regards to laws that impair the right to privacy in pursuance of other factors. It shows that when it comes to privacy, the judicial expectation for a section that limits privacy to be considered valid and legally sound is the presence of procedural safeguards along with the substantive provisions of the section. The primary question in front of the Court with regards to the PUCL case was whether a Section that gave the government wide discretion in applying its powers under it would be valid without procedural safeguards to ensure that those powers were not abused. The court, through its order, showed that it considered the presence of procedural safeguards to be necessary for any Section that entailed limitations on the fundamental right to privacy.

To briefly sum up the Court’s order, it essentially placed procedural safeguards into the clause to ensure that the wide powers of the executive under the clause could not be abused. The PUCL case illustrates the thinking of the Court with regards to laws that impair the right to privacy in pursuance of other factors. It shows that when it comes to privacy, the judicial expectation for a section that limits privacy to be considered valid and legally sound is the presence of procedural safeguards along with the substantive provisions of the section. The primary question in front of the Court with regards to the PUCL case was whether a Section that gave the government wide discretion in applying its powers under it would be valid without procedural safeguards to ensure that those powers were not abused. The court, through its order, showed that it considered the presence of procedural safeguards to be necessary for any Section that entailed limitations on the fundamental right to privacy.

The PUCL case involving phone tapping is analogous to the issues that could arise if the government, under the Data Protection Bill, is exempted from the normal restrictions on collecting data under loose criteria, as data in the 21^st century, just like phone tapping, can be used by the State to get a clear picture of an individual’s movements. The court’s order in the case, placing procedural safeguards into a Section with very loose criteria, also gives us a precedent as to what is considered valid when it comes to parts of legislation setting down criteria limiting privacy. From our earlier reading of Section 35 of the Bill, we already know that the section does not have any such procedural safeguards in place. Thus, the Section (if it remains in the final bill) would be clearly not valid constitutionally under the existing jurisprudence of the court with regards to privacy.

---

^[1] The Personal Data Protection Bill of 2019, Bill No. 373 of 2019, 17th Lok Sabha (2019).

^[2] K.S. Puttaswamy and Anr v. Union of India and Ors., 10 S.C.C. 1 (2017).

^[3] Ibid.

^[4] Gobind v. State of Madhya Pradesh, 2 S.C.C. 148 (1975).

^[5] People’s Union for Civil Liberties v. Union of India & Anr., 1 S.C.C. 301 (1997).

^[6] K.S. Puttaswamy and Anr v. Union of India and Ors., 10 S.C.C. 1 (2017).

^[7] Andrews v. Law Society of British Columbia, 1 S.C.R. 143 (Canada Supreme Court, 1989).

^[8] Ibid.

^[9] Indian Telegraphs Act, 1885, Act No. 13, Imperial Legislative Council, 1885, sec. 5 (2)