Journal of Positive School Psychology http://journalppw.

com
2022, Vol. 6, No. 3, 5785–5790

Right To Privacy In India: The Technical And Legal Framework

Dr. G. Mallikarjun, B. Md. Irfan
Asst. Professor of Law, Dept., of Law, Nalsar University of Law, Hyderabad.
2
System Analyst, IT Dept, Nalsar University of Law, Hyderabad.

Abstract

‘Data Protection’ and ‘Privacy’ of the individuals are inseparable and inalienable. If
key data belonging to an individual or an organization is not secured and is easily
accessible to the public, it raises concerns of intrusion of privacy. Thus, personal data
of every individual should be protected and should not be made accessible to the
public. Data protection is a method of legally safeguarding an individual’s or any
organization’s information in the virtual world of communication and the internet.
With the passage of the Information Technology Act of 2000 and a subsequent
revision, India has officially recognised the need of data privacy protection.
Considering that India's existing laws on data protection and other related issues, such
as the IT Act of 2000 and the Information Technology (Reasonable Security Practices
and Procedures and Sensitive Personal Data or Information) Laws of 2011, fail to
provide adequate remedies, the Personal Data Protection Bill 2019 was introduced in
the Lok Sabha on December 11, 2019, and has since been passed. The privacy of the
individual, in the present digital world, is continuously at stake on account of the
various e-surveillance methods, interception of digital communication, and the
collection of personal data in various forms at various stages by various agencies.
Therefore, the author in this paper makes an attempt to highlight the issues like
surveillance, censorship and the interception of digital communications and its effects
on the right to privacy and to what extent the present Bill will protect the personal data
and safeguard the privacy of the individual.

an individual without the knowledge and the

Introduction: consent of the said individual using a number of
techniques like data mining, clustering,
Right to Privacy vis-à-vis Protection of geotagging and geocoding. The information
Personal Data: which is collected can used to send unsolicited
business advertisements or be used for their
Since personal information can be accessed by a personal ends.
variety of people and for a variety of purposes in
the digital age, it is extremely difficult to In fact, with the advent of the 21st century, with
maintain privacy and protect personal data. For an increase in technological development,
example, by the state for surveillance or even by privacy concerns against new technologies
private business entities for the revenue seemed to multiply.As a result, it is possible to
generation.People's personal information, such say that new technologies make personal data
as their name and contact information as well as more accessible and communicative. Therefore,
their likes, dislikes, habits, and hobbies, as well it is critical to have a powerful and reliable data
as their medical and financial histories, are all protection regulatory framework in order to
publicly available on the internet, and companies ensure consistency between innovation and the
like these take use of this to increase their preservation of privacy.. When it comes to
profits. In addition to this information which is personal data, there are always tensions between
voluntarily put out on the internet, there are what should be kept private and what should be
some other ways to access the personal data of made public. Privacy is one of those legal

© 2021 JPPW. All rights reserved

Dr. G. Mallikarjun, et. al. 5786

concepts that can take on a wide variety of it offers strong protection as it is portable and
appearances depending on the context, the time naturally available offline making it safe from
of day, the issue under discussion, and even who network based attacks.
is bringing the case.
In addition to these methods however, an
Principles of Data Protection organization can use a technology known as a
“mirror” which creates an “image” of a specific
As the amount of data being created and stored site or file so as to make it available in more
continues to expand at unprecedented rates, the than one location. In any case, the practice of
need for data protection is becoming more data backup on the cloud is gaining increased
critical. When it comes to data security, we're acceptance and is now commonplace. Often,
talking about preventing sensitive information backup data is moved to a cloud-based
from being lost, damaged, or accessed by repository or to a public cloud. Local discs and
unauthorized parties. In today's highly advanced libraries can be replaced or protected data can be
and frantic new world, it is critical to save and added to these backups. The process of creating
retain all of your important data. Data is data backups is an extremely important function
becoming more valuable as new technologies to effective protect data. Current technological
emerge and new use cases are established, advancement has meant that backup has moved
resulting in a greater need to preserve and from an independent activity to an integrated
safeguard this information. Protecting data and component of other activities to conserve storage
making it accessible in any situation is the as well as reduce expenses. Modern backup data
fundamental goal of information security protection involves the use of a built-in system
measures. Both data backup and business that adds or exchanges backups and protects
continuity/disaster recovery are technically against potential problems.1
referred to as "data protection" (BCDR). It's
becoming increasingly difficult to protect data in In the current day and age, data is all pervasive
two ways: through acquisition and through and has become an indispensable component in
management. We're talking about two distinct almost every activity. Data is generated and
but intertwined concepts here: lifecycle and data shared as a consequence of most of our day to
management. Life cycle management is an day activities including traveling, ordering food
automated procedure that moves critical or even purchasing anything. This places a high
information between online and offline storage. value on this data which is not often recognized
It's a complete approach for measuring, and several persons and organizations have
cataloguing and protecting information assets found ways to utilize this data which highlights
against operating and user errors, malware and the need for data protection and digital privacy.
viral attacks, system failures or breakdown and
interruption. Right to Privacy in India: The Legal
Framework
Data Storage and Protection: Technological
Frame work Constitutional texts across the world provide for
privacy protection in one form or the other. The
Data backup plays an important role in ensuring most notable examples of these are the US
that data continues to remain available. To this Constitution’s Fourth Amendment,2On the
end, a number of storage technologies are International Covenant on Civil and Political
available. These include the creation of a backup Rights and on the European Covenant on Civil
copy of a disk or an alternative tape based and Political Rights (Article 17 and Article 8).
device whose purpose is to copy specific
information to an offline storage device for
storing it securely. Although this mechanism has
1
the drawback of being time consuming and slow, Ibid.
2
The Constitution of the United States. amend. IV.

© 2021 JPPW. All rights reserved

5787 Journal of Positive School Psychology

Human Rights.3 Even at its lowest point in understand the Article 21and how it articulates
American constitutional jurisprudence, the right the right to privacy in the context of use of
to privacy was said to be a part of the Bill of internet. This is because the ruling in Gobind
Rights’ penumbra, if not an integral part or a directly challenges the foundations of the most
substantive right on its own.4 invasive elements of India’s national security
apparatus. One such feature is the retention of
In India, however, privacy jurisprudence has communications metadata by service providers
taken a different line of evolution altogether. for a period of two years.8 Another is Netra, a
While it has been dealt with in a wide variety of mass surveillance programme that gives security
constitutional as well as sub constitutional agencies the ability to collect and store all
contexts 5, the fact remains that on its own, communications data (as well as metadata)
privacy is almost alien to the Indian judicial flowing through India’s internet infrastructure.
imagination. While other jurisdictions can claim Gobind, by following the tradition of Kharak
to source the right to privacy from a concrete Singh before it, laid down strict limitations upon
text, India cannot. The best way out of this the targeted surveillance of an individual by
quagmire so far has been an expansive police officers. If targeted surveillance of an
interpretation of Article 21, which mandates that individual based on a probable cause or a
the right to life and personal liberty can only be criminal record requires such standards to be
taken away by a lawfully established procedure. followed, there can be no question that even
Indeed, Indian law has a fairly rich history of more stringent due process constraints must be
attempting to create a somewhat robust right to in place for the collection and storage of data en
privacy from Article 21. The first real “privacy” masse from every single internet user in the
cases in Indian constitutional law relate to the country.
police surveillance of individuals with criminal
records (“history sheeters”). In Kharak Singh v. Thus, at first glance, it would seem that Kharak
State of Uttar Pradesh,6 the petitioner claimed Singh and Gobind have established a right to
that police surveillance, and specifically night- privacy within the Indian constitution through
time house visits, of history sheeters was the Article 21 route. However, my thesis is that
violative of Article 21. Citing American such a right, even if it does exist, isn’t nearly
jurisprudence extensively, the Supreme Court robust enough to stand the test that pervasive
held that a right of privacy was implicit in internet surveillance poses. I argue that this is
Article 21’s guarantee of personal liberty. because of the inherent limitations that plague
the Article 21 articulation of the right to privacy,
Next in line was Gobind v. State of Madhya and that these limitations have been highlighted
Pradesh,7 in which the Supreme Court by the manner in which the Supreme Court has
encountered another instance of visitation and treated the ways in which the right to privacy
harassment by the police against a history can be infringed upon by the state.
sheeter. Gobind is an important case to
The biggest limitation of an Article 21 right to
3 privacy is that the provision and its
Council of Europe, European Convention for the
Protection of Human Rights and Fundamental jurisprudence are fundamentally at odds with the
Freedoms, as amended by Protocols Nos. 11 and 14, framework of the privacy debate. In today’s
1950, art.8. world, privacy has been couched as an
4
Griswold v. Connecticut, 381 US 479 (1965). individual, collective or human right that states
5
R. Rajagopal v. State of Tamil Nadu, (1994) 6 SCC have an obligation to protect, except when faced
632 for example, discusses the right to privacy in the with grave national security concerns. The
context of civil wrongs committed by private parties privacy v. security debate is of such a nature that
against one another, rather than in the context of states, when violating the privacy of their
constitutional commitments of a state towards its
people.
6 8
1964 SCR (1) 332 AnirudhRastogi, Cyber Law: Law of Information
7
(1975) 2 SCC 148 Technology and Internet 212 (LexisNexis 2014).

© 2021 JPPW. All rights reserved

Dr. G. Mallikarjun, et. al. 5788

citizens, routinely get away with heavy-handed The government then appointed a single expert
tactics in the name of the “national interest” (or commission under the leadership of Justice
some equally vague variant of the term). Srikrishna who was the previous judge of the
Last Resort in India, reviewing issues related to
The manner in which Article 21 has been en- data retention in India and specific
capsuled has led to real consequences in the recommendations needed to benefit the Central
privacy context, where in the ability/power of Government on the principles to be considered
state to restrict or abridge the privacy of citizen for data protection in India in the framework of
and the consequences thereof. In Gobind vs. the proposed data protection bill.
State of M.P.,9 the Supreme Court laid down the
test of compelling state interest or compelling There are other important legal provisions that
public interest. In theory, this was an attempt to focus on and regulate privacy protection and the
borrow an American constitutional principle10 provision of personal data
and adapt it to the Indian context in order to
emphasize that a “compelling” public interest However, data protection in India was achieved
required to take away an individual’s privacy through the provision under various laws and
would be a higher threshold than the state regulations apart from provisions of the
interest or public interest thresholds present in constitution,11 such as the following:
Article 19(2) or Article 19(5). Further, the
American doctrine of compelling state interest • Information Technology Act, 2000 - (aIt is
was accompanied by a requirement that any illegal for companies that deal with sensitive
infringement upon the right be tailored as personal information, such as credit card
narrowly as possible. Thus, an overbroad numbers or health records, to profit improperly
measure (the monitoring of all internet traffic or unfairly from that data. In accordance with
within the country, for instance) would Section 72-A, any service provider that discloses
immediately pose a constitutionality problem personal information about a person without
within this test. their consent or in violation of a legally binding
contract is subject to criminal prosecution.
The Growing Need for Novel Policy
• Telegraph Act, 1885 –The Central
India does not have a complete law that deals Government of India and the Provincial
with data protection and privacy. Existing Governments of India are governed by Sections
policies and regulations are, in fact, part of its 5 and 24 of the Indian Constitution, respectively.
core. These industry rules are a related provision
of that IT Act, 2000 and thus provide the rules • Telegraph Regulations, 1951- For the
governing the collection process, the use of such issuance of disconnection orders, Law 419-A
confidential information and sensitive sets up specific processes and criteria.
confidential information or the date by the
• Unlawful Activities Prevention Act, 1967 - If
companies' organization within India.
the responder is not given a copy of the
The government is regulating the development restraining order, the illegal communication
of some comprehensive laws that help regulate cannot be used as evidence.
privacy and data protection. Additional efforts
• Access to Information Act, 2005 – According
are needed in the process initiated by a team
to Section 8 (1 (j) of the Privacy Act, personal
formed by a privacy expert led by Justice A.P.
information that is not related to any public
Shah, a judge of the Delhi High Court, presented
his full report on October 16, 2012.
11
Constitutional protection in respect of the right to
privacy as a fundamental right under Part III of the
9
Supra n.12. Constitution as opined in the case of Justice K.S.
10
See, eg.,Grutter v. Bollinger, 539 US 306 (2003). Puttaswamy vs. Union of India (2017) 10 SCC 1.

© 2021 JPPW. All rights reserved

5789 Journal of Positive School Psychology

service or interest, or that could result in illegal Significant Features of the Bill
access to any privacy, is exempt from
disclosure.. Data collection and usage will be governed by
this legislation. Bill proposes to establish Data
• Postal Act, 1898 – Protection Authority in addition to creating
rights and obligations in relation to processing
Section 26 governs the acceptance of postal personal data (DPA). The DPA is responsible for
products by the Indian government at both the drafting and enforcing the rules of the game. The
federal and provincial levels. bill also provides the DPA a mandate to enforce
the law and gives the central government more
• Criminal Procedure Code, 1973 - Section 91 power to regulate itself.
regulates access to stored content.
A bill's most crucial feature is that it applies to
• Wireless Telegraphy Act, 1933 - Wireless all businesses in India, unless specifically
networks that are established, maintained or exempted by law. Any business that uses
operated for the aim of blocking, monitoring, or automated data collection methods will be
intercepting communication are illegal under affected by this. Based on income, portable data
Section 3 of the Act. volume, and data collecting objectives, (DPA
will be able to define small firms). This may
Locating the Data Protection Bill in the contain not only technological firms and e-
Context of Privacy Considerations commerce platforms, but also real estate
companies, banking contacts, vehicle dealers,
The PDP Bill has a big impact on how personal hotels, and restaurants. etc.. etc. Consent must be
information about Indian citizens is collected free, informed, and direct, with the option to
and used. Because there are no rules for private cancel it; this is the most critical condition. It is
or public businesses in India today. Section 3 illegal to process personal information without
(28) of the Bill says that "personal data" refers to the express authorization of the data subject. In
information that can be used to identify or addition, the Bill says that such data can only be
contact a person who can be found. People can used "with explicit permission." If you want to
use this definition to describe data that is online collect data from someone, you must give them
and off-line, as well as any combination of these enough information about what data is being
characteristics with other information. The Bill collected, why it is being collected, and what
is very important because it defines personal their rights and responsibilities as "data trustees"
data very well. are so that they can give their consent. This
information must be provided to the person
If the GDPR and other privacy rules have made being tracked (the "data principal").
a big difference in how the Data Protection Bill,
2019, is written, that's what it looks like. There are several exceptions to the notification
requirement, such as the provision of emergency
In the 1970s, there was a lot more privacy than medical or health care services in the event of an
there is now. That's why the rules aren't up to epidemic, a disaster, or a breakdown of public
date. In the 1970s, a report called "Records, order. Similar exemptions to permit
Computers, and Citizens' Rights" was written to requirements, including credit rating and the
deal with the rapid technological changes. recovery of pending debt, may also be granted
Organization for Economic Co-operation and by regulations.
Development rules on protecting privacy have
also been put into place for some of the most A fiduciary duty only comes into play when the
important suggestions on how to protect people's information is needed to reach the goal for
privacy, such as not collecting data without which it was gathered, and in full compliance
permission, making data processing visible, and with all applicable laws and rules. So, there are
giving people the right to change their data. rules about how and when data can be used and

© 2021 JPPW. All rights reserved

Dr. G. Mallikarjun, et. al. 5790

stored, so that's why. In addition, businesses that recognize the privacy of citizens as the ultimate
use privacy by design must use business goal of data protection law.
processes that can predict and avoid harm to
customers, comply with transparency In the end, any law is as good as the remedy it
requirements that include measures to stop data provides. None of the existing laws mentioned
misuse, and make sure that data isn't used above provide a legal remedy for correcting
without permission, as well as meet other unlawful state actions such as illegal intrusion /
requirements. surveillance into a person’s data and this aspect
must be addressed at the earliest. While there
Even the panel that came up with ideas for a seems to be growing regulation of the online
2019 bill on intermediary responsibility has world, protection of the data of individuals must
looked at it, too. Those who work for a company be prioritized and its misuse must be prevented
are being held accountable for what they do without compromising on the freedom of
under the Bill and other laws. For example, the speech.
Intermediary Guidelines and Digital Media
Ethics Code of 2021 say that media publishers
and OTT providers should be in charge of the
content they put on the internet. Consumer
Protection (Amendment) Rules of 2021 say that
e-commerce intermediaries will have to pay for
what other people do when they sell and buy
things from them. Under Section 79 of the
Information Technology Act, they were
previously free from liability for things like web
hosting services and search engines, as well as e-
commerce platforms and telecom service
providers. But because of this new law, they
could now be held liable for things like this.

There are questions about whether people can

say what they want and if they can be censored.
If you want to make sure that third parties who
have a lot of information don't use it in a bad
way, this could be a good start.

Conclusion:

In this present digital world, the need of

protecting the individual data is very much
needed. Thus, the efforts made in the Data
Protection Bill are commendable in striving to
establish a data protection system in India.
However, some of the provisions under the Bill
are not in consonance with the fundamental right
to privacy. The Bill, in the present form, does
not provide much protection to protect the right
to privacy. Interestingly, the Bill is in its strict
sense would not be able to provide the proper
system of checks and balances in monitoring and
protecting the data. Therefore, there is a need to

© 2021 JPPW. All rights reserved