SC rules that the Right to Privacy is a fundamental right; analysts expect stronger data privacy laws

The Right to Privacy is now a fundamental right.

A nine-judge bench of the Supreme Court pronounced this verdict on Thursday morning. It was a unanimous decision with all the nine judges in favour of the Right to Privacy. The constitutional bench headed by Chief Justice JS Khehar ruled that "right to privacy is an intrinsic part of Right to Life and Personal Liberty under Article 21 and entire Part III of the Constitution."

Supreme Court of India

Supreme Court of India. Image: Mohit Singh

The ruling was meant to deal with a batch of petitions that challenged the Centre's move to make Aadhaar mandatory for availing benefits of various social welfare schemes. While the Centre said that the right to privacy wasn't a fundamental right, the petitioners contended that the commercial use of citizens' biometrics and personal data was a breach of privacy. While the judgment given out today was related to privacy, the questions around Aadhaar's privacy debates will be dealt with by a separate five-judge bench which has been hearing the petitions since 2015.

According to Mishi Choudhary, technology lawyer and director at SFLC.in, this judgement does not make Aadhaar irrelevant. "It is certainly not a death knell for Aadhaar. But there were a lot of points related to the Aadhaar Act, which many people were not comfortable with. This judgement, gives more impetus to those who had challenged the Aadhaar scheme," says Choudhary.

Greyhound Research's Sanchit Vir Gogial says that the case against UIDAI is a separate one and there may be a chance that this judgement might not impact that case. "We are yet to find out the specifics on data exclusions and limitations and we can well expect instances where the government is allowed to collect personal data," says Gogia.

For those wondering if this judgement will have a direct effect on data sharing with private companies or websites, it won't. At least not in the immediate future, as we don't have a data privacy law to begin with. According to Gogia, since India does not have a forward-looking Data Privacy act, companies such as Google and Facebook will not be affected severely.

"With consumer apps flooding the market, consumers rarely read the fine print and there is no work around regarding that. Since the consumer is willing to share their information. Personal data is already out via the API exposures allowed by consumers on their mobile apps — again, an area where this opt-in (not often understood or termed as that) overrides any new judgement," says Gogia.

"Fundamental Rights are not applicable against private parties, but only against the state or local authorities according to Article 12. For instance, you can't go to court saying that a website which collects your private data is violating your fundamental right," says Choudhary.

But having said that, the judgement certainly gives incentives to work towards a strong data privacy policy. "There will be a need to set up appropriate and detailed standards of care regarding what is done with your data and how it is used. There is already a Data Protection Bill in consideration. Legislation will be required to implement the fundamental rights, so that in the future even private parties are subjected to regulation," says Choudhary.

Gartner research director DD Mishra believes that this is a landmark judgement in the sense that it will trigger a lot of change and will accelerate the process of creation of data privacy laws. "The judgement should also speed up creation of strong data privacy laws. It will have wider ramifications with the government having to come up with policies, regulations and laws to complement this right of privacy for individuals. Even the consequences of violating the right should be thought out," said Mishra.

According to Mishra, the judgement will affect government bodies or projects collecting personal data. So things such as public CCTV surveillance data gathering, direct marketing, cybersecurity programs, medical industries which collect medical data and so on will be affected.

"It may also affect various initiatives such as smart city or IoT-related projects which gather customer information and gain insights from it. There will be ramifications on on-going projects and future projects will have to take this judgement into consideration and ensure the right measures are taken. There will definitely be higher investments in the security and compliance sectors going forward. The judgement should improve our sense of security as there will be an added pressure to protect data," feels Mishra.

While protection of data is one thing, Mishra feels that there should also be provisions for an oversight committee to monitor how the privacy is being taken care of by public or private institutions.

The 547-page long judgement will throw up a lot more insights in the coming days. But one thing is certain, the judgement is quite a pertinent one in the technologically driven world we are living in. In some way, it puts India on par with countries such as the US, UK, EU where you have strong privacy laws.

Choudhary feels that there is a lot of work still to be done, but it's a good start. "What the Supreme Court has done, is opened a dialogue for creating the framework for recognising privacy as an eco-system. This will definitely help us in framing data privacy laws and making them part of the legislation. It will encourage setting up of detailed rules as to how even governments will deal with user data."


Published Date: Aug 24, 2017 03:24 pm | Updated Date: Aug 24, 2017 03:36 pm