7th Anniversary Of Puttaswamy Judgment : Analysing Impact Of Privacy Right Declaration
Seven years ago, on 24th August 2017, 9 judges of the Supreme Court of India declared that the right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and is a part of the freedoms guaranteed by Part III of the Constitution. The genesis of the above declaration was a batch of writ petitions filed in 2012 in the Supreme Court challenging...
Seven years ago, on 24th August 2017, 9 judges of the Supreme Court of India declared that the right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and is a part of the freedoms guaranteed by Part III of the Constitution.
The genesis of the above declaration was a batch of writ petitions filed in 2012 in the Supreme Court challenging the constitutional validity of the UID (Aadhaar) Project and the January 2009 notification of the central government by which the Unique Identification Authority of India (UIDAI) was set up. Under an executive notification government began to collect fingerprints and iris scans of individuals. It had no statutory backing. Among several other grounds, the Petitioners contended that such collection of personal biometric details on a mass scale without prior informed consent violated the right to privacy. Appearing for the central government, the then Attorney General claimed that Indians had no fundamental right to privacy. He contended that the judgments in Gobind (1975), R. Rajagopal (1994) and PUCL (1997) that recognised such a right were contrary to the 1954 judgment of an 8 Judge Bench in M P Sharma v. Satish Chandra and a 1964 judgment of a 6 Judge Bench in Kharak Singh v. State of U.P. Realising that these decisions will have to be revisited, a 3 Judge Bench on 11th August 2015 referred the issue to a larger Bench.
Two years later the 9-Judge Bench, speaking polyvocally through 6 judges, delivered the landmark Privacy Judgment [Justice K.S. Puttaswamy (I) v. Union of India (2017)]. Nine privacy types merited recognition, among which were communicational privacy which enabled an individual to restrict access to communications or control the use of information communicated to third parties; and informational privacy which enabled an individual to prevent information about oneself being disseminated and to control the extent of access to such information. The Court held that the right to privacy was not absolute but emphasised that 'privacy is not lost or surrendered merely because the individual is in a public place. Privacy attaches to the person since it is an essential facet of the dignity of the human being'.
Meanwhile the Lok Sabha passed the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016 ('Aadhaar Act') as a Money Bill. The Rajya Sabha, which had expressed reservations about some of its provisions, was bypassed.
Soon thereafter, the hearing of the batch of petitions challenging the Aadhaar Act resumed before a 5 Judge Bench. Section 7 of the Aadhaar Act mandated that “individuals must provide proof of their Aadhaar number or undergo Aadhaar-based authentication to receive subsidies, benefits, or services.” Section 57 permitted private entities to commercially exploit personal data of individuals without their consent. Section 139 AA of the Income Tax Act that mandated linking of PAN with Aadhaar. The validity of all these provisions was questioned. Also challenged were the rules and circulars that permitted collection of biometrics of children; that mandated the linking of mobile numbers and bank accounts with Aadhaar. Also on board were contempt petitions arising out of the wanton disobedience by the government of the interim orders in which the Court insisted that Aadhaar should not be made mandatory. This was the first major occasion where the law and the principles enunciated in the Privacy Judgment would be put to test. The Supreme Court quite spectacularly failed that test.
On 26th September 2018 by a majority of 4:1 [Justice K.S. Puttaswamy (II) v. Union of India (2018)] ('the Aadhaar Judgment'), the Supreme Court substantially upheld the validity of the Aadhaar Act, held that it did not violate the right to privacy, condoned the brazen violations of its interim orders by the central and state governments. It was not a mere coincidence that none of the 4 Judges who constituted the majority were part of the 9 Judge Bench that delivered the Privacy Judgment while the lone dissenting Judge who held the Aadhaar Act and the Project to be unconstitutional was.
A reading of the majority judgment and of the dissent reveals diametrically opposite approaches. The majority accepted the government's plea that the Aadhaar Act could be passed as a Money Bill, whereas the dissent held it unconstitutional on the very ground that it did not satisfy the basic requirements of a Money Bill under Article 110 of the Constitution. Consequently, while the majority held Section 139 AA of the Income Tax Act mandating the linking of Aadhaar with the PAN to be valid, the dissent held it was not.
As regards Section 7 of the Act which made possession of a UID number a pre-condition to availing social welfare benefits and services, the majority saw it as an issue of 'balancing of two competing fundamental rights', the right to privacy on the one hand and the right to food, shelter and employment on the other. The majority held that enrolment in the Aadhaar Scheme “actually amounts to empowering these persons. The scheme ensures dignity to such individuals.” The dissenting judge saw it differently. He held that the inclusion of services and benefits in Section 7 is a precursor to the kind of 'function creep' which is inconsistent with privacy and informational self-determination. The broad definitions of the expressions 'services' and 'benefits' would enable government to regulate almost every facet of its engagement with citizens under the Aadhaar platform. The dissenting Judge asked: “Should the scholarship of a girl child or a midday meal for the young be made to depend on the uncertainties of biometric matches?” and answered: “Our quest for technology should not be oblivious to the country's real problems: social exclusion, impoverishment and marginalisation.” Further the dissenting judge concluded: “the absence of proof of an Aadhaar number would render a resident non-existent in the eyes of the State, and would deny basic facilities to such residents. Section 7 thus makes a direct impact on the lives of citizens. If the requirement of Aadhaar is made mandatory for every benefit or service which the government provides, it is impossible to live in contemporary India without Aadhaar. It suffers from the vice of being overbroad.” Adverting to the imminent financial exclusion, the dissent noted: “For an old age pensioner, vicissitudes of time and age obliterate fingerprints. Hard manual labour severely impacts upon fingerprints.”
Overlooking the UIDAI's own commissioned studies which spoke of considerable failure rates in authentication, the majority glibly accepted UIDAI's unverified claim (in a power-point presentation) of 99.76% accuracy of the biometric data. Applying the utilitarian logic, the majority asked: “if the Aadhaar project is shelved, 99.76% beneficiaries are going to suffer. Would it not lead to their exclusion?” This trading off one right against another was a constitutionally untenable proposition. The dissent on the other hand noted that the recorded failures of Aadhar Based Biometric Authentication had resulted in denial of food from ration shops particularly for the vulnerable groups such as widows, the elderly and manual workers. It had neither failed to reduce quantity fraud or the problem of missing names in ration cards, the identification of Antyodaya (poorest of the poor) households, or the arbitrary power of private dealers. It noted that poor internet connectivity was one of the reasons for authentication failures and eventual exclusion.
On the crucial aspect of data protection, the majority noted that after they had reserved judgment, the Justice Srikrishna Commission had submitted a report in July 2018 containing a draft Personal Data Protection Bill. It hoped that the law would be in place 'very soon'. The dissent noted that the UID number was being seeded into every database; it had become a bridge across discreet data silos, allowing anyone with access to the information to re-construct a profile of an individual's life. Also, prior to the enactment of the Aadhaar Act in 2016, the biometric data of several millions of persons had been collected without their consent and handed over by the UIDAI to L-1 Identity Solutions with which it had a contract for managing such data. L-1 Identity Solutions was a foreign entity which specialized in selling face recognition systems, electronic passports, and other biometric technology to the U.S.A and Saudi Arabia. In 2011 it was acquired by Safran, a French multinational aerospace and defence corporation. In the end, the dissent found the wilful violation of the Court's interim orders by the government to be inexcusable.
The harsh truth spoken with clarity in the dissenting judgment was this: “the linking of the Aadhaar number to different databases is capable of profiling an individual, which could include information regarding her/his race, religion, caste, tribe, ethnicity, language, records of entitlement, income or medical history. Thus, the impact of technology is such that the scheme of Aadhaar can reduce different constitutional identities into a single identity of a 12-digit number and infringe the right of an individual to identify herself/himself with choice.” And yet, ignoring the large tranche of empirical data placed before it, the majority put its seal of approval on an Orwellian dystopia where the people stand exposed to the constant gaze of the State whereas the State remains opaque and unaccountable to them.
The post-script of the Aadhaar Judgment was somewhat disillusioning. Although the Court held that Section 57 of the Aadhaar Act was unconstitutional and mandating the compulsory linking of bank accounts and mobile numbers with Aadhaar was unlawful, the law was thereafter tweaked to permit such linking as long there was consent. Likewise, while the Court held the collection of biometrics of children to be unlawful, the law was again tweaked to permit it with the consent of parents.
That brings me to the central part of this address. What difference has the Privacy Judgment made to our lives? The Privacy Judgment belongs to the species of declaratory judgments (other examples being the Right to Education judgment and the Visaka judgment). These have seemingly longish gestation periods during which they acquire a life of their own and get applied in a variety of contexts. The Privacy Judgment's recognition of 'decisional privacy” viz; the ability to make intimate decisions primarily consisting of one's sexual or procreative nature and decisions in respect of intimate relations, was invoked to read down Section 377 IPC and decriminalise same-sex relations between consenting adults in the private sphere (Navtej Johar); to strike down Section 497 IPC which punished adultery (Joseph Shine); to recognise the right of an unmarried woman to medically terminate her pregnancy [X v. Principal Secretary, Health and Family Welfare Department (2022)]. It formed the main plank of a PIL in the Delhi High Court challenging the validity of Section 9 of the Hindu Marriage Act, 1955 that enables a spouse to seek restitution of conjugal rights. In March 2020 the Allahabad High Court invoked the right to invalidate the decision of the Lucknow administration to place on the streets banners giving personal details of persons alleged to have indulged in vandalism. In 2022, the Supreme Court agreed to reconsider its earlier view in Reserve Bank of India v. Jayantilal Mistry (2015) mandating disclosure by the RBI of the names of defaulters of loans. The Court now doubted if it was consistent with the fundamental right to privacy. Recently in Ikanoon Software Development Pvt. Ltd. v. Karthick Theodore (2024) informational privacy has been invoked to plead for recognition of the right to be forgotten and to ask for names and other details of persons appearing in reported judgments of the courts to be redacted.
There have been instances, however, where the response of the judiciary to the attempts to enforce the right to privacy have not been encouraging. The outcry in 2021 as a result of an investigative report that appeared in the New York Times that the Indian Government had procured spyware from the Israeli entity Pegasus to target the mobile phones of the leader of the opposition, journalists and even Supreme Court judges. In the PILs that ensued [Manohar Lal Sharma v. Union of India (2021)], the Supreme Court appointed a Technical Committee headed by a former Supreme Court judge to examine the facts. The Committee submitted its report to the Court in July 2022 but the case has not been taken up since. The Supreme Court by a narrow majority (3:2) turned down the plea for legalising the unions of same sex couples (Supriyo v. Union of India (2023)].The petitioners there drew extensively on the Privacy Judgment to buttress their arguments. The Delhi High Court gave a split verdict in the case demanding criminalisation of marital rape [RTI Foundation v. Union of India (2022]. One of the grounds that weighed with the judge who accepted the plea was based on the right to privacy. He held: “The attempt to keep away the law even when a woman is subjected to forced sex by her husband, by demarcating private and public space is to deny her the agency and autonomy that the Constitution confers on her.” The case is now in the Supreme Court [Hrishikesh Sahoo v. State of Karnataka (2022)]
The Privacy Judgment has made little difference to the behaviour of the governments both at the centre and the states, and even municipal bodies and public sector enterprises. Undeterred by the botched authentications by the UIDAI of biometric data, the problems of errors in data entry compounded by the tortuous procedure in having the errors corrected, Aadhaar is insisted upon as the primary identity document not just for availing benefits and services but for a whole range of routine transactions including obtaining a passport or filing a petition in a court. With their biometrics failing routinely, large sections of the poor and vulnerable continue to be deprived of rations, pensions and of basic services including shelter and schooling and even a hassle-free burial or cremation. If you are unable to be verified digitally, you are invisible to the State, to your school, to your university, to your employer and to private entities. You are rendered 'presenceless'. The poor and disadvantaged face the prospect of being banished to a digital life outside of which they may be denied access to survival rights. In India, cows and buffaloes too have UIDs. It is called Pashu Aadhaar. Each of the bovine creatures is expected to have an eartag with a 12-digit UID. Incidentally the e-Gopala portal hosted by MeiTY one can buy live animals, frozen semen and embryos. Then there is Property Aadhaar, linking Aadhaar with property details. There are mutant, and more virulent, variations of the UID project in the states – A.P. and Telangana, for instance. Hospitals store personal medical data with impunity as do shopkeepers and watchmen at housing complexes, who ask for your mobile number (and which many of us unquestioningly give). If you resist being enrolled on the DigiYatra (managed by a private entity), your entry into an airport is deliberately made more difficult. You pay the price for asserting your right to privacy. We live in times where digital stalking and intimidation is commonplace. The adjectives that aptly describe us are 'helpless' 'vulnerable' 'gullible' 'surveilled' 'manipulated'. Belying the expectation of the 5 Judge Bench that delivered the Aadhaar Judgment, even 6 years later, the Digital Personal Data Protection Act, 2023 is yet to be made operational. Unfortunately, even this statute exempts from its control, the government which is the biggest aggregator of personal data.
Then there are reports, appearing with fair regularity, of large-scale data theft, data leaks and the ease with which digital big data is sold for being mined by corporate houses or for being crunched by Large Language Models. Neither the provisions of the Information Technology Act or the Telecommunications Act are adequate to deal with such contingencies. We have known for a while, thanks to Julian Assange and Edward Snowden, that data about us is not in our control. It is kept on servers controlled by multinational mega corporations like Meta (earlier Facebook), Alphabet (earlier Google), Microsoft, Amazon, Apple and X (earlier Twitter) [each one of which is an American company, and many of which undertake contracts for the Pentagon]. Their servers are at remote inaccessible locations. Beyond our legal jurisdiction. As every visa applicant knows, our personal data is available not only to our government but to foreign ones as well. It is no longer a matter of doubt that systems, states and corporations know more about us than we know ourselves.
Thanks to Cambridge Analytica we now know that big data, algorithms and AI are deployed extensively to manipulate our choices politically and socially and that we are mere monetizable data points in a larger scheme of international commerce. The drones and satellites hovering above and amidst us have created a glass bubble where we can be seen but we cannot see those seeing us. Our online presence is being monitored not just by the State but non-state actors and machines unknown to us and located perhaps somewhere in dark web. There is no silent space in which one can experience true solitude. Not in the internet-controlled world. As a 22-year-old, I was a fan of the 1983 hit single by Sting: Every Breath You Take, Every Move You Make, I'll be watching you. Not anymore. I realise how darkly sinister and prophetic it was. The digital dystopia is here and now.
The Black Mirror episodes are, sadly, not fiction. We are no longer surprised to hear that there was a deep fake featuring the digitally morphed speaking image of Elon Musk, or that a Mayoral candidate in Cheyenne, Wisconsin vowed, if elected, to run that city exclusively with an AI bot called VIC (Virtually Integrated Citizen). His USP? “AI would be objective. It wouldn't make mistakes. It would read hundreds of pages of municipal minutiae quickly and understand them. It would, he said, be good for democracy.” These days when I read judgments and lawyers' briefs, I begin to wonder how much of it is a product of Chat GPT. Ray Kurzweil, an AI evangelist in his latest offering “The Singularity Is Nearer,” prophesises that, by 2029, AI will be “better than all humans” in “every skill possessed by any human.” He expects that in the 2030s, solar power enhanced by AI-driven advances in 3-D printing, will come to dominate the global energy supply, most consumer goods will be free, and the “dramatic reduction of physical scarcity” will “finally allow us to easily provide for the needs of everyone.” He apparently has no problem with allowing the masking of both human mediocrity and ingenuity under an AI generated veneer of synthetic creativity.
It is trite that the internet registers every digital footprint and never forgets. Yet, one wonders whether it is resignation to the inevitable or sheer ignorance that explains our willingly placing our intimate details in the digital domain in the form of Facebook posts, TikTok videos or Instagram images; our being excited about Metaverse and the delusional prospect of assuming different digital persona unmindful of the huge risks that we subject ourselves to. Are we in the throes of a 'culture of narcissism' that American historian Christopher Lasch warned us about? We ask for more CCTV and facial recognition devices on roads, public transport and apartments not knowing who is controlling the data and how. The overload of information on the net is inversely proportional to the knowledge it generates. It has made us compulsive scrollers with diminishing attention spans.
In 2019 a remarkable Malayalam film was made. It was called Android Kunjappan. An Indian working in Russia sends a robot to his ageing father living alone in a remote village to be his AI controlled virtual assistant. The movie ends with father being unable to be separated from the android that he has come to depend so heavily on for his emotional sustenance. Six years earlier Hollywood came up with Her, portraying a man's relationship with his virtual AI assistant personified through a female voice. AI promises to resurrect, for our renewed interaction, digital versions of our loved ones long dead. On 14th August this year OTV, a Oriya news channel, proudly announced the completion of one year of the launch of India's first ever AI news presenter – Lisa. We seem to be working towards humanising robots and robotising humans.
Renowned sociologist Sherry Turkle wonders what we have become as a result of our interactions with chatbots, robots and programmes like Siri and Alexa? She explains that talking listening machines are comforting because they shield us from encountering friction, second-guessing, ambivalence and the fear of being left behind. Assurance of not being judged and being always validated – things that usually make interactions with other humans messy and complicated. This has led to our expecting more from machines than other humans. To quote Turkle: “These machines promise the pleasures of companionship without the demands of friendship, the feeling of intimacy without the demand of reciprocity. We have begun treating programs as people.” We have enabled the machine to devalue what it is to be human. We need to ask ourselves: Do we want that future?
What should we then do? Can we work towards building internet-free spaces where we progressively reduce our dependence on machines? A more empathetic society that veers away from the pretend empathy of the robots. As the dissenting Judge in the Aadhaar Judgment reminded us: Dignity and rights of individuals cannot be based on algorithms or probabilities. Constitutional guarantees cannot be subject to the vicissitudes of technology.
Giving up resisting this overpowering of our selves by the internet and the machines is not an option. The huge effort made by a few amongst us to get a resounding declaration in 2017 from the Supreme Court of our fundamental right to privacy after a long and hard-fought battle should inspire us to emulate it and regain for ourselves, and the generations that follow, a more secure future. A future in which human intelligence will not surrender to AI. A future in which we are able to think, love, eat, talk, joke, pray, sing, dance, act, dress, and be what we want to be without the looming presence of an omniscient internet and the machine. We must work towards a less intrusive State.
(This is the text of the Keynote Address by Dr. S. Muralidhar, Senior Advocate and former High Court Chief Justice, at the Internet Freedom Foundation's flagship event 'Privacy Supreme' on 22nd August 2024 at New Delhi)