Privacy In Cyber Space

My son, when he was six years old, vehemently opposed one of my relatives taking his photographs in a family function. Being embarrassed among the crowd due to his discourteous screams, I inquired the reason why he was so blunt in such a family gathering and he frantically revealed his dislike and apprehension on his photos being immediately uploaded by these uncles and aunts to the 'Facebook'. That was a very personal incident which opened up my inner eyes, towards the true understanding of the expression, "right to privacy as an inalienable, inherent, inborn, natural and fundamental human right"; even a doli incapax[1] who is exempted by law from liability for his deeds on account of his incapability of understanding, immaturity and vulnerability, has an inborn realisation of his privacy rights[2]! This natural and internal realisation is the centre point in the jurisprudence of privacy rights as observed by Brandies,J.:

"…solitude and privacy have become more essential to the individual; but modern enterprise and invention have, through invasions upon his privacy, subjected him to mental pain and distress, far greater than could be inflicted by mere bodily injury. The right "to be let alone" thus represented a manifestation of "an inviolate personality", a core of freedom and liberty from which the human being had to be free from intrusion."[3]

If that much is the ambit, content and nature of integration of right to privacy to one's own person, the legal fraternity has to address this right more seriously, particularly in this cyber age.

Advancements in science and technology has opened up new vistas of Mobility (Geographic Knowledge Discovery), Data Mining, Cloud Computing etc. which bring unforeseen and unprecedented outcomes with respect to collection, analysis and handling of data in terms of accuracy, efficiency and saving of time, money and manpower. Even while offering tremendous benefits, they pose certain challenges for legal protection by denuding territorial jurisdictions of the court/tribunal; but the major challenge is threat to 'privacy', which has been endorsed as a fundamental right into the sweep of article 21[4] and article 19(1)(a)[5] of the Constitution of India, through judicial process.

After the advent of cyber space, anybody can access any information related to anything or anybody from anywhere at any time. Anybody can upload any data to the cyber space and keep it simply in the web, like something precious was kept safe by our elders in a chest of drawers, in the past. Globalization has given wider acceptance to this cyber technology in the whole world; e-commerce, e-governance, e-learning, e-courts, etc., have made day to day affairs very easy. The recent lock-down throughout the world, necessitating work from home and the urgency of combating pandemic burst-outs also necessitated the growing dependence on cyber data. The collection, storage, access, handling and disposal of these data raise the task of resolving many legal issues, of which the most fundamental one, viz., the right to privacy with respect to cyber data, is discussed here.

Any discussion on data privacy in cyber space shall have its focus on the basic human right and fundamental right of privacy, emanating from the core, 'right to life and personal liberty'. A bird's eye view on the international concern towards right to privacy and data protection, highlights the obligation of states parties to ensure the enjoyment of privacy rights to the citizens through legal framework[6]. Even in the absence of a statute, India is liable in public law to protect the fundamental right of its citizenry, upholding its international commitment[7].

International Resolve on Right to Privacy and Data Protection

It is pertinent to note that the Universal Declaration of Human Rights, 1948 (UDHR)[8] and International Covenant on Civil and Political Rights, 1966(ICCPR)[9] have specifically asserted that right to privacy is an integral part of individual rights which cannot be arbitrarily interfered with. The United Nations Human Rights Committee in its General Comment No.16 on Article 17 of ICCPR has stated that "the gathering and holding of personal information on computers, data banks and other devices, whether by public authorities or private individuals or bodies, must be regulated by law. Effective measures have to be taken by States to ensure that information concerning a person's private life does not reach the hands of persons who are not authorized by law to receive, process and use it, and is never used for purposes incompatible with the Covenant. In order to have the most effective protection of his private life, every individual should have the right to ascertain in an intelligible form, whether, and if so, what personal data is stored in automatic data files, and for what purposes"[10]. Convention on the Rights of the Child, 1989[11] mandates the convention parties to ensure the right to privacy to children also in the same way as it is bound to provide in the case of adults. International Convention on the Protection of All Migrant Workers and Members of their Families, 1990[12] also ensures privacy protection in the case of migrants. The Budapest Treaty on Cyber Crimes, 2001[13] is an outcome of the realization by the member states of the need to pursue, as a matter of priority, a common criminal policy for the protection of society against cybercrimes, inter alia, by adopting appropriate legislation and fostering international co-operation. The treaty parties are concerned of the risk that computer networks and electronic information may also be misused for committing criminal offences including those affecting the privacy of individuals. The Budapest treaty intends to deter actions directed against the confidentiality, integrity and availability of computer systems, networks and computer data as well as the misuse of such systems, networks and data by providing for the criminalization of such conduct. The treaty upholds the mandates of all applicable international human rights treaties, which reaffirm the right of everyone to hold opinions without interference, as well as the right to freedom of expression, including the freedom to seek, receive, and impart information and ideas of all kinds, regardless of frontiers, and the rights concerning the respect for privacy. It also upholds the right to the protection of personal data, as conferred, for example, by the 1981 Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data[14]. In 2013, the UN General Assembly adopted a resolution to protect privacy of individuals online, in the same way as is protected offline, " recognising the global and open nature of the internet and the rapid advancement in information and communications technologies as a driving force in accelerating progress towards development in its various form"[15]. The treaties of Council of Europe, mainly, Convention for the Protection of Human Rights and Fundamental Freedoms,1950, Convention for Protection of Individuals with Regard to Automatic Processing of Personal Data ,1981[16] and Additional Protocol to the Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data, Regarding Supervisory Authorities and Transborder Data Flows, 2001[17] expose the international obligation to protect right to privacy in the cyber regime. Protocol Amending the Convention for Protection of Individuals with Regard to Automatic Processing of Personal Data, 2018[18] is another document intended to improve the original 1981 Convention by taking into account the challenges posed by the new forms of information and communication technology (ICT) that have emerged during the ensuing decades. American Convention on Human Rights, 1969[19] upholds the right to privacy recognized by the UDHR and other international covenants. In 2014, the African Union adopted Convention on Cyber Security and Personal Data protection. Apart from these, we can identify a number of other regional documents which very strongly assert the enforcement of right to privacy[20], giving particular concern for the protection of data and information.

Whenever a privacy issue arises with respect to cyber-related data, the obligation of states parties to ensure protection of right to privacy to individuals is of paramount importance. This means, nothing can stand on the way of an individual, in assuring and realizing the right to privacy with respect to his data deposited/stored in the cyber space or computer network or electronic system. And, the international community has always expressed the resolve to firmly stand for the privacy rights of individuals against the state as well as private entities. States parties are obliged to legislate upon the convention/treaty mandates, for which ratification was accorded by the respective governments. With this backdrop in the international sphere, let us discuss, to what extent Indian legal system ensues in following this mandate conceded by the international community. Article 51(c) of the Constitution of India issues a directive to the state to endeavor to foster respect for international law and treaty obligations. With the help of Article 51(c), the apex judiciary has been able to input into Part III of the Constitution the vast number of rights flowing from various international declarations, charters and conventions ratified by India. In S R Bommai v. Union of India,[21] the Supreme Court has clearly stated that the provisions of an international covenant which elucidate and go to effectuate the fundamental rights guaranteed by our constitution, can clearly be relied upon by courts as facets of those fundamental rights and hence enforceable as such. In the light of our international commitment, this discourse on privacy rights, comprises of two facets; viz., the phase of recognition of right to privacy and the phase of right to protection of data and information relating to an individual so as to ensure right to privacy.

Right to Privacy in India

Right to privacy has been unequivocally articulated as a fundamental right by the apex court of India by the landmark judgment in, K.S. Puttaswamy (Retd) v Union of India [22]. The nine judges bench declared:

"Right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as a part of the freedoms guaranteed by Part III of the Constitution."

In fact, Putaswamy did not lay down a pretty new principle regarding right to life and personal liberty to Indian Constitutional law one fine morning. The remarkable outcome in the Puttaswamy case had been evolving through the judicial process over the past long years. The premise of 'right to life and personal liberty' expounded in Maneka Gandhi v Union of India[23] had been expanding through years by the judicial creativity of our learned judges of the apex court[24]. Further, the inconsistency resulted from two earlier judgments[25] had also been reconciled to unequivocally and explicitly declare that right to privacy is a fundamental right which comes within the scope of personal liberty of an individual. Quoting John Stuart Mill's prepositions in his essay, 'On Liberty' (1859), Chandrachud,J., gave expression to the need to preserve a zone within which the liberty of the citizen would be free from the authority of the state[26]. According to Mill :

"The only part of the conduct of any one, for which he is amenable to society, is that which concerns others. In the part which merely concerns himself, his independence is, of right, absolute. Over himself, over his own body and mind, the individual is sovereign." While speaking of a "struggle between liberty and authority" the tyranny of the majority could be reined by the recognition of civil rights such as the individual right to privacy, free speech, assembly and expression."

At the end of a voyage through the Aristotelian division between the public sphere of political affairs (which he named as polis) and the personal sphere of human life (named oikos), comparative jurisprudential evolution of the concept of right to privacy, treatises of John Stuart Mill, James Madison, Warren and Brandeis, Thomas Cooley, William Blackstone, Roscoe Pound, Ronald Dworkin etc., and above all, the traditional Indian legal philosophy, the Puttaswamy court assimilated 'privacy' as the very basic need of every individual to live with dignity. The court recognized it as a natural and inalienable right and upheld the view that privacy is a concomitant of the right of the individual to exercise control over his or her personality[27].

Besides, the preposition that "constitutional provisions must be read and interpreted in a manner which would enhance their conformity with international human rights instruments ratified by India" had again been affirmed. The judgment also concludes that privacy is a necessary condition for the meaningful exercise of other guaranteed freedoms.

A similar adherence to right to privacy of an individual as a fundamental constitutional right is reflected in other jurisdictions also. In 2018, in the landmark decision of Carpenter v. US[28] Supreme Court of United States held that the state is obligated to ensure that the "progress of science" does not erode Fourth Amendment[29] protection assuring privacy. The Court held that the government violates the Fourth Amendment to the Constitution of US by accessing historical records containing the physical locations of cell phones without a warrant[30]. Roberts, C.J., noted that "the development of technology has required the court to find ways to preserve privacy from the government even when surveillance tools have enhanced the government's ability to encroach on areas normally guarded from inquisitive eyes." It is interesting to see that the very famous dissenting view of Brandies, J., in Olmstead v. United States[31] became the ratio in Carpenter. Brandies,J., pointed out, " The framers of the US Constitution sought to protect Americans in their beliefs, their thoughts, their emotions, and their sensations. It is for this reason that they established, as against the government, the right to be let alone as the most comprehensive of rights and the right most valued by civilized men. To protect that right, every unjustifiable intrusion by the government upon the privacy of the individual, whatever the means employed, must be deemed a violation of the Fourth Amendment…".

In England, privacy law was developing as a part of tort in common law; as distinct from tort of trespass or tort of assault. The introduction of Human Rights Act, 1998, incorporating European Convention on Human Rights into the domestic law, provides explicit human rights protection to privacy of individuals.

Hence, 'right to privacy' is identified and established as the most fundamental right for the existence of a human being, by the judiciary world over. With this premise, the next issue relating to the necessity of protection of right to privacy in cyber space shall be examined.

Privacy Issues w.r.t to Personal Data and Information in Cyber Space

Today, the meaning of information has gained varied meanings in terms of its production, collection, analysis, storage and access using cyber tools and internet. In the same way, definition of personal data also has been redefined. For instance, the personal information of user can be easily generated by tracking his movement on various internet platforms like social media, online transactions, browsing history etc. This again advances the dilemma of what constitute the private and personal information. In the present netizen's world, there are two different and extreme views, i.e., one school believes in the protection of privacy of an individual as the paramount virtue, as in the real world; but the other school believes that there is no privacy at all, when the netizen enters into the web world. In other words, there is a confusion as to what privacy is and what it is not, in a cyber world[32]. It is quite true that the protection once secured to individuals with geographical barriers has now been removed by World Wide Web, the advent of which threatens one's own personal existence and privacy even within the four walls of his own room[33].

Online Invasion to Privacy

An individual's privacy may be invaded online, most often, without his knowledge. There are two aspects that we will have to keep in mind; (i) the person entering into the web world in almost all the cases, is a person having little understanding of the operation of various commands, locations, cookies, the hooks and crooks by which technology mines sensitive and valuable information, etc., to which he will respond without any hesitation. Many people undertake their operations in the net with a belief that their online activities are anonymous. They may be recorded virtually. The data the subscriber accesses, the websites visited and e-mails read etc., would be monitored and copied by the service providers and by web site operators. The information and privacy of an individual may be at risk by threat of invasion during generation, storage, transmission, and processing by the system itself or by the Internet Service Providers (ISP) or web sites or due to a Spyware. Again, when we surf the web, many web sites deposit data about our visit, called "cookies," and the cookie data will reveal that we have been there before[34]. In a 2019 decision of the Court of Justice of the European Union (CJEU) involving consent for the use of cookies by a German business firm called 'Planet49', the Court held that "(i) consent for cookies cannot be lawfully established through the use of pre-ticked boxes, and (ii) any consent obtained regarding cookies cannot be sufficiently informed in compliance with applicable law if the user cannot reasonably comprehend how the cookies employed on a given website will function."[35]

It should be noted that the legal implications of the use of cookies to gather user's information was first considered in Doubleclick case.[36] In that case, Court dismissed the claims advanced by the plaintiffs under the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, and the Wiretap Act, arising out of Google-Doubleclick's use and placement of "cookies" on plaintiffs' computers. Doubleclick used such "cookies" to gather information about the users' use of client web sites of Doubleclick. Doubleclick's users consented to such information-gathering, though not with willful awareness, the court held that Doubleclick's activities did not run counter to either the Electronic Communications Privacy Act or the Wiretap Act. The Doubleclick approach has now been overturned and privacy rights of individuals gained momentum over simple commercial interests.

Spyware is fast-becoming the biggest annoyance to computers these days, degrading system performance, tracking our computing habits, popping up annoying advertisements, and even stealing our important personal information. Detecting and removing spyware may be difficult, since it occurs in so many different forms.

Data Protection in Cyber Space: Legal Frame Work in India

As seen earlier, due to the growing requirement for assuring protection to cyber data, different countries have introduced laws like Data Protection Act, 1998 superseded by Data Protection Act 2018 (UK)[37], Electronic Communications Privacy Act, 1986 (USA)[38] etc. from time to time; European Union has enacted the General Data Protection Regulation(GDPR), which came into force on 25 May 2018, replacing the Data Protection Directive of 1995. In India, there is no such comprehensive legal framework that deals with privacy issue. Major cyber challenges are dealt with by the Information Technology Act, 2008 (IT Act)[39], which was enacted with the predominant objective to facilitate e-commerce[40] and hence privacy was not a primary concern. The 2011 Rules[41] issued under the IT Act provide for compensation from a body corporate on account of any negligence in implementing and maintaining reasonable security practices and procedures while dealing with sensitive personal data or information. These Rules also provide for various contingencies such as consent requirement, lawfulness of purpose, subsequent withdrawal of consent, etc. Still, there is a danger with these Rules as it permits the wrongdoer to evade responsibility, by the payment of compensation to the person who suffered infringement of his privacy rights[42]. Again, the proviso in Rule 3 which defines sensitive personal data, exempts any information that is freely available or accessible in public domain or furnished under the Right to Information Act, 2005 or any other law for the time being in force, out of the purview of sensitive personal data or information for the purposes of these rules. As per Rule 7, "a body corporate or any person on its behalf may transfer sensitive personal data or information including any information, to any other body corporate or a person in India, or located in any other country, that ensures the same level of data protection that is adhered to by the body corporate as provided for under these Rules". This again creates suspicion as to the extent of privacy that can be availed by an individual; Is the 'level of data protection' envisaged by the Rules sufficient to ensure privacy rights of an individual, particularly when Rule 7 permits transfer of sensitive personal data or information including any information[43]; What are the criteria for determining the level of data protection?

The relevant provisions of the Indian Penal Code could also be utilized to deal with cybercrimes affecting privacy[44]. The liability will be fixed on the basis of general principles of criminal law and the convict will be punished. When the prosecution fails to establish the commission of an offence, there is no scope for privacy protection under criminal law. So, there is a vacuum in the legislative frame work as far as the protection of privacy rights in cyber space is concerned.

Pursuant to the Puttaswamy verdict which called upon the government to create a data protection regime to protect the privacy of the individual in compliance with the international obligations, a new legislative measure viz., 'Data Protection Bill, 2019' was introduced in Lok Sabha on December 11, 2019 to provide for protection of personal data of individuals, and establishing a Data Protection Authority, for the same[45]. It recommends a powerful regime which balances individual interests and legitimate concerns of the state. As the lead judgment in Puttaswamy cautions, "formulation of a regime for data protection is a complex exercise that needs to be undertaken by the state after a careful balancing of requirements of privacy coupled with other values which the protection of data sub serves together with the legitimate concerns of the state."[46] For example, the court observes, "government could mine data to ensure resources reached intended beneficiaries." However, the bench restrains itself from providing further guidance on the issue.

In the 2019 Bill, procedural safeguards are provided in relation to the processing of personal data by: (i) government, (ii) companies incorporated in India, and (iii) foreign companies dealing with personal data of individuals in India. Personal data is identified as "data which pertains to characteristics, traits or attributes of identity, which can be used to identify an individual". It deals with Personal Data, Sensitive Personal Data and Critical Personal Data. The rights of individuals/data principal and the liabilities of data fiduciary are well defined. The data fiduciary decides how the data will be processed; the purpose also will be determined by the data fiduciary. The rights of the individual availing the services of data fiduciary is protected in the Bill by ensuring security safeguards like data encryption and other measures for preventing misuse of data. The individual/data principal enjoys rights to (i) obtain confirmation from the fiduciary on whether their personal data has been processed, (ii) seek correction of inaccurate, incomplete, or out-of-date personal data, (iii) have personal data transferred to any other data fiduciary in certain circumstances, and (iv) restrict continuing disclosure of their personal data by a fiduciary, if it is no longer necessary or consent is withdrawn. The Bill also envisages for the establishment of a Data Protection Authority which may take steps to protect interests of individuals and prevent misuse of personal data.

Another important provision in the Bill is that Sensitive Personal Data can be transferred outside India for processing only if explicitly consented to by the individual, and subject to certain additional conditions. Let us wait to see how efficiently this forthcoming law is going to protect privacy rights of individuals.

Protection against Privacy Breach: the GDPR Model

The General Data Protection Regulations, 2018 of EU (GDPR) has identified Sensitive Personal Data as personal data consisting of information as to racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person's sex life or sexual orientation. Collection, handling and processing of Sensitive Personal Data requires special legal backing and documentation under GDPR[47]. The conditions include, the requirement of a specific contract with the individual from whom data is collected, and consent obtained on providing a clear information regarding the collection, processing, storage, privacy measures etc. to the individual (informed consent). The information regarding archiving of data, for scientific or research or governmental purpose, access to legal remedies, repudiation of contracts etc., should also be informed. In line with these Regulations, Justice B.N. Srikrishna Committee Report in 2018 recommended to enact a law adopting special measures to ensure privacy to sensitive personal data. These recommendations have been culminated in Personal Data Protection Bill, 2019, wherein provisions regarding Sensitive Personal Data and Critical Personal Data are included. The Bill provides that Sensitive Personal Data can be transferred outside India for processing only if explicit consent from the individual is obtained and that too subject to certain additional conditions; however, such Sensitive Personal Data should continue to be stored in India. According to the Bill, certain Personal Data notified as Critical Personal Data by the government from time to time can be processed in India only.

Concluding Remarks

Technology has now brought us to a critical juncture, where we are not able to pinpoint the horizons to which the developments are fast moving. Ignorant of the dangerous webs spun by the cyber spiders, innocent human beings are attracted towards the amazing possibilities created by the 'world wide web' and cyber technology. Hence the legislature as well as the judiciary shall remain vigilant to ensure the fundamental rights of the individuals in the cyber space and digital operations, and to control the state intervention into the enjoyment of basic rights, particularly, right to privacy. In the modern context of the concept of state, the agencies entrusted with responsibilities by the state for discharging state functions are amenable to writ jurisdiction. Whenever, 'right to privacy and protection of personal data and information' is in question before the judiciary, a number of issues might surface in the process of solving the privacy grievance. Likewise, during collection of personal data, many questions like, whether a strict data collection policy has been released and made known to the data principal/individual; whether information is collected by authorized agency; whether purpose of information is adequately transmitted to the individual; whether informed consent, which is the most crucial requirement, is obtained; whether any commercial interest is involved; whether the terms of the Master Service Agreement[48] was verified and adhered to on the basis of a 'techno-legal audit' so that privacy and data security is ensured; etc., shall be analyzed to examine the appropriateness of collection of data and information itself. Once data is gathered from or about a person it shall be kept accurately and responsibly. Appropriate technical measures such as information security controls which are necessary to keep information secured over internet, should be utilised. Data privacy or confidentiality is, protecting data from unlawful, unauthorized use as well as from unintentional access, handling and disclosure. Similarly, personal data shall be processed lawfully. Processing means any application upon the data, for the purpose of obtaining a result. Data can be processed only if the consent of the individual is obtained. The state should ensure that there are sufficient safeguards to maintain the data confidentiality and that the data is appropriately dealt with after processing and analysis. While entering into a contract between data principal and data fiduciary, the clauses for effective cyber security measures shall be added.

In nut shell, in all the cyber activities, the data principal, the cyber intermediaries, the society, the state and the legal system should extent eternal vigilance to place the right to privacy of the individual at the prime position. Whatever be the cause of thrusting individuals into the cyber world, collecting personal data without their informed consent will be highly unfair, unjust and arbitrary. The right to privacy which is the core fundamental right for the existence of an individual as a respectable human being, shall never be compromised, sans a just, fair and reasonable procedure established by law. One should be cautious of the eagerness of the service providers in gathering and mining sensitive and personal information of individuals under the pretext of providing speedy and efficient services. Quoting Brandeis,J., "our government is the potent, the omnipresent teacher; for good or ill, it teaches the whole people by its example"[49]. Let us hope for an efficient statutory frame work, guided by illustrious judicial wisdom, to regulate the activities in cyber space and handling of data and information, assuring privacy of individuals.

(*The author is Assistant Professor at School of Indian Legal Thought, Mahatma Gandhi University, Kottayam, Kerala.)