Privacy, Surveillance and Data
Chapter Sixty-Five
Syllabus topic 5, "Freedom of press and challenges of new scientific development".
Pages 292 to 295 of 304
In one line
Nine judges held unanimously that privacy is a fundamental right, and the interesting part is that they located it in the whole of Part III rather than in article 21 alone.
In the wording a student can write in an exam: the Constitution contains no express right to privacy, and in M P Sharma, decided by eight judges, and in Kharak Singh, decided by six, it had been held that no such right is protected. In Justice K.S. Puttaswamy (Retd) v. Union of India a Bench of nine judges unanimously overruled M P Sharma, overruled Kharak Singh to the extent it held that the right to privacy is not protected, and declared that the right to privacy is protected as an intrinsic part of the right to life and personal liberty under article 21 and as a part of the freedoms guaranteed by Part III of the Constitution. Restrictions on the right must satisfy the requirements of legality, a legitimate State aim and proportionality.
The decision
Facts. Justice K.S. Puttaswamy (Retd) v. Union of India, decided 24 August 2017 by nine judges. A reference arising out of challenges to the Aadhaar scheme, in which the Union contended that there is no fundamental right to privacy at all, relying on two older and larger Benches.
Held. Unanimously, in four terms:
(i) M P Sharma, which holds that the right to privacy is not protected by the Constitution, stands overruled.
(ii) Kharak Singh, to the extent that it holds that the right to privacy is not protected by the Constitution, stands overruled.
(iii) The right to privacy is protected as an intrinsic part of the right to life and personal liberty under article 21 and as a part of the freedoms guaranteed by Part III of the Constitution.
(iv) Decisions subsequent to Kharak Singh which enunciated that position lay down the correct law.
Six separate judgments were delivered; the judgment for the Chief Justice, Agrawal and Nazeer JJ. and himself was delivered by Chandrachud J.
Why the wording of (iii) matters more than students notice. Privacy is not confined to article 21. It is protected as a part of the freedoms guaranteed by Part III, which means it inheres in article 19 as well. That is what allows privacy reasoning to be used about speech, association and movement, and it is why this case belongs in a chapter on the press rather than only in a chapter on life and liberty.
The tests for a restriction
Because privacy is a Part III right, it may be restricted, and the standard formulation has three requirements, with a fourth commonly added.
Legality. There must be a law. Executive action without statutory backing cannot invade privacy, which is the same first requirement as under article 19(2) and the one most often decisive.
Privacy, Surveillance and Data
Legitimate aim. The law must pursue an object the Constitution permits.
Proportionality. The means must be rationally connected to the aim, must be the least restrictive alternative, and must strike a balance in which the benefit outweighs the harm. This is the same four-part test set out in [The Grounds of Reasonable Restriction], and Anuradha Bhasin applies it in terms to restrictions imposed over the internet.
Procedural safeguards. Commonly added as a fourth: the law must provide against abuse, by review, oversight or a remedy.
What privacy covers
The judgments identify overlapping zones, and giving them is better than treating privacy as a single undifferentiated thing.
Bodily and physical privacy. Integrity of the body, freedom from unwanted search and physical intrusion.
Informational privacy. Control over personal information: what is collected, by whom, for what purpose, and to whom it is disclosed. This is the zone that data protection legislation addresses.
Decisional privacy or autonomy. The freedom to make intimate choices about family, marriage, procreation, and the conduct of one's life.
Privacy of communications. Interception and surveillance.
Spatial privacy. The home, and places where a person reasonably expects not to be observed.
Surveillance
The constitutional position. Interception of communications is an invasion of privacy and must satisfy legality, legitimate aim and proportionality. Statutory power exists, principally under section 5(2) of the Indian Telegraph Act 1885 and section 69 of the Information Technology Act 2000, each with rules prescribing who may authorise, on what grounds, for how long, and with review.
The recurring difficulties, and an answer should name them rather than describe the machinery.
Secrecy defeats the safeguards. An interception the subject never learns of cannot be challenged by him, so the safeguards depend entirely on internal review by the executive. The same objection Anuradha Bhasin met for section 144 by requiring publication cannot be met the same way here, because publication would defeat the purpose.
Executive authorisation. The authorising officer is part of the executive that seeks the interception, not an independent authority. Comparative systems commonly require judicial authorisation, and the absence of it in India is the standard reform proposal.
Mass collection. The old law was framed for the interception of a particular line. Bulk collection and metadata analysis are different in kind, and the proportionality of collecting everything in order to search it later is a question the framework was not designed to answer.
Chilling effect. Surveillance of communications restricts speech even where nothing is prosecuted, because a person who believes he is watched speaks differently. That is why this belongs in the press topic: the interference is with article 19(1)(a) as much as with article 21.
Privacy, Surveillance and Data
Data protection
The Digital Personal Data Protection Act 2023 is the legislative answer to the informational privacy limb of Puttaswamy. Its scheme rests on consent, notice, purpose limitation, and duties on the entity that determines the purpose and means of processing, with a Data Protection Board to adjudicate and penalties for breach.
Two features that matter constitutionally and are the standard criticisms.
Exemptions for the State. The Act permits the Central Government to exempt instrumentalities of the State from its provisions in specified interests. An exemption power exercisable by the very actor whose processing is most consequential is the point at which a data protection statute stops constraining the principal risk.
The Board's independence. Composition, appointment and terms are largely determined by the Central Government, which raises the same structural objection made about the Information Commissions in [The Right to Information].
And the change to the Right to Information Act. Section 44(3) of the same Act substituted section 8(1)(j) of the Right to Information Act 2005 with effect from 13 November 2025, exempting information which relates to personal information, without the earlier qualifiers about relationship to public activity, unwarranted invasion, or the larger public interest. That is the sharpest current illustration of privacy and the right to information pulling against each other, and it is treated fully in [The Right to Information].
A worked example
A State sets up a system of facial recognition cameras in public places, matched against a database of persons of interest, under an executive order of the Home Department. There is no statute. The order is not published. A civil liberties organisation challenges it, and a journalist adds that reporters covering protests are being identified and later questioned.
Is privacy engaged in a public place? Yes. Spatial privacy is not confined to the home; the question is whether there is a reasonable expectation, and being recorded and identified by an automated system is different in kind from being seen by passers-by.
Requirement one, legality. There is no law, only an executive order. That is fatal, and it is the shortest route to the answer. After Puttaswamy an invasion of privacy requires a law, and an executive order is not one.
Requirement two, legitimate aim. Detection of crime is legitimate, so the challenge does not fail here.
Requirement three, proportionality. Rational connection is arguable. Necessity is the weak point: identifying every person in a public space in order to find a few is the opposite of the least restrictive alternative. Balancing weighs continuous identification of the whole population against a benefit that is not quantified.
Requirement four, safeguards. No published order, no retention limit, no oversight, no remedy.
Privacy, Surveillance and Data
The journalist's separate point. Identification of reporters at protests, followed by questioning, is a chilling effect on article 19(1)(a), and it is a distinct claim. Puttaswamy's location of privacy in the whole of Part III is what makes it available: the interference is not only with article 21.
Answer. The system fails at the first requirement for want of a law, and would fail on necessity and safeguards even if a law existed.
Quick revision
- Puttaswamy, nine judges, 24 August 2017, unanimous: M P Sharma overruled; Kharak Singh overruled to the extent it denied privacy; privacy protected as an intrinsic part of article 21 AND as part of the freedoms guaranteed by Part III.
- The location in the whole of Part III is what lets privacy inform article 19.
- Restriction requires legality, a legitimate aim, and proportionality; safeguards are commonly added as a fourth.
- Zones: bodily, informational, decisional, communications, spatial.
- Surveillance: statutory power under section 5(2) of the Telegraph Act and section 69 of the IT Act; the difficulties are secrecy, executive authorisation, mass collection, and chilling effect.
- The DPDP Act 2023 answers informational privacy; the criticisms are State exemptions and the Board's independence.
- Section 44(3) of that Act rewrote section 8(1)(j) of the RTI Act with effect from 13 November 2025.
Test yourself
1. State the four terms of the order in Puttaswamy, and explain why the wording of the third matters.
2. Set out the three requirements for a restriction on privacy, and the fourth that is commonly added.
3. Name five zones of privacy and give an example of each.
4. Give four difficulties with the Indian surveillance framework, and say why the Anuradha Bhasin answer of publication cannot be used here.
5. What are the two standard constitutional criticisms of the DPDP Act 2023?
6. Why does a chapter on privacy belong in a topic on the freedom of the press?
The rest of this subject
These notes are cut from the University's printed syllabus. Open the syllabus itself, or the past papers, for the same subject.