Privacy and Surveillance

The word to notice is "arbitrary or unlawful". Two conditions, not one. An interference must be lawful, meaning provided for by law, and it must not be arbitrary, which imports reasonableness and proportionality. A State that passes a statute permitting mass interception has satisfied the first and not the second.

The 1975 Declaration, paragraph 6, is the provision that ties privacy specifically to this paper. States are to extend the benefits of science and technology to all strata of the population and to protect them from possible harmful effects of the misuse of scientific and technological developments, including their misuse to infringe upon the rights of the individual or of the group, particularly with regard to respect for privacy and the protection of the human personality and its physical and intellectual integrity. That is a 1975 instrument naming privacy as the leading casualty of technological misuse, before most of the technology existed.

The Indian position

Justice K.S. Puttaswamy (Retd.) v. Union of India, AIR 2017 SC 4161, (2017) 10 SCC 1, decided on 24 August 2017 by nine judges.

Facts. A Bench of three judges hearing the challenge to the Aadhaar scheme recorded that the norms for and the compilation of demographic and biometric data by the Government were being questioned as a violation of the right to privacy. The Attorney General argued that the existence of a fundamental right of privacy was itself in doubt, relying on M P Sharma and Kharak Singh. The petitioners answered that both rested on an approach later held not to be good law. Because the decisions that had since recognised privacy were given by smaller Benches, the question was referred upwards, and on 18 July 2017 a Constitution Bench directed that it be placed before nine judges.

Held. The Order of the Court disposed of the reference in four terms. M P Sharma, which holds that the right to privacy is not protected by the Constitution, stands over-ruled. Kharak Singh stands over-ruled to the extent that it so holds. The right to privacy is protected as an intrinsic part of the right to life and personal liberty under article 21 and as a part of the freedoms guaranteed by Part III. Decisions subsequent to Kharak Singh which have enunciated that position lay down the correct position in law.

Why it matters here. The case exists because of a technology. Nobody asked the Supreme Court an abstract question about privacy; a biometric identification programme was built and the question could no longer be avoided. That is the pattern this whole paper describes, visible in the procedural history of one case. It also settles the Indian starting point for everything in Module IV: personal data is inside article 21.

The three-part test

The instruments and the Indian cases converge on the same structure, and it is the structure an answer should use. An interference with privacy is permissible only if it satisfies three requirements.

1. Legality. There must be a law. Not a policy, not an executive instruction, not an internal standard operating procedure. The law must be accessible and must be precise enough that a person can foresee when the power may be used against them.
2. Legitimate aim. The purpose must be one the constitutional or treaty order recognises: national security, prevention of crime, public health, the protection of the rights of others.
3. Proportionality. The measure must be rationally connected to the aim; there must be no less restrictive means reasonably capable of achieving it; and the benefit must outweigh the burden imposed on the right.

The same three-limbed structure governs limitations on the right to science under article 4 of the ICESCR, set out in [Dual Use: the Same Technology Both Ways]. That is not a coincidence: it is the general shape of limitation analysis in human rights law, and a candidate who has learnt it once can apply it to any right on this paper.

Worked example

A municipal corporation installs cameras with automated face recognition at every entrance to a public market. The stated purpose is the detection of pickpockets. Images are matched against a database of persons previously arrested, and all footage is retained for two years. The scheme is created by a resolution of the corporation.

Legality. It fails at the first step. A resolution of a municipal body is not a law that authorises interference with a fundamental right, and there is no statute defining who may be enrolled in the database, on what grounds, for how long, or with what remedy for a person wrongly included. The analysis could stop here, and a good answer says so before going on.

Legitimate aim. Prevention and detection of crime is a legitimate aim. This limb is usually satisfied and is rarely where a case is won.

Proportionality. Rational connection is arguable. The failure is at necessity and at balance. Retaining footage of every visitor for two years to catch pickpockets is not the least restrictive means; the burden falls on the entire population of shoppers, none of whom is suspected of anything; and matching against a database of persons previously arrested, rather than convicted, imports the error rate of past policing into every future identification.

The equality dimension. Recognition systems do not perform uniformly across populations, so a scheme of this kind distributes its errors unevenly. That converts a privacy problem into a discrimination problem, which is taken up in [Equality and the Digital Divide].

What could survive. Cameras without automated matching, under a statute, with a defined retention period and an accessible complaints route, may well be proportionate. The point of the test is that it does not produce a yes or a no to "cameras"; it produces a yes or a no to a particular design.

What it does NOT mean

Privacy is not secrecy. A person who has told a doctor something has not made it public, and a person walking down a street has not consented to being tracked. The right protects control over access, not concealment.

"Nothing to hide" is not an argument the law recognises. It misstates the interest, which is not in hiding wrongdoing but in not being watched; and it misallocates the burden, since it is the State that must justify the interference, not the individual who must justify wanting to be left alone.

Consent does not cure everything. Consent obtained as the price of a service a person cannot do without is not a free choice, and the framework treats it accordingly.

Anonymised is not anonymous. Data stripped of names can frequently be re-identified by combining it with other data, which is precisely the property General Comment 25 notes when it observes that information is nonrivalrous and recombinant.

Surveillance is not only a State activity. Most of the capability is privately owned, which engages the duty to protect and makes regulation, rather than restraint, the primary obligation.

Limits and criticism

The three-part test is a method, not an answer, and its second limb is almost never contested. Cases are decided at legality and proportionality, and a candidate who spends an answer establishing that national security is a legitimate aim has spent it on the uncontested limb.

The deeper criticism is that the test is individual in shape and the harm is increasingly collective. It asks whether this person's rights were interfered with and whether that interference was justified. It is a poor instrument for a harm that consists in an entire population altering its behaviour because it knows it may be watched, since no individual can show that they in particular were observed. That is a real limitation of the framework and worth a sentence in an answer that has room for it.

Quick revision

• UDHR article 12 and ICCPR article 17: no arbitrary or unlawful interference with privacy, family, home or correspondence; and a right to the protection of the law against it. Two conditions: lawful, and not arbitrary.
• 1975 Declaration, paragraph 6: protect people from misuse of scientific and technological developments, particularly with regard to respect for privacy and the physical and intellectual integrity of the person.
• Puttaswamy (2017), nine judges: privacy is protected as an intrinsic part of article 21 and as part of the Part III freedoms; M P Sharma over-ruled, Kharak Singh over-ruled to the extent it held otherwise.
• The three-part test: legality (a law, accessible and foreseeable), legitimate aim, proportionality (rational connection, least restrictive means, benefit outweighing burden).
• The five changes technology made: scale, cost, permanence, invisibility, delegation. Surveillance engages all five.
• Not secrecy; "nothing to hide" is not an argument; consent as the price of a necessity is not free; anonymised is not anonymous; and most of the capability is private, so the duty to protect does the work.

Test yourself

1. Set out article 17 of the ICCPR and explain the significance of the words "arbitrary or unlawful". Article 17 provides that no one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation, and that everyone has the right to the protection of the law against such interference or attacks. The two adjectives impose two distinct conditions. Unlawful means the interference must be provided for by law, so an executive practice with no legal basis fails immediately. Arbitrary imports a further standard of reasonableness and proportionality, so that a State which enacts a statute authorising an interference has satisfied the first condition and must still show the interference is not arbitrary. A test that collapsed the two would allow any interference a legislature chose to authorise.

2. What did Puttaswamy decide, and why is it a case about technology rather than about privacy in the abstract? Its Order disposed of the reference in four terms: M P Sharma is over-ruled in so far as it holds that privacy is not protected by the Constitution; Kharak Singh is over-ruled to the same extent; the right to privacy is protected as an intrinsic part of the right to life and personal liberty under article 21 and as part of the freedoms guaranteed by Part III; and the decisions after Kharak Singh which took that view state the law correctly. It is a case about technology because the question reached the Court only because a biometric identification programme had been built and challenged; the constitutional question was forced by the capability rather than raised for its own sake.

3. Apply the three-part test to a proposal to require every mobile telephone connection to be linked to a biometric identity. Legality asks whether a statute authorises it, whether that statute is accessible, and whether it is precise enough that a person can foresee when and how the power will be used, including who may access the resulting database and for what. Legitimate aim is likely satisfied, prevention of crime and national security both being recognised. Proportionality does the work: whether biometric linkage is rationally connected to the aim; whether a less restrictive means, such as documentary verification without biometrics or retention of the biometric only at the point of verification, would reasonably achieve it; and whether the benefit outweighs the burden of creating a database that links every person's communications to their body. The retention period, the access controls and the remedy available to a person wrongly matched are all part of proportionality rather than separate questions.

4. Why is "nothing to hide" not an answer, and where does the burden of justification lie? Because it misdescribes the interest and misplaces the burden. The interest protected is control over access to oneself and one's information, not the concealment of wrongdoing, so a person with nothing to hide still loses something when they are watched. And under both article 17 and article 21 as construed in Puttaswamy, an interference must be justified by the State: it must point to a law, a legitimate aim and proportionality. The formulation reverses that, requiring the individual to explain why they should not be observed, which is the opposite of how a limitation clause operates.

5. What is the principal structural weakness of the three-part test as applied to population-scale surveillance? The test is individual in shape while the harm is collective. It asks whether a particular person's right was interfered with and whether that interference was justified, which suits a search of one house or the interception of one line. Where a capability is applied to a whole population, no individual can ordinarily show that they in particular were observed, and the characteristic injury, that people alter their behaviour because they know they may be watched, is not an injury to any identifiable claimant. The framework can address this through the requirement that a law be foreseeable and through proportionality at the level of the scheme rather than the instance, but it remains a poor fit for a diffuse harm.