Govt must tweak IT Act, make data protection law after top court’s privacy ruling

By Archana Khosla, Meghna Rao

  • 14 Sep 2017
Govt must tweak IT Act, make data protection law after top court’s privacy ruling
L to R: Archana Khosla is founder partner and Meghna Rao is an associate at Vertices Partners

“The refrain that the poor need no civil and political rights and are concerned only with economic well-being has been utilized through history to wreak the most egregious violations of human rights.” — The nine-member bench of the Supreme Court in Justice K. Puttaswamy & Others versus Union of India.

Recently, a nine-judge bench led by the Chief Justice of India pronounced a judgment with respect to the right to privacy being a fundamental right by a 9-0 majority. The judgment declares privacy to be a fundamental right as enshrined under Article 21 of the Constitution of India. Through its verdict it has overruled the M.P. Sharma case and the Kharak Singh case, which stated that privacy is not a fundamental right protected under the Constitution.

While each of the judges gave their own opinion, the judgment was a unanimous one and held that the right to privacy is “protected as an intrinsic part of the right to life and personal liberty under Article 21 and as a part of the freedoms guaranteed by Part III of the Constitution.”


The petitioners had filed a writ petition in 2012 challenging that biometric data and iris scan, being collected for issuing Aadhaar cards, was violative of a citizen’s fundamental right to privacy as their personal data was not being protected and was vulnerable to exposure and misuse. This controversial issue arose when the Supreme Court was dealing with a batch of petitions that challenged the Centre’s act to make Aadhaar compulsory for availing several social welfare schemes.

The judgment is a move in the right direction, as information technology governs every aspect of our lives and it was a paramount task for the apex court to impart constitutional meaning to the individual liberty in an interconnected world. The bench has done a commendable job by examining and analysing every case in this realm of law including a comparative analysis of the American, British, South African, European and Canadian laws. However, overruling the earlier decisions was long overdue and this decision by the Supreme Court could have come earlier.

The decision in these landmark judgments seldom legislate, as they ordinarily provide for guidelines that the legislature could follow in creating or drafting appropriate laws. For example, the Vishaka judgment laid down the guidelines for laws relating to sexual harassment and it was years later that these guidelines formed the basis of the sexual harassment act which became a law in 2013.


Similarly, this decision in the right to privacy also has commended that the Union Government examine and put into a place a robust regime for data protection as currently there is no satisfactory mechanism or structure in place towards protection of data, except the Privacy Bill of 2011, which has been referred to in the judgment. The decision has expressly stated that a comprehensive data protection legislation can address the concerns of data protection and privacy and it is such a regime that seeks to protect the autonomy of the individual.

Prior to this judgment since the right to privacy was not recognised, there was no remedy to enforce, in the event the right was violated. This, in our view, is an evolution of a branch of jurisprudence which has been discussed in the judgment by certain members of the bench.

As a measure to ensure that the laws relating to privacy are brought in a uniform manner, the government could initially streamline the existing laws such as the Information and Technology Act, 2000 and the rules thereunder to bring it in line with this judgment especially those provisions which deal with the privacy of an individual by amending them suitably.


An ambivalence that pertains to the right to privacy could be with regards to section 8(1)(j) of the Right to Information Act, 2005 over the manner in what would be given priority and how would the exception to privacy versus the directive to provide for disclosure, be treated as it requires the balancing of two constitutional rights, that is the right to information and now the right to privacy.

With respect to social media policies and practices, it is a known fact that whenever data is shared through a social media platform, the user volunteers with the data, though not with its usage in entirety by the platform of the data. Since laws relating to data and privacy are subjective to each jurisdiction, the impact of this judgment maybe that certain areas of law would need strengthening. For companies that are in the financial sector particularly those dealing with retail customers, providing Aadhaar cards had become obligatory for its customers.

One would need to wait and see how this judgment would impact their operations in the near future. Another area where this judgment would definitely have an impact would be on the surveillance modalities.


As a clarification, the bench had not been formed to look into the constitutional validity of the Aadhaar Act, but to consider the larger question, that is whether the right of privacy would be found within Article 21 in both “life” and “personal liberty” by rich and poor alike primarily against State.

The right to privacy even though being a fundamental right would not be absolute and would be subject to reasonable restrictions. If Aadhaar and biometrics work in a manner which brings the people across a common platform to avail benefits from the government and if the right to privacy contradicts or hampers this objective then it may be preferable to keep Aadhaar and biometrics out of the ambit of privacy and it would be up to the Union to prove that the aspects do not fall under the Right to Privacy.

Further, the question of the validity of the Aadhaar Act is sub-judice before the five-member bench of the apex court. This judgment could have a major impact on three other major issues that are pending for consideration before the Supreme Court.


While the judgment of the Supreme Court does not expressly list down the penal provisions in the case of right to privacy being violated, the Privacy Bill, 2011, which provides for the right to privacy to citizens of India and regulates the collection, maintenance and dissemination of their personal information and for penalisation for violation of such rights and matters connected, is pending.

What is suggested is that an identity system be developed and followed so that citizens of the state avail the benefits of welfare schemes aimed for the people in a fair manner.

Archana Khosla is founder partner and Meghna Rao is an associate at Vertices Partners.

Like this Opinion? Sign up for our daily newsletter to get our top reports.

Share article on