(Free Android App)
By Vijayashankar Na
Filed Under Cyber Law
| No Comments»
[This is in continuation of our debate on the Privacy Judgement]
The Puttaswamy judgement from the 9 member bench of the Supreme Court which was hailed as a “Historic” judgement ended up with a simple declaration that “Right to Privacy is a Fundamental Right under the Indian Constitution which is subject to the reasonable restrictions applicable to all such rights”. Let us now look at how this decision affects the three stake holders we identified for this issue of “Privacy” namely,
Whether a “Right” is a fundamental right or a legal right makes some difference as to the Government but not so much for the Citizen or even the data processing Companies
The “Reasonable Restrictions” relate to
A detailed academic discussion on these “Reasonable Restrictions” can be found here. As one can see, the “Reasonable” restrictions is reasonably vague and there could be many excuses under which a law can be defended under one of these restrictions.
In each such case, the law can be challenged at the High Court or the Supreme Court as violative of the fundamental rights and the Court will apply the test of reasonableness and the need for the law before ruling either the law does not violate any of the fundamental rights or that even if it does so it may be saved by falling into one of the reasonable restriction categories. If not the law will be struck down.
The current judgement will therefore provide an opportunity to challenge every law made by the Government and the Courts will spend their precious time in the coming days debating these issues.
If the Government is careful in drafting the law, and if the Judiciary is not too unfriendly, then it may be able to justify its position and get through the law as it intended or with whatever modifications that the Court may suggest.
The immediate challenge is regarding the UIDAI Act and the use of Aadhar as an ID for providing many of the Government services with a need to be linked to the PAN, Driving License or Mobile. Each of these can be eminently defended under national security and hence the law may pass the test.
Key is Interpretation and it depends….
We need to however observe that ultimately it is the “interpretation” of the judges that determines whether the law is violative of the fundamental rights or not.
Even now the 9 member bench has only interpreted that “Privacy” is a “Right” which is part of the “Right to Life and Personal Liberty” and Article 21 and 19 are not different and hence the bench came to the conclusion that Privacy Right is a fundamental right. The Constitution has not been amended to include “Privacy” as a right nor the bench defined the term “Privacy” in an unambiguous manner.
This “interpretation” will stand unless a bench of more than 9 members holds otherwise in some point of time in future.
Whether any legislation comes under any “Reasonable Restriction” principle will be subject to another “Interpretation” by other benches which can be of a smaller size. We may recall that the Shreya Singhal case was an example of how the “Power to Interpret” was used by the Court to strike down a law that was meant for “Messages” sent from one person to another through e-mail or SMS by interpreting it as equivalent to “Publishing” of an information reaching out to the public.
Interpretations therefore may vary from time to time. This may not be bad since law has to keep moving forward but it also means that the law can be rendered inconsistent with different judges coming to different interpretations based on their own understanding of the problem.
Both the judges who earlier interpreted “Messaging” as “Publication” in the case of Shreya Singhal case were also part of this bench and had seen “Chilling Effect” of Section 66A while coming down with a sledge hammer on the section.
Hence possibility of any law made by the Government even in future to be over turned if a Court so desires cannot be ruled out.
In view of this there is no significant impact of the decision on the Government except that there would be more litigation and challenges for every law made by the Government and the battle of the opposition to put hurdles in the path of growth contemplated by the Government will move from the Rajya Sabha to the Supreme Court.
Whether the Supreme Court will continue to entertain all politically motivated cases filed under the guise of “Privacy Rights” or exercise discretion needs to be seen.
Definition of Privacy
Despite some academic discussions on how to define “Privacy”, the final order did not include a clarity on “What is Privacy” as a “Right”.
When the Government legislates on “Privacy” in future, this lack of definition will come to haunt us since whatever the Government does can be challenged under the argument that it infringes “Privacy” as a petitioner may try to interpret and the Supreme Court will keep hearing such petitions.
It was also interesting to note that some of the discussions were centered around “Information Privacy” as if “Right to control information related to a person” itself as the “Right to Privacy”.
Is name an information related to privacy? Is Mobile number an information related to privacy”, Is information on caste, sub caste, political affiliation, etc are information related to privacy have not been clarified in this judgement. They continue to be in the realm of uncertainty.
Is a “Phone Conversation” between A and B a joint property of “A and B”?, is recording of such conversation is not amounting to Privacy breach?, what about information between children and parents? family members? are they under constraints of Privacy?, Should we blindly follow the Privacy culture of the west or re-define it along with our own family customs and culture?
…all these remain as unclear as it ever was.
The health, financial and sexual orientation related information is presently identified as Sensitive Personal information under ITA 2000/8 and that continues to remain in operation.
In other words, even after this 9 member bench report, if we need to look at a “Definition of Privacy” we need to look at what is “Personal Information” under Section 72A or 43A of ITA 2008 or Sensitive personal information under Section 43A of ITA 2008 and the rules there under.
Hence ITA 2008 continues to define “Information Privacy” and not the Indian Constitution Part III nor this judgement.
On the other hand, Rights to Privacy outside the “Information domain” continues to remain an enigma since we donot have any new definition of what is “Privacy”. The earlier concept of “Right to be Left Alone” continues to be our guide.
When we look at Privacy as “Right to be left alone”, the main focus is on the “Physical Privacy” which was a subject matter of Kharak Singh judgement, a right against interference of physical space of an individual.
Cyber Privacy
This definition (Privacy as a Right to be left alone) fails in the context of “Cyber World” where Cyber bullying and Cyber Stalking do occur without physical proximity.
Does “Virtual Proximity” is equal to “Physical Proximity”? …could have been one aspect that the bench could have considered but failed.
In the recent “Blue Whale Challenge” issue, does it constitute “Violation of Cyber Privacy”? … would have been another interesting debate which the 9 Judges missed.
While “Physical Privacy” can be defined as coming within “Touching distance” between two individuals, we still need to define whether “Touching distance” is zero cms or 5 or 10 centimeters and whether the distance has to be different for different body parts. Additionally, exception has to be made for Mumbai locals where physical privacy is most of the time less than zero cms.
“Cyber Privacy” depends on “Informational Proximity” and we can devise means of defining this. For example, in Facebook, “Friends” should have more accessibility than public. Similarly in Whats App group, the group members should have more proximity than e-mail contacts.
Hence some thing said in a Whats App group may not be a privacy invasion where as the same thing said in an e-mail could be. Some comment passed by a “Friend” in Face book may not be a Privacy objection where as the same comment made by a non-friend could be.
Presently neither our Judiciary nor Police make distinction of who made a comment and whether the comment was made in a restricted group (eg Whats App) or in public place (eg Twitter, website) before charging them under defamation or obscenity etc. They will continue to make the same mistake under Privacy invasion also.
There was also no debate on Anonymity, Pseudonomity or “Regulated Anonymity” either as components of Information Privacy or as solutions to privacy protection. Neither the petitioners nor the Government attorneys nor the advisers to the Judges brought out such issues as part of the Privacy debate.
The bench had an opportunity to debate such issues instead of simply debating earlier judgments, cutting and pasting the previous judgments into the current judgement and making it a 547 page volume.
Privacy as a Mental State
In my opinion, “Privacy” is a “State of mind”. A person may be amidst a crowd and still feel his privacy is not invaded. On the other hand he may be sitting in a closed room but filled with anxiety that his privacy is being invaded.
“Mental Privacy” as a “State of Mind” of one individual is outside definition of the Physical definition of “Right to be left alone” or “Right to control dissemination of of privacy information”,.
It is also outside the definition of Cyber Privacy as “Keeping a certain virtual distance”.
It is for each individual to declare what are his/her mental privacy boundaries.
Section 66A of ITA 2008 which was scrapped, did have a link to such concept but the Supreme Court which handled the Shreya Singhal Case did not understand it.
Most Cyber Stalking victims have a psychological condition where what is not “Privacy Invasion” for most may be considered by them as “Privacy Invasion”. This is a “Deemed Privacy Invasion” and would be a factor to be considered in the “State of the Mind” definition.
Under this concept Privacy boundaries would be different from a Man and Woman, Boy and Girl, Friend and Stranger, from a relative to a non relative, from a City bred person to a Villager and so on.
Using one yard stick for all would not be a good idea.
Without being able to define “Privacy” any attempt to grant a “Right” and call it “Fundamental” appears to be a fruitless exercise.
The Data Protection Legislation
Now when the new Data Protection law comes into being, it will again use the definition of “Personal Information” and “Sensitive Personal Information” as used in ITA 20008 and define what constitutes “Breach of Privacy of an individual through his information”. It will be a repetition of what is already there.
The Privacy of information in oral form or in hand written paper form would be outside the Data Protection Act or ITA 2008 and since there is no definition in the Constitution, we will not have any clarity on this issue.
In the absence of law for non electronic information, when a hand written diary of a person is accessed by another, he has to move the High Court or Supreme Court as a “Constitutional Right” and claim compensation.
On the other hand, had the Nine Member bench advised the Government to amend the constitution and add “Privacy” as a specific right along with a definition, then there would have been progress in Privacy legislation in India. This was missed by the bench.
In this context, the 547 magnum opus is a great effort but of little practical utility for the Citizens.
Impact on Corporate Entities
The Corporate entities and Others who collect information from public in electronic form are today covered under ITA 2000/8. They have “Privacy Principles” equivalent to the international practices . ITA 2000/8 defines data protection in terms of a need to obtain consent and enter into a contract with the data subject.
The current judgement has no impact on this corporate handling of personal data.
One of the judges has briefly mentioned GDPR without naming it. But even he has not proceeded further to discuss what would be the impact of overlapping international privacy legislation on an Indian Corporate entity bound by the Indian laws on Privacy.
Does Indian law apply only to Indian subjects and international laws apply only to those international citizens based on their individual nationalities?.
It could be an interpretation. But the bench did not find it necessary to address such practical problems faced by the industry in India.
This is another point fo failure of this high profile decision.
Summary
Overall therefore I am disappointed with the Judgement and consider it as a “Lost Opportunity” to bring clarity to the Privacy regime in India.
( I welcome a debate on the subject and look forward to comments from other experts)
Naavi
By Vijayashankar Na
Filed Under Cyber Law
| No Comments»
In continuation of our previous article on the “Hashing of the Privacy Judgement” we can now look at the six pieces of individual judgement and the end notes in each of these judgement s that can be considered as “Judgmental Conclusions not forming part of the final order”. This is the second level of the 547 page judgement that we can try to explore.
Before penning down these end-notes, the judges who authored their respective parts of the judgement have presented pages and pages of observations basically recollecting the earlier judgements. Technologists should appreciate the huge efforts involved in “Cutting and Pasting” from volumes of judgements from the early part of the last century to the current days not only in the honourable Supreme Court but also other Courts as well.
Many of these judgements were from other qualified Judges mostly by smaller benches or subordinate Courts. Hence the current consolidation represents an over riding of earlier contrarian opinions and brings the development of Jurisprudence on Privacy Rights in India to a mile-stone stage.
In particular, two judgements namely M.P Sharma (1954) and Karakh Singh (1964) judgements were declared as over ridden. the first – M P Sharma v Satish Chandra, District Magistrate, Delhi1 was rendered by a Bench of eight judges and the second, in Kharak Singh v State of Uttar Pradesh was rendered by a Bench of six judges. These decisions, contained observations that the Indian Constitution does not specifically protect the right to privacy. They were based on the principles expounded in A.K.Gopalan Vs State of Madras (1950) which construed each provision contained in the Chapter on fundamental rights as embodying a distinct protection. This principle had already been over turned by an 11 member bench in Rustom Cavasji Cooper v Union of India.(1970)(Popularly known as the Bank Nationalization Case).
Hence part of this 9 member bench in this case which can be referred to as the Puttaswamy case was only reiterating that M P Sharma and Kharak Singh Judgements had already been over ridden in the Cooper judgement if we had not realized it. Since Cooper Judgement was a 11 member bench, there was no way this 9 member bench could over turn it. Had the CJI wanted it to be over turned, he would not have constituted a 9 member bench at all. Hence it was known from the beginning that M P Sharma and Kharak Singh judgements were out of contention and Cooper was in.
The consequence of the Cooper decision according to the Chandrachud (Part I) part of the judgement is that a law which restricts the personal liberties contained in Article 19 (Freedom of Expression) must meet the test of permissible restrictions contemplated by Clauses 2 to 6 in relation to the fundamental freedom which is infringed.
These restrictions are stated as follows:
Nothing in sub clause (a) of clause ( 1 ) namely that All citizens shall have the right to freedom of speech and expression; shall affect the operation of any existing law, or prevent the State from making any law, in so far as such law imposes reasonable restrictions on the exercise of the right conferred by the said sub clause in the interests of the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, public order, decency or morality or in relation to contempt of court, defamation or incitement to an offence… etc
In this background, we can now concatenated all the end notes in the Six parts of the judgement as follows.
Part-I (Chandrachud, Kehar, Agarwal, Nazeer) : Conclusions:
1 The judgment in M P Sharma holds essentially that in the absence of a provision similar to the Fourth Amendment to the US Constitution, the right to privacy cannot be read into the provisions of Article 20 (3) of the Indian Constitution. The judgment does not specifically adjudicate on whether a right to privacy would arise from any of the other provisions of the rights guaranteed by Part III including Article 21 and Article 19. The observation that privacy is not a right guaranteed by the Indian Constitution is not reflective of the correct position. M P Sharma is overruled to the extent to which it indicates to the contrary.
2 Kharak Singh has correctly held that the content of the expression ‘life’ under Article 21 means not merely the right to a person’s “animal existence” and that the expression ‘personal liberty’ is a guarantee against invasion into the sanctity of a person’s home or an intrusion into personal security. Kharak Singh also correctly laid down that the dignity of the individual must lend content to the meaning of ‘personal liberty’. The first part of the decision in Kharak Singh which invalidated domiciliary visits at night on the ground that they violated ordered liberty is an implicit recognition of the right to privacy. The second part of the decision, however, which holds that the right to privacy is not a guaranteed right under our Constitution, is not reflective of the correct position. Similarly, Kharak Singh’s reliance upon the decision of the majority in Gopalan is not reflective of the correct position in view of the decisions in Cooper and in Maneka. Kharak Singh to the extent that it holds that the right to privacy is not protected under the Indian Constitution is overruled.
3
(A) Life and personal liberty are inalienable rights. These are rights which are inseparable from a dignified human existence. The dignity of the individual, equality between human beings and the quest for liberty are the foundational pillars of the Indian Constitution;
(B) Life and personal liberty are not creations of the Constitution. These rights are recognised by the Constitution as inhering in each individual as an intrinsic and inseparable part of the human element which dwells within;
(C) Privacy is a constitutionally protected right which emerges primarily from the guarantee of life and personal liberty in Article 21 of the Constitution. Elements of privacy also arise in varying contexts from the other facets of freedom and dignity recognised and guaranteed by the fundamental rights contained in Part III;
(D) Judicial recognition of the existence of a constitutional right of privacy is not an exercise in the nature of amending the Constitution nor is the Court embarking on a constitutional function of that nature which is entrusted to Parliament;
(E) Privacy is the constitutional core of human dignity. Privacy has both a normative and descriptive function. At a normative level privacy sub-serves those eternal values upon which the guarantees of life, liberty and freedom are founded. At a descriptive level, privacy postulates a bundle of entitlements and interests which lie at the foundation of ordered liberty;
(F) Privacy includes at its core the preservation of personal intimacies, the sanctity of family life, marriage, procreation, the home and sexual orientation. Privacy also connotes a right to be left alone. Privacy safeguards individual autonomy and recognises the ability of the individual to control vital aspects of his or her life. Personal choices governing a way of life are intrinsic to privacy. Privacy protects heterogeneity and recognises the plurality and diversity of our culture. While the legitimate expectation of privacy may vary from the intimate zone to the private zone and from the private to the public arenas, it is important to underscore that privacy is not lost or surrendered merely because the individual is in a public place. Privacy attaches to the person since it is an essential facet of the dignity of the human being;
(G) This Court has not embarked upon an exhaustive enumeration or a catalogue of entitlements or interests comprised in the right to privacy. The Constitution must evolve with the felt necessities of time to meet the challenges thrown up in a democratic order governed by the rule of law. The meaning of the Constitution cannot be frozen on the perspectives present when it was adopted. Technological change has given rise to concerns which were not present seven decades ago and the rapid growth of technology may render obsolescent many notions of the present. Hence the interpretation of the Constitution must be resilient and flexible to allow future generations to adapt its content bearing in mind its basic or essential features;
(H) Like other rights which form part of the fundamental freedoms protected by Part III, including the right to life and personal liberty under Article 21, privacy is not an absolute right. A law which encroaches upon privacy will have to withstand the touchstone of permissible restrictions on fundamental rights. In the context of Article 21 an invasion of privacy must be justified on the basis of a law which stipulates a procedure which is fair, just and reasonable. The law must also be valid with reference to the encroachment on life and personal liberty under Article 21. An invasion of life or personal liberty must meet the three-fold requirement of (i) legality, which postulates the existence of law; (ii) need, defined in terms of a legitimate state aim; and (iii) proportionality which ensures a rational nexus between the objects and the means adopted to achieve them; and (I) Privacy has both positive and negative content. The negative content restrains the state from committing an intrusion upon the life and personal liberty of a citizen. Its positive content imposes an obligation on the state to take all necessary measures to protect the privacy of the individual.
4 Decisions rendered by this Court subsequent to Kharak Singh, upholding the right to privacy would be read subject to the above principles.
5 Informational privacy is a facet of the right to privacy. The dangers to privacy in an age of information can originate not only from the state but from non-state actors as well. We commend to the Union Government the need to examine and put into place a robust regime for data protection. The creation of such a regime requires a careful and sensitive balance between individual interests and legitimate concerns of the state. The legitimate aims of the state would include for instance protecting national security, preventing and investigating crime, encouraging innovation and the spread of knowledge, and preventing the dissipation of social welfare benefits. These are matters of policy to be considered by the Union government while designing a carefully structured regime for the protection of the data. Since the Union government has informed the Court that it has constituted a Committee chaired by Hon’ble Shri Justice B N Srikrishna, former Judge of this Court, for that purpose, the matter shall be dealt with appropriately by the Union government having due regard to what has been set out in this judgment.
Justice Chelmeshwar has not recorded any separate para as “Conclusions”. Hence his conclusion is contained in the final order only. He has generally agreed with the conclusions arrived at Part I.
a. The ineluctable conclusion must be that an inalienable constitutional right to privacy inheres in Part III of the Constitution. M.P. Sharma and the majority opinion in Kharak Singh must stand overruled to the extent that they indicate to the contrary.
b. The right to privacy is inextricably bound up with all exercises of human liberty – both as it is specifically enumerated across Part III, and as it is guaranteed in the residue under Article 21. It is distributed across the various articles in Part III and, mutatis mutandis, takes the form of whichever of their enjoyment its violation curtails
c. Any interference with privacy by an entity covered by Article 12’s description of the ‘state’ must satisfy the tests applicable to whichever one or more of the Part III freedoms the interference affects.
This reference is answered by stating that the inalienable fundamental right to privacy resides in Article 21 and other fundamental freedoms contained in Part III of the Constitution of India.
M.P. Sharma (supra) and the majority in Kharak Singh (supra), to the extent that they indicate to the contrary stand overruled.
The later judgments of this Court recognizing privacy as a fundamental right do not need to be revisited.
These cases are, therefore, sent back for adjudication on merits to the original Bench of 3 honourable Judges of this Court in light of the judgment just delivered by us.
Justice Sapre also has not captioned any paragraph as a “Conclusion” but has identified two specific points of reference and went ahead to give his views there on.
They are
(1) whether the law laid down in the case of M.P.Sharma and others vs. Satish Chandra, District Magistrate Delhi & Ors., AIR 1954 SC 300 and Kharak Singh vs. State of Uttar Pradesh & Ors. AIR 1963 SC 1295 insofar as it relates to the “right to privacy of an individual” is correct and
(2) whether “right to privacy” is a fundamental right under Part III of the Constitution of India?
His views are
1) I entirely agree with their reasoning and the conclusion on question No. 1 (given by others)
2) ..my answer to question No. 2 is that “right to privacy” is a part of fundamental right of a citizen guaranteed under Part III of the Constitution. However, it is not an absolute right but is subject to certain reasonable restrictions, which the State is entitled to impose on the basis of social, moral and compelling public interest in accordance with law….I also hold that the “right to privacy” has multiple facets, and, therefore, the same has to go through a process of case-to-case development as and when any citizen raises his grievance complaining of infringement of his alleged right in accordance with law.
Justice Kaul has also not specifically noted any “Conclusion” but has made a few important observations.
I am in agreement with the view of Dr. D.Y. Chandrachud, J., who in paragraphs 123 & 124 of his judgment, states that the right of privacy cannot be denied, even if there is a miniscule fraction of the population which is affected.
Let the right of privacy, an inherent right, be unequivocally a fundamental right embedded in part-III of the Constitution of India, but subject to the restrictions specified, relatable to that part. This is the call of today. The old order changeth yielding place to new.
If we observe all these concluding remarks together, the majority opinion which is “Unanimous” is that “Privacy is a Fundamental Right subject to Resalable Restrictions”.
There are many other observations buried inside the pages of this judgement which could be quoted in other litigations in due course as ” views of a Judge in the famous Puttaswamy case”. These will however be “Observations not forming either individual judgements or the Final Order” and will be seen as the third level of what this judgement implies.
Observations which are not part of the final order or individual conclusions may have a limited practical judicial value since they have been deliberately omitted in the conclusions or the final order.
Other observations such as the one on LGBT rights etc are not majority opinions and not also part of the order. Aadhaar has not been specifically commented upon since another bench is anyway looking into it.
Now, the next question that we need to discuss is what will be the take home for the stake holders on account of this Puttaswamy judgement?
Judges are happy about the excellent media coverage that they have got because of this judgement. They have got as much TRP as the media channels. Constitutional experts who practice in High Courts/Supreme Courts are happy that there could be a number of cases they can file directly at the High Courts and Supreme Courts and enjoy locking up our judicial system in a plethora of litigations. Academicians will be happy with the bundle of case laws that can be discussed and re-discussed in class rooms and conferences. It is a Win-Win-Win situation for all.
But at the end of this short term celebration, we need to examine the impact of this judgement on the real stake holders of “Privacy” which we shall explore in subsequent article.
There are three different stake holders to this “Privacy Issue” namely
a) The Citizen of the Country who should feel that he has a “Right to Privacy” in whatever manner the Constitution understands it.
b) The Government which makes laws and uses services such as Aadhaar which may have an indirect association with the principle of “Privacy”
c) The business entities which use services that have a direct and indirect association with the principle of “Privacy”.
Let’s continue our debate…after a break…because we may have some thing more in the interim to discuss on Infosys Saga….
Naavi
By Vijayashankar Na
Filed Under Cyber Law
| No Comments»
(This is in continuation of our discussion on Justice Chelmeshwar’s part of the judgement in the Privacy case)
While the nine eminent judges went about their mission to declare “Privacy As a Fundamental Right”, they also encountered the problem defining what is “Privacy”.
The challenge of defining Privacy Rights without a definition of Privacy has confronted law makers as well as law followers which has not been appreciated much in the past. Now it is interesting to see that even the nine judges are unable to agree on how to define “Privacy Right”.
Justice Chelmeshwar uses his Judicial freedom to
-first admit that ” Whether it is possible to arrive at a coherent, integrated and structured statement explaining the right of privacy is a question that has been troubling scholars and judges in various jurisdictions for decades.” and
-then to say “In my opinion, there is no need to resolve all definitional concerns at an abstract level to understand the nature of the right to privacy….Definitional uncertainty is no reason to not recognize the existence of the right of privacy….“.
He then concludes that “for the purpose of this case, it is sufficient to go by the understanding that the right to privacy consists of three facets i.e. repose, sanctuary and intimate decision. Each of these facets is so essential for the liberty of human beings”.
These three facets “repose”, “Sancturary” and Intimate Decision” are picked from academic concepts postulated by a US author Bostwick.
“Repose” refers to freedom from unwarranted stimuli, “sanctuary” to protection against intrusive observation, and “intimate decision” to autonomy with respect to the most personal life choices. All these are covered under the concept of Privacy being “Right to be Left Alone”.
Unfortunately, the definition does not form part of the order and is not handled similarly by other Judges. Hence it remains one of the opinions of the nine judges.
This means that search for an acceptable definition of Privacy continues even after this judgement.
Though Privacy Invasion is recognized from State as well as Individuals and Companies, the judgement does not provide proper guideline on how the stake holders need to respond.
Of course it is understood that the Government cannot make any laws that infringes on the Privacy Rights subject to “Reasonable Restrictions” as per Article 19 of the Constitution.
However, when Privacy invasion occurs either by the State or another individual or a Company, there is no wisdom on how the affected individual would be compensated. For this we need to await a law from the Government.
Presently law is being contemplated on “Data Protection” which is not directly equal to “Privacy Protection”. In the absence of an agreed definition of Privacy, it is not easy to define what information/data can be considered as “Relevant for Privacy Protection” and has to be protected in the Data Protection Act.
Other judges have used the term “Information Privacy” to identify personal information in data form and state that “Right to control collection and dissemination of such personal information” is “Privacy Rights in the Data world”.
This is acceptable for the Privacy Protection in data form but inadequate when protection of Privacy is to be considered when information is handled orally or through non electronic written form.
The Judgement does not clarify this and therefore the Government formulating Data Protection Act or Companies and Individuals who look at ITA 2008 for Privacy protection in data form are not wiser when privacy has to be protected in non-eelctronic form.
Additionally, several stray aspects of life are loosely cited as examples that may define different facets of Privacy. For example, Justice Chelmeshwar reflects on ” Decision to stop medical treatment by a patient” or a decision of a woman to bear or not bear a child, or abort pregnancy as Privacy issues. The reflections go on into many other areas including right to work and chose the type of work, right to travel, right to chose a place of residence, as other areas where the principles of Privacy can be extended.
Justice Chelmeshwar has even delved into political issues by commenting
“I do not think that anybody would like to be told by the State as to what they should eat or how they should dress or whom they should be associated with either in their personal, social or political life.”
Similarly other judges have included the Right to sexual orientation as part of Privacy in their reflections.
By making such comments in the body of the judgement, all these issues are being projected as part of “Privacy Rights” which in future will come up to Supreme Court in the form of writ petitions from the Citizens of India trying to protect their fundamental rights.
No doubt that this is a feather in the cap of Indian democracy that our Judiciary considers that an information that if I post in my WhatsApp that “I ate Masala Dosa at Vidyarthi Bhavan today ” and some body forwards it outside, it can be contested as “Violation of my Privacy Rights”. But.. is this what Privacy Right protection all about?
Adding these reflections in the Judgement without a proper confirmation on either acceptance or rejection of the same by a majority of judges as a part of the final order has only brought in more confusion to the public and was completely avoidable.
Now individuals and companies are placed in a dilemma if these individual reflections are to be treated as part of the order or ignored. This will only help frivolous litigations in future from which no body but the Privacy advocates benefit.
Considering the vague reflections included in the judgement, it would not be surprising if tomorrow, in a divorce case, husband or wife may claim “Privacy Right” not to be “husband and wife” or “Transfers in Jobs” may be contested as “Right to Privacy” and so on. The capacity of this judgement leading to nuisance litigations is very high because of the numerous reflections being made part of the judgment document though they are not part of the final order.
For the time being, it may therefore be better to ignore these stray comments since they are not part of the final order or form a majority common decision. Government when it frames the Data Protection law should not give weightage to all these different instances of life as “Privacy Issues” and make life unbearable.
In these facets, the Judgement reflects an attitude of the Court to consider the judgement as an erudite academic essay without the need for concluding it properly with either acceptance or rejection of a point of view.
Similarly when a decision of multiple judges are involved, if individual opinions are not consolidated into groups with indication of which judge agrees or rejects the issue, and further export it into the final order, the communication to the public remains incomplete.
As a result, after such a judgement, stake holders are not wiser than what they were before. Perhaps they are more confused than before.
The “uncertainty” created out of such “Vague” judgments can be avoided if Judges consider that a Judgement is not written to show case how much the Judge knows about a subject but how much the public needs to know in solving a legal problem.
[P.S: I am aware that it is not customary for anybody to make comments on the judgement particularly when it comes from the highest Court of the land.
But in the hope of Courts rendering judgments which can be read and understood by common people without the need for intermediaries, I have found it necessary to express these views.
Commercially, if there is more the confusion in the market, better it is for consultants like us because some body is needed to interpret the interpretations rightly or wrongly and present it again to some other Court so that debate can continue.
But law is not meant for creating commercial value to consultants and lawyers. Law has to be simple and understandable by the Citizens and other stake holders so that they can comply with them without the assistance of a third party.
Voluntary compliance will suffer if law is vague and complicated and the trend has to change towards law being lucidly explained. This may not be possible in the writing of the law but it is possible in the judgement. Hence even if Law can be vague but Judgement should be precise. I hope we will see short and precise judgement particularly when it involves concepts that need to be understood by Citizens and adopted as part of their life styles.
The touch stone of the “Privacy Judgement” is whether this judgement can be understood by the common man on the street who is the subject who has to enjoy “Privacy” as a “Fundamental Right”. If “Privacy Law” is meant to be understood as a PG Diploma course, then Law of Privacy will remain an elite concept and does not reach to the masses.]
Naavi
By Vijayashankar Na
Filed Under Cyber Law
| No Comments»
Does ITA 2000/8 address “Privacy Protection” and if so, does it do it effectively is a question that is lingering in the industry. It will continue to be a point of debate for the amended ITA 2017 (p). …This is in continuation of the discussions on the proposed amendments to ITA 2000/8 presently being discussed by an expert committee headed by Mr T.K.Vishwanathan. ….. Naavi
Protecting the Right to Privacy of an individual is a fundamental right claimed by citizens living in a democratic society and is closely associated with the right to freedom of expression, right to information and security. India has recognized the need for Privacy by interpreting the Article 21 of our constitution favourably but has not yet enacted a separate law which says “Privacy is right protected under law and any violation thereof leads to civil and criminal liabilities”. It is also not likely that in the near future any specific law will be passed in this regard.
However, ITA 2000 and more specifically ITA 2008 has addressed many concerns of Privacy Protectionists without being recognized as a “Privacy Protection Legislation”.
What ITA 2000/8 has done is to provide protection to the “Data” which indirectly protects the “Privacy”. Without being too obsessive, it is better if we recognize the role of ITA 2000/8/17(p) as the principle legislation for protecting the Privacy for which it is eminently suited particularly if a few minor changes are accommodated in the proposed amendments.
“Privacy” of a person is defined as a “Right to determine what amount of personal information should be made public”. It should be a right that can be exercised only by the individual (provided he is in a state of mind where he can exercise that control as per the requirements of law). Every other person who comes into possession of Personal Information should follow the universal principles of privacy protection such as “Disclosure of Privacy Policy”, “Obtaining Consent”, “Collection under minimum and specific use principles”, “Protecting the information on hand” and “destroying” it when no longer required.
An effective law defines the rights, prescribes the punishments for violation and introduces mechanism for effective implementation.
Let us see how ITA 2000/8 address these issues and what can be done further to strengthen the Privacy Protection under ITA 2017 (P), equating “Privacy Protection” with “Data Security” for the current discussion.
The first task of law is to define the “Privacy Right”. In the context of its alter-ego of data security, Privacy Right gets defined by defining “Personal Information” that qualifies for protection.
Under ITA 2000/8 we have defined what is “Sensitive Personal Information” (SPI) without defining “Personal Information”. (PI). SPI was defined in ITA 2008 along with Section 43A which brought an obligation on the “Body Corporates” handling SPI to protect it with “Reasonable Security Practice”.
Though PI is not defined, Section 72A accords protection to PI and makes its breach a punishable offence with 3 years imprisonment.
Additionally, Section 43 read with Section 66 imposes penalties when the “Value of information is diminished” (which can be an effect of privacy breach).
Also Section 69/69A/69B while providing powers to some officials for interception, decryption and data mining, puts a bar on the others to do the same without attracting penalties.
Section 79 imposes the responsibility of Privacy protection on the “intermediaries” in clear terms through the rules of due diligence.
Grievance redressal is defined with reference to the provisions of due diligence under Section 79 and also by instituting the Adjudication and Cyber Appellate Tribunal (CyAT).
While we can debate the adequacy of these provisions in comparison to the EU standards such as the GDRP or US Standards such as the HIPAA, we cannot but acknowledge that ITA 2000/8 has covered most of the requirements of Privacy Protection (In the context of Data protection).
Without therefore saying so, ITA 2000/8 therefore provides protection of Personal Information. It is possible that some may not realize it until a separate act is legislated but it is not necessary.
It must be noted that under ITA 2000/8, any information which is processed in a computer device or meant to be processed in a computer device also is “Information”.
Hence it is possible to extend the “Data Protection Rights” as is available in different forms under Section 43, 43A, 66, 72,72A, 69, 69A, 69B, 7A, etc to information which is in a form other than as “Electronically Written”, such as “Voice which is Electronically spoken or meant to be processed in an electronic device”. This can extend “Privacy Protection” to “Voice” in certain circumstances.
The perception in the industry however is different. Most of the IT professionals in India think India does not have an adequate Privacy protection provisions in the country and cannot defend the regime with their EU counterparts. Probably they are interpreting the failures in implementation as failure of law and hence the clamour for a separate Privacy Protection Act has continued.
It is therefore an opportunity now to address some of these concerns in the proposed amendments for which some suggestions can be discussed.
Perhaps, a chapter can be dedicated in the ITA 2017(P) with the title “Privacy and Data Protection” where some provisions of Privacy and Data Protection is specifically mentioned. This will provide the required confidence to professionals who compare Indian legislation to EU legislation.
Defining Personal Information
One of the requirements that is perhaps required is to upgrade the definition of “What is Personal Information” from what is provided in the rules to Sec 43A, which states
“Personal information” means any information that relates to a natural person, which, either directly or indirectly, in combination with other information available or likely to be available with a body corporate, is capable of identifying such person.
This definition is restrictive to data with the Body Corporates and the Section 43A also restricts itself to Body Corroborates.
An improved definition that should be added in the Act itself to be applicable for all sections including Section 72A could be
“Personal Information” of an individual means any information related to a living person who is not a minor, or of unsound mind or an undischarged insolvent, which when in possession of a third person is capable of being used to identify the individual by such third person with reference to the individual’s Name and Physical location.
By defining the Personal Information in the above manner, we will be letting a “Netizen” preserve his “Anonymity and Pseudonomity” subject to certain conditions. Mere assumption of a “Pseudonym” or “Anonymous identity” on the information space would not be an offence unless such alter-identity is used to commit an offence.
Whenever an “Information” is required for “Law Enforcement” which means that there is a prima facie evidence that the information is suspected to be a “Tool of Crime”, the protective veil has to be lifted.
The focus of the regulation will be to introduce a due process under which alone the “Privacy Veil” is removed.
Also under this definition, “Right” ceases when a person loses his capacity to enter into valid contracts. This means that there is no “Privacy Right” of a person who has lost his mental capacity to take decisions. Of course how this has to be determined and by whom needs to be defined in law. Such issues are already addressed under HIPAA and should not be difficult.
Establishment of a “Privacy Board”:
In order to adjudicate on the Privacy issues, the current system of adjudication/CyAT may continue where the fact of a wrongful act is not under serious challenge. Where there are serious doubts as to whether an information should be subject to privacy or not, a “Privacy Board” may be constituted as a “Reference Advisory Body” to which the Adjudicator may refer an issue of a “Request for lifting of the Privacy Veil” or “Defence an alleged violation of Privacy Right by disputing the nature of information as not being subject to the protection”. Such a “Privacy Body” may be headed by the NHRC Chair person and may have representation of the Ministries of Home Affairs, Defense, Information Technology, Netizen/Privacy Right Activists etc.
Once the issue of proper “Definition” and the “Privacy Controller” is established, other aspects of protection can be defined in an acceptable manner.
Preventing International Abuse
The privacy laws just like IPR laws of some of the foreign countries are designed in such a manner that they can be used effectively to control business flow over riding the principles of free trade.
If India does not recognize this and take some steps within our own laws to ensure that Indians are protected against unfair foreign laws, we will be letting foreign forces build “Information Colonies” in India. We have seen how Mr Donald Trump has already protected the US interests by restricting the US privacy protection only for US citizens. India needs to also protect its interests in a similar manner against exploitation of Indian interests through unfair and excessive privacy regulation of foreign Governments.
For this purpose, it must be made mandatory that whenever a foreign entity has to invoke a Privacy Law against an Indian Company or individual (including the GDPR or HIPAA etc), prior clearance of the Privacy Board is required.
This will ensure that unfair and unreasonable business restrictions are not imposed on Indian entities in the guise of protecting “Privacy” .
An appropriate mechanism of Arbitration can be instituted by the Privacy Board to ensure that there is proper conduct on both sides and there is no scope for unfair use of privacy laws by international players.
These could be part of the new amended ITA 2017 and I urge the Committee to look into these suggestions seriously.
I wish organizations such as DSCI which celebrate the “Data Privacy Day” also do some thing more concrete in this direction.
Naavi
By Vijayashankar Na
Filed Under Cyber Law
| 1 Comment»
From the 1st of August 2016, the new Privacy Shield regime in US-EU data market space has come into operation. This has replaced the “Safe Harbor” regime that was declared as ineffective by the Court of Justice of EU (CJEU) in October 2015.
This new Privacy Shield will provide the framework for EU-US personal data transfers from now on and will work concurrently with the alternatives such as the BCR (Binding Corporate Rules), SCC (Standard Contractual Clauses of EU) and the CBPR (Cross Border Privacy Rule).
Relevance to Indian IT Companies
These EU-US developments will also apply to the data processing that happens in India either because the data transfering customer is an EU country or that these will emerge as general standards of the industry. Hence a general understanding of these principles is essential for Indian companies engaged in data processing activities involving “Personal Data” of non Indian Citizens.
As regards the data of the Indian Citizens, the ITA 2000/8 imposes its own obligations under Section 43A (For sensitive personal information), Section 72A (For all personal information) besides other provisions that apply to “Data” in general. The key aspect of the Indian law is that it provides legal backing to the contractual agreements between an Indian data processor and the foreign data vendor. Hence whether it is the Privacy Shield obligations or the BCR/SCC/CBPR obligations, they all get extended to Indian processors and become enforceable under the Indian law.
Indian companies therefore have to be completely alert to the developments in the EU-US data exchange scenario and follow it in India as the best Privacy practice particularly when processing of international data is involved. Since it is impractical to maintain one set of privacy standards to data of foreign nationals and another to Indian nationals, companies need to adopt the international standards for all personal data irrespective of whether it is pertaining to an Indian citizen or a foreign citizen.
This should establish the relevance of the new US-EU Privacy Shield regimes and the other frameworks to the Indian context.
What is Personal Information?
In Indian law, the rules under Section 43A define personal information as
” any information that relates to a natural person,which, either directly or indirectly, in combination with other information available or likely to be available with a body corporate, is capable of identifying such person. “
In comparison, the “Sensitive Personal Information” is such personal information that contains any of the following type of information.
(i) password;
(ii) financial information such as Bank account or credit card or debit card or other payment instrument details ;
(iii) physical, physiological and mental health condition;
(iv) sexual orientation;
(v) medical records and history;
(vi) Biometric information;
(vii) any detail relating to the above clauses as provided to body corporate for
providing service; and
(viii) any of the information received under above clauses by body corporate for
processing, stored or processed under lawful contract or otherwise:
In contrast the EU definition of Personal Information is contained in the following form
“‘personal data’ shall mean any information relating to an identified or identifiable natural person (‘data subject’); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;”
The EU definition appears broader than the Indian definition but we can assume that for practical purposes both mean the same. (Refer for details here)
However, it must be remembered that under European law, data is considered ‘transferred’ when it is either physically transferred to another country (i.e. to be stored in a data centre on that territory) or when a person residing in another country accesses the data from that country. It is therefore an extremely broad concept that may apply even if personal data is technically stored within the EEA.
Hence the EU guidelines will become applicable in all cases where data is actually transferred to servers outside EU or when access is provided.
Essence of Privacy Shield
Privacy Shield principles are not much different from the general principles which are being followed in Safe harbor principle, there are a few significant differences that we need to take note of mainly in the enforcement of the provisions.
Stronger Supervision:
The intent of Privacy Shield is to transform the oversight system from self-regulating to one that is more responsive and proactive. The certification and annual re-certification process will remain unchanged, but the Department of Commerce will actively monitor compliance through detailed questionnaires, among other things.
Additionally, the FTC will maintain a “wall of shame” for companies that are subject to FTC or court orders in Privacy Shield cases.
Redressal Mechanism
Any EU citizen who believes that his or her data has been misused will have several redress possibilities under Privacy Shield. Among them, EU citizens will be able to report complaints directly to their local Data Protection Authorities. Redress mechanisms include established timelines for responses by a subject company. Privacy Shield also creates a new arbitration right for unresolved complaints.
Limitations imposed on US public bodies
There will be clear limitations, safeguards, and oversight mechanisms for access by public authorities for law enforcement and national security purposes. A new redress mechanism will inform a complainant whether an access or surveillance matter has been properly investigated and that either U.S. law has been followed or has been remedied in the case of non-compliance.
Steps to Certify
The subject Company should firstly develop and maintain a Privacy or Privacy Shield policy based on the following principles of certification under the EU-U.S. Privacy Shield, which includes
A Privacy Shield company must maintain adequate and reasonable administrative, technical, and physical safeguards and controls designed to address appropriate security requirements for U.S. and EU applications that capture or process data within the scope of the certification.
Following a review of existing contracts, the contracts with the downstream Business Associates must be updated to addresses the specific Privacy Shield wording requirements.
Training of manpower to update them on the requirements of the Privacy Shield requirements need to be undertaken.
Documentation supporting the company’s Privacy Shield certification (e.g., policies and procedures, gap assessment report, and contract addendum) should be prepared/compiled and included in a compliance binder.
Registration
Companies who decide to adopt the Privacy Shield must register themselves with the International Trade Administration of the US department of Commerce and subject themselves to the self certification process involving completion of the required questionnaires.
Presently it is reported that 200 companies have signed up for the process in the first month when the registration started. Others may be weighing the need for registration vis a vis their present privacy practices which may have incorporated other measures such as BCR, SCC or CBPR.
Alternatives to Privacy Shield
BCR:
BCR or Binding Corporate rules are internal rules adopted by multi national group companies which define the global policy with regard to the international transfers of personal data within the same corporate group to entities located in countries which do not provide an adequate level of protection. Once approved under the EU cooperation procedure, BCR provide a sufficient level of protection to companies to get authorisation of transfers by national data protection authorities (“DPA”). BCR does not however provide a basis for transfers made outside the group.
EU Standard Contractual Clauses
The Council and the European Parliament have given the EU Commission the power to decide, that certain standard contractual clauses offer sufficient safeguards as required.
The Commission has so far issued three sets of standard contractual clauses
Adoption of these standard clauses could be considered if found suitable.
CBPR (Cross Border Privacy Rules of APEC)
The APEC Cross Border Privacy Rules (CBPR) system helps bridge the differences in privacy rules between different countries by providing a single framework for the exchange of personal information among participating economies in the APEC region.There are currently three participating APEC CBPR system economies: USA, Mexico and Japan, with more expected to join soon.
The APEC Electronic Commerce Steering Group (ECSG) and the EU Article 29 Working Party have produced a common referential for the requirements of the APEC CBPR system and the EU Binding Corporate Rules.
Participating companies are required to adhere to the standards established by the APEC CBPR system. All APEC CBPR system certified companies have their privacy policies and practices evaluated by an approved independent third party verifier (known as an “Accountability Agent”). Accountability Agents monitor and enforce companies’ compliance with the APEC CBPR program requirements. In appropriate cases, they are also required to report non-compliance to Privacy Enforcement Authorities.
Final Word
The mechanisms such as the Privacy Shield, BCR, SCC or CBPR are different framework approaches to manage the privacy concerns when data from one country flows across to another and there could be differences in privacy laws between the two countries. Some of these frameworks differ in the system of enforcement and grievance redressal mechanism. While Privacy Shield is totally a self declaration based certification system, CBPR tries to bring in the Accountability Agent to certify at the first place. BCR may be for intra group data transfers in multi national companies and may not apply as a comprehensive approach. SCC framework is a good indicator and needs to be explored while drafting the Business Associate Contracts where data is transferred to sub contractors.
While these frameworks are essentially for the participating economies such as the EU-USA data transfers or within the CBPR signatories etc, Indian companies need to recognize the endorsement of ITA 2000/8 to these frameworks and the possibility that the vendors of USA or EU or any other country who transfer data for transfer to Indian companies may have incorporated a fine print clause in the SLAs or the Business Associate contracts and try to enforce indemnity clauses for any intended or negligent contravention of the privacy obligations.
It is time companies in India audit their privacy policies and its implementation status within the company to ensure that they are within manageable levels of deviation if any.
Naavi
By Vijayashankar Na
Filed Under Cyber Law
| 1 Comment»
A Round table was held at National Law School of India, Bangalore, the premier law education institute in the country on assessing the impact of the Supreme Court order on Right to Privacy on Cyber Space and Data Protection. Dr Professor Nagaratna, Dr Professor Subbarao, from NLSUI led the discussions and several other invited guests from IT industry, Advocates, Police, Research scholars participated in the consultation program.
Participating in the discussion, the undersigned shared his views on the subject reproduced below:
Assessing the Impact of Supreme Court’s Order on Right to Privacy on Cyber Space and Data Protection
Discussion@ NLSUI, 31st August 2017
A Note By Naavi
Law is meant to be complied with by the Citizens. Hence it has to be written in a manner that is easily and precisely understood by the stake holders. A well written law brings better compliance than a law that people cannot properly understand. This principle also applies when laws are made by way of Jurisprudence developed in major Judgement of superior Courts. If the Judgement are precise and lucid, it will be well understood by the citizens and there will be better compliance. We need to assess this Judgement keeping this basic principle in mind.
The Order
The Bench in its 547 page judgement has given out a one page order signed by all the judges making just one major point namely:
“The right to Privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as a part of the freedoms guaranteed by Part III of the Constitution”.
Additionally the order specifically mentions that the earlier judgements in the M.P.Singh and Kharaksingh Cases have been over ruled.
Apart from the order, individual judgements have been given by 5 judges and the other four have given a common judgement. Some of these individual judgements list some conclusions after reflections and other citations from Indian and foreign judgements.
The operating part of the judgement is however limited to the declaration that Right to Privacy is a “Fundamental Right”. It means that the Government cannot make any law that infringes the right any previous laws made can be challenged. However, the Right is subject to the “Reasonable Restrictions” under Article 21 and it would be the line of defense whenever a law is challenged.
While infringement of the Privacy Right by the State can empower a citizen to claim damages from the Government, it cannot be used to claim damages from a Non State body.
Impact on Non State Bodies
Individuals and Companies who are not State bodies shall be liable on the basis of any law made by the Government to protect Privacy of a Citizen as per the obligation under the Constitution.
At present no law exists specifically to protect the Privacy of an Individual. However, Information Technology Act 2000/8 has certain provisions which afford protection to “Personal” data of an individual in electronic form which is collected and processed by a corporate entity.
Lack of Definition of Privacy
In the Judgement, it has been admitted that there is no acceptable definition of “Privacy” as it prevails in India. Earlier, the various judgements of the Supreme Court including the Kharak Singh judgement used the concept of Privacy Right as a “Right to be left alone”. It was mostly viewed in the context of “Physical Privacy”.
Additionally, some of the Judges have made reference to “Information Privacy” where “Right to decide how information that is related to the Privacy of a person may be collected and used” is recognized as a facet of Privacy. Again this is not part of the order and hence not binding under this judgement.
The current judgement did not add an acceptable definition of Privacy in its final order though different judges in their reflections made many remarks. At least one Judge (Justice Chelameswar) categorically stated “….Definitional uncertainty is no reason to not recognize the existence of the right of privacy…. “.
As a result the “Right to Privacy” is now sought to be defended with a vague understanding of the definition of “Privacy”. Citizens and Companies will have to therefore consider protection of Privacy of other Citizens and not to infringe them without having a clear understanding of what right they are really protecting.
If there is any dispute whether a “Right” is infringed and what is infringed is the “Right to Privacy”, then a reference would be required to be made a Court to define on a case to case basis whether the “Right which was infringed was in deed a Right to Privacy”.
The public will therefore look for the specific legal provision where the Privacy Right is mandated to be protected to find out whether they are indeed compliant with law or not.
For example, in cases where ITA 2000/8 applies, public and companies will look for the definition of “Personal Information” and “Sensitive Personal Information”. It also has certain sections like the Section 43A, Section 72A, Section 79, Section 65, Section 67C, Section 66E, Section 69, Section 69B, Section 70B etc. where different aspects of Privacy are referred to. All this applies to electronic documents other than excluded documents under Section 1(4). They do not apply to non-electronic documents or oral statements.
Courts have the right to not only interpret the law but to write the law
Justice Chelameswar has however made an interesting statement which implies that any decision of the Court in this regard may not necessarily be dictated by what is provided in the law.
According to him
“To sanctify an argument that whatever is not found in the text of the Constitution cannot become a part of the Constitution would be too primitive an understanding of the Constitution and contrary to settled cannons of constitutional interpretation”
What this observation means is that even if the Constitution or any law does not mention something in the text of the law, the Court can still interpret the law to contain such text by way of an interpretation.
This makes law completely arbitrary and leaves not only interpreting what is written in the law but also import any other text not present there in as if the law is being “Re written”.
When we remember that Justice Chelameswar and Justice Nariman, who are part of this bench were also the Judges who in the Shreya Singhal Case struck down Section 66A considering that Messaging is no different from Publishing and Words used in the section were vague and also refused to read down the provisions and retain the section but insisted that it has to be struck down, it is surprising that they have now changed their view completely.
In this judgement the Court is ruling on “Protection of Privacy” without freezing on what is meant by “Privacy”. This is not considered vague. Also now the Court is read to not only “Read down” but also “Write down” law in any manner in which the Judges consider it correct.
This inconsistency in judicial approach creates needless confusion to companies who would like to be compliant with law.
With this approach of laying down law without clarity is undesirable. As a result, any law can be interpreted by the Court any time and what is written in the law is immaterial.
In such a scenario, compliance is almost impossible and Businesses will not be able to invest in technologies and build an infrastructure or brand without the constant fear that law may be re-interpreted by a Court in a different manner and make their business illegal.
ITA 2008 approach to Privacy Protection
ITA 2008 defines Personal Information as any information that relates to a natural person, which, either directly or indirectly, in combination with other information available or likely to be available with a body corporate, is capable of identifying such person. (Notification of 11th April 2011).
The sensitive Personal information is defined as password, financial information such as Bank account or credit card or debit card or other payment instrument details , physical, physiological and mental health condition; sexual orientation; medical records and history; Biometric information; any detail relating to the above clauses as provided to body corporate for providing service; and any of the information received under above clauses by body corporate for processing, stored or processed under lawful contract or otherwise.
Under Section 72A, any person disclosing personal information in violation of an agreement with the data subject is liable for 3 year imprisonment.
Under Section 43A, which is applicable only to companies, a company handling “Sensitive Personal Information” needs to implement “Reasonable Security Practices” failing which it would be liable to pay compensation.
Under Section 43, any person who “Diminishes the value of information residing inside a computer” or obtains unauthorized access to information (whether personal, or sensitive personal or any other) is liable for payment of compensation and additionally for 3 year imprisonment.
Further there is data retention requirements (Sec 67C, sec 65) bodily privacy protection, (Sec 66E), Disclosure and interception related issues (Sec 69, 69B, 70B) for which punishments are prescribed. Section 79 is a complete reproduction of internationally accepted norms of privacy protection as applicable to information intermediaries.
ITA 2000/8 however provides emphasis on “Contract” with the data subject which gets translated into “Informed consent”. Hence any company dealing with privacy related information has to focus on obtaining a proper consent after a proper disclosure of why an information is being collected, what all information is collected, how they are used, how they are shared, how they are secured, how long they are retained etc.
The law is reasonably robust, though there is lacuna in its implementation. Companies are negligent in not going for a structured ITA 2008 compliance exercise despite nudging by the Government through various means.
Now the Government is contemplating a separate law on Data Protection for which a committee led by another retired Judge of Supreme Court (Justice Srikrishna) is working. Since this is a “Data Protection law”, it has to address only what ITA 2008 has already addressed. It is expected that it would focus on the administrative part of the data protection including appointment of a data commissioner, replacing the Adjudication and Cyber Appellate Tribunals with a separate system. Hopefully there will be not much of a need to ticker with ITA 2000/8 itself to ensure that the two laws are not contradictory.
What Can change after the Judgement?
Now that this judgement elevates Privacy to the status of a “Fundamental Right” there will be a greater attention from the Privacy advocates and there would be a number of frivolous litigations on e-commerce players who are today banking on the “Contractual Permissions” from the data subjects.
The common approach of business is to offer a service under the specific condition that certain data is shared and it may be used by them in a certain manner in which they generate some additional revenue.
In a way the data subject “Trades” his personal information for a benefit. Whether he gets a fair price for his data or whether he is allowing the data processor to get free data is perhaps a point of debate. We however have to recognize that the world is already recognising the IPR laws in which often the author/inventor gets some small revenue and transfers the rights to a business entity which makes a windfall. These imbalances in data trade cannot be easily regulated by law and should be left to the NGOs and better education of the consumer.
Businesses like Data Anaytics, Advertising etc. survive only on collection and use of personal data. Some businesses can do with de-identified data but many need value which comes only with identified data. In the digital economy “Data” is considered an important commodity just like “Oil” and hence imposing irrational curbs on its usage in the guise of “Privacy” will be counterproductive.
Additionally “Privacy” is always at logger head with Security and even the Judges in this judgement have recognized this. Hence Government and Companies will try to justify certain practices on the basis of security requirements while whether there were “Compelling reasons” for the same will remain eternally a debate in Courts.
What is required now is for development of good enforcement machinery which will guide the Companies in India to protect the Privacy of individuals and ensure that a fair price will be paid to them whenever personal data is used for commercial purposes. How this will be done is the challenge for the Data Protection Act in the anvil.
Technically, apart from De-Identification, Regulated Anonymity concepts provide a strategy for striking balance between Privacy Rights and Security requirements. They need to be harnessed in the Data Protection regime.
Industry therefore may continue to follow the principles of Data Protection under ITA 2008 as its obligation for “Privacy Protection” and await the Data Protection Act for any review of its strategies.
Naavi
31st August 2017
The deliberations of the Round table are likely to be collated and submitted by NLSUI to the Government and the Srikrishna Panel on Data Protection.
Naavi
