Introduction
The verdict in the Puttaswamy case was a landmark moment for its recognition of privacy as a constitutionally protected right, residing within the inalienable values of life, liberty and freedom. However, akin to other inalienable human rights, the right to privacy also requires sanction by rules of positive law to have any meaning. That is, no such rights can exist in domains where the State cannot enforce them. The internet, I argue, is a domain where the State has so far only had minimal influence. The protection of individual privacy on the internet thus warrants State intervention in the form of a data protection regime. As the Puttaswamy verdict explicates, any such regime is required to make a “careful and sensitive” balance between individual interests and legitimate concerns of the State. Without this, the presence of State as an overarching authority will have ramifications on both individual autonomy and technological innovation.
In 1926, Nikola Tesla gave an interview to Collier’s Magazine, detailing his predictions for the future of humankind. It is a remarkably prescient vision, where unmanned aircrafts travel the skies, people communicate with devices they carry in their pockets, events are broadcasted around the globe, and much more. Tesla believed wireless systems would be of greater benefit to the human race than any other scientific discovery. When wireless is applied perfectly, he said, “the whole earth will be converted into a huge brain…We will be able to communicate with one another instantly, irrespective of distance.” We now know this is not merely wishful thinking for a utopia of interconnectivity, but, the reality of our times. Nearly a century after Tesla, IBM envisioned smart cities to resemble a nervous system: “with the sensors acting as the nerves relaying information to a ‘brain’.”
However, as Tesla’s wireless systems inch closer to their ‘perfect application’, we now also understand the trade-offs inherent to them. Privacy is one such aspect of our being, which is gradually becoming more incompatible with the direction of technological advancements. The question before us then is: What recourse is available to an individual against the invasive nature of technology?
To reclaim privacy and autonomy over wireless systems, such as the internet, one must treat these values as intrinsic to human existence, irrespective of the context surrounding an individual. For this reason, the verdict in Justice K.S. Puttaswamy (Retd.) v. UOI was a landmark moment for our debate on privacy. The Supreme Court upheld privacy as a constitutionally protected right that is inherent to and inseparable from the human element. Post-Puttaswamy, the onus is now on the State to protect this right. The following is a brief account of the need for State intervention and its potential ramifications across the internet.
Post-Puttaswamy: The State
The wisdom of human rights posits their acceptance as inalienable rights of an individual solely due to his being as a ‘man’. (The Universal Declaration of Human Rights, Declaration of Independence, the French Declaration of Human and Civic Rights, and so on, acknowledge certain equal and inalienable rights of man.) Similarly, the rights to life, freedom, and personal liberty under the Indian Constitution, from which privacy emerges, are held as inhering in each individual, as “part of the human element which dwells within” him.
However, similar to all such human rights we deem inalienable, the right to privacy also requires the presence of the State to give them any meaning. As Alain de Benoist[1] writes, human rights do not possess any legal importance or significance by themselves. They require sanction by rules of positive law, which can be conceived only within a society. The individual can claim rights “only in the midst of a specific polity, in a life context that concretely guarantees the power of benefiting from it.” The same holds for the right to privacy as well. While an individual possesses the inalienable right to privacy and should define the required standard of privacy for himself, he is not the sole determiner of its extent.
The idea that human rights become ‘disarmed’ in the absence of positive law is significant for our debate on informational privacy. If one’s right to privacy is based solely on the ‘human element’ he possesses, he is well entitled to shape and protect it against the rest of the world. However, the existence of the State as the proprietor of rights requires him to share his autonomy with others. Furthermore, his participation in a society or community also engenders a reasonable expectation of privacy. The Puttaswamy verdict thus clarifies that the right to privacy “is based not only on the subjective expectation of the individual but on an objective principle which defines a reasonable expectation.”
The challenges of locating this objective principle over the internet are also apparent. It is relatively easier to determine what actions violate an individual’s privacy, as well as the extent of this right in respect to his surroundings in the physical world. The degree of autonomy and privacy one can reasonably expect is situational and generally deducible by the individual himself. For example, the expectation of privacy in one’s bedroom would be much higher than that in a marketplace. The objective principle thus continuously morphs with his being as he moves from one place to another. On the other hand, multiple such principles can work on the individual simultaneously while on the internet.
Each platform or service determines its privacy standards that become binding on the users, along with the means to collect and process the user-generated information. Further, third parties may also collect and use this data for varied purposes. In short, the modes of data collection, processing, and usage are near impossible to comprehend for a layperson. Sarah Myers West has used the term Data Capitalism to explain a system “in which the commoditization of data enables a redistribution of power in the information age.”
In the absence (or abundance) of a definite objective principle, the State must provide one to ensure homogeneity of privacy standards across the internet. Data protection regimes, of which the upcoming Personal Data Protection Bill (hereinafter, PDP Bill) is an example, are such measures for uniformity. Any such regime should supposedly empower the individual as an autonomous being capable of exercising his rights on the internet. At the same time, and rather contradictorily, the State can curtail the absoluteness of these rights for the welfare of the society at large. The Puttaswamy verdict thus commends the State to formulate a data protection regime that strikes a “careful and sensitive balance” between both these ends.
Post-Puttaswamy: The Internet
How balanced the PDP Bill eventually turns out to be, and what implications it will have across the internet remains to be seen. Much has been said already about the overarching provisions present in the Bill and their potential for misuse. Apart from these provisions, a grave threat to privacy emerges from the ramifications of State intervention on technology. It affects not just those implementations of technology that are invasive, but ones crucial for safeguarding individual privacy also.
Recently, a report from the Parliamentary Standing Committee on Home Affairs recommended the permanent blocking of Virtual Private Network (VPN) services to combat cybercrimes. Their ‘anxieties’ stemmed from the idea that VPNs can “bypass cyber security walls and allow criminals to remain anonymous online.” The Committee further recommended taking initiatives to strengthen the tracking and surveillance mechanisms to curb their use. We saw another controversial instance of State intervention with the Informational Technology Rules, 2021. The provisions mandating traceability mechanisms on messaging platforms received heavy flak from all sides. In response, the government reiterated the need to control the potential abuse of social media and digital platforms. To balance individual interests and its legitimate concerns, the State must ensure homogeneity and carve exceptions for itself, including watering down various privacy-friendly technologies.
Incompatibility between technology and regulatory frameworks is another point of concern. For example, Rania El-Gazzar and Karen Stendal have shown how various innovative technologies (Artificial Intelligence, Cloud Computing, Blockchain, and Internet-of-Things) raise compliance issues with the principles and rights mentioned under the General Data Protection Regulation (GDPR), and how the attempts to make these technologies GDPR compliant may hinder their intended functionalities. Since promoting innovation is one of the intended goals of the PDP Bill, locating the ill-effects of State intervention is necessary.
Post-Puttaswamy: Individual
At this point, we have come full circle to the initially posed question: If the individual has an inalienable right to privacy, what degree of autonomy can he exercise to uphold it? So far, challenges to this autonomy have come primarily from the complexities of forces acting against it. With the unfettered growth of Data Capitalism, it became near impossible to understand and act against the means of data accumulation. Post-Puttaswamy, however, challenges to individual autonomy will come from the State’s conception of the good as well.
The presence of the State as an overarching authority impacts the extent of autonomy an individual wields, especially over decentralized networks, such as the internet. Marcel Gauchet writes how “the deeper the laws of men enter into the definition of their society, the more the organisational dominance of the bureaucratic state, under cover of permitting their participation in it, robs them, in fact, of this faculty.”[2] The forces of Data Capitalism, no doubt, require some regulatory oversight. But what impact should it have on the rest of the internet?
The invasive forms of technology on the internet have, so far, worked on the principle of acquiescence. The innumerable means and purposes of data collection render one’s desire for privacy meaningless. In this regard, the sole obligation of the State is to avail the autonomy lost to such pervasive technologies. How effective a consent-based model is in demystifying the abstractions of technology remains to be seen. Post-Puttaswamy, the State must provide impetus to information literacy because privacy already exists as a counter-culture on the internet. As more and more people become aware of the trade-offs inherent to data capitalism, they move over to platforms and services built upon strong privacy principles.
(This article has been authored by Dhananjay Sharma, a fourth-year law student at National Law University, Jodhpur)
References
-
Alain de Benoist, Beyond Human Rights (John B. Morgan ed., Alexander Jacob trans., 2011). ↑
-
Marcel Gauchet, La Démocratie Contre Elle-Même 20-21 (2002) in de Benoist, supra note 1. ↑
Cite As: Dhananjay Sharma, ‘Privacy Post-Puttaswamy: The Need for State Intervention and its Implications on Individual Autonomy‘ (The Contemporary Law Forum, 19 March 2022) <https://tclf.in/2022/03/19/privacy-post-puttaswamy-the-need-for-state-intervention-and-its-implications-on-individual-autonomy> date of access.