SURVEILLANCE IS NOT THE ONLY PRIVACY ISSUE: COMMERCIAL DATA EXPLOITATION, AND CONSTITUTIONAL SAFEGUARDS

Why In News?

Public interest litigation (PIL) in the Supreme Court concerning police biometric facial recognition in public protests, algorithmic doxxing, deepfakes, and automated electoral roll revisions has highlighted that privacy violations extend far beyond direct government wiretapping .

What Is The Right To Privacy?

In the nine-judge bench ruling in Justice K.S. Puttaswamy (Retd.) vs Union of India (2017), the Supreme Court unanimously declared the Right to Privacy an intrinsic part of the Right to Life and Personal Liberty under Article 21 and Part III of the Constitution.

Three Functional Dimensions of Privacy:

• Spatial Privacy: Protection of physical spaces, homes, and personal domains from unlawful entry or intrusion.

• Decisional Privacy: Autonomy over intimate personal choices, including bodily integrity, reproductive choices, marital freedom, and ideological beliefs.

• Informational Privacy: An individual’s sovereign right to control the dissemination, aggregation, and processing of their personal data in digital and physical spheres.

Anchored in Human Dignity: Overruling earlier restrictive precedents in M.P. Sharma (1954) and Kharak Singh (1962), the apex court affirmed that privacy is essential for realizing human dignity, liberty, and the "right to be let alone".

What Are The Major Privacy Concerns Beyond State Surveillance?

Commercial "Surveillance Capitalism": Private corporate platforms track, record, and monetize every click, scroll, and online query to construct psychological dossiers for behavioral micro-targeting and commercial manipulation.

Corporate Data Breaches: Cybersecurity deficits result in the exfiltration of personally identifiable information (PII)—including Aadhaar numbers, phone logs, and credit scores—fueling organized identity theft, financial fraud, and cyber extortion.

Pervasive Facial Recognition Technology (FRT): Unregulated deployment of automated facial recognition algorithms in airports, transit hubs, and commercial complexes strips citizens of public anonymity, enabling pervasive real-time tracking.

Location Tracking and the Internet of Things (IoT): Connected cars, wearable fitness trackers, and smart-home appliances harvest continuous spatial, physiological, and ambient data without explicit user comprehension.

Deceptive "Dark Patterns": Manipulative user interface designs employed by e-commerce and social media applications to trick consumers into surrendering permissions, subscribing to covert services, or disabling privacy settings.

Algorithmic Discrimination and Bureaucratic Exclusion: Automated sorting algorithms determine creditworthiness, insurance premiums, and welfare eligibility, entrenching historical biases against marginalized socio-economic groups. 

What Is The Legal Framework In India (The DPDP Act, 2023)?

Core Institutional Architecture

• Data Principal: The individual to whom the personal data relates.

• Data Fiduciary: Any entity (private firm, individual, or government department) that determines the purpose and means of data processing.

• Significant Data Fiduciary (SDF): Entities handling voluminous or sensitive datasets, legally mandated to appoint a Data Protection Officer (DPO), conduct independent data audits, and execute Data Protection Impact Assessments (DPIA).

Statutory Consent Architecture: Mandates that personal data can only be processed with free, specific, informed, unconditional, and unambiguous consent accompanied by a clear affirmative action.

Core Privacy Principles: Codifies fundamental benchmarks including Purpose Limitation (processing strictly for specified purposes), Data Minimisation (collecting only necessary data), and Storage Limitation (erasing data once the purpose is served).

Data Protection Board of India (DPBI): Establishes an adjudicatory mechanism empowered to investigate personal data breaches, direct remedial actions, and impose financial penalties of up to ₹250 crore for systemic failures.

Legislative Criticisms:

• Sweeping State Exemptions (Section 17): Grants broad exemptions to state agencies from notice, consent, and purpose limitation obligations on open-ended grounds of "sovereignty, integrity, and public order".

• Executive Control over the DPBI: Selection, tenure, and removal of Board members rest entirely with the Central Government, raising concerns over institutional independence.

• Dilution of the Right to Information (RTI) Act: Section 44 amends Section 8(1)(j) of the RTI Act, 2005, introducing an absolute bar on disclosing any personal information, weakening transparency in public administration.

What Are The Constitutional Safeguards And Proportionality Standard?

The Interlocking Triad (Articles 14, 19, and 21): The Supreme Court established that any state interference with privacy must be non-arbitrary (Article 14), respect democratic freedoms (Article 19), and conform to constitutional due process (Article 21).

The Four-Pronged Proportionality Test: Any state measure infringing upon privacy must strictly satisfy:

• Legality: Must be anchored in an explicit, publicly accessible parliamentary law.

• Legitimate State Aim: Must serve a demonstrable, constitutionally valid public objective.

• Suitability (Rational Nexus): The means adopted must be rationally connected to achieving the specified objective.

• Necessity: The state must adopt the least intrusive measure among available alternatives.

• Balancing / Proportionality Stricto Sensu: The societal benefit achieved must not be disproportionately outweighed by the severity of the fundamental rights infringement.

What Are The Major Challenges In Enforcing Privacy Rights?

Public-Private Surveillance Nexus: State law enforcement agencies routinely deploy private contractors to collect, process, and host sensitive biometric information gathered during public assemblies.

• Example: Petition by Rajya Sabha MP A.A. Rahim in the Supreme Court (2026), challenging the Delhi Police’s use of facial recognition, AI-powered smart glasses, and drones hosted on servers of private commercial firms.

Algorithmic Disenfranchisement in Bureaucratic Updating: The use of opaque automated software to de-duplicate public registers risks disenfranchising eligible citizens without procedural due process.

• Example: Special Intensive Revision (SIR) of Electoral Rolls, where automated profiling and deletions disproportionately impacted migrant laborers and urban slum dwellers.

Prevalence of Deceptive Dark Patterns in Tech Ecosystems: Indian internet consumers frequently face interfaces engineered to induce coercive consent.

• Example: CCPA Enforcement Actions on Dark Patterns (2023–2026), penalizing airline and e-commerce platforms for pre-ticked add-ons and hidden consent opt-outs.

Cross-Border Cloud Vulnerabilities and Regulatory Arbitrage: Global digital platforms transfer Indian telemetry data across overseas servers, evading domestic subpoena powers and enforcement actions.

• Example: Unregulated Data Harvesting by Offshore Short-Video & Gaming Apps, routing user contact graphs and microphone logs to foreign servers.

Way Forward

Institutionalize "Privacy by Design": Statutorily require software developers, platform operators, and government digital missions to integrate end-to-end encryption, automatic data purging, and zero-knowledge architectures from inception.

• Example: Bureau of Indian Standards (BIS) Data Protection Frameworks, setting baseline technical standards for mobile operating systems and cloud providers.

Safeguard the Structural Independence of the DPBI: Amend the DPDP rules to ensure that the Chairperson and members of the Data Protection Board are selected by an independent multi-stakeholder panel comprising the Chief Justice of India, similar to other regulatory commissions.

• Example: European Data Protection Board (EDPB) Model, operating with functional and financial autonomy from executive ministries.

Narrow and Circumscribe State Exemptions: Subject state surveillance requests and data processing under Section 17 to independent judicial oversight rather than internal executive clearances.

• Example: Justice B.N. Srikrishna Committee Draft Bill (2018) mandated strict judicial warrants for state intelligence intercepts.

Enforce Strict Liability on Private Bunkers of Public Data: Mandate that private contractors managing government biometric or law enforcement data be subjected to mandatory, real-time cybersecurity audits by CERT-In with severe financial liability for unauthorized commercial leakage.

• Example: NCIIPC Mandatory Security Architecture for Critical Information Infrastructure, imposing criminal penalties for data leaks in public systems.

Nationwide Digital Privacy Literacy Initiatives: Roll out public education campaigns to empower citizens with the knowledge to recognize dark patterns, revoke device permissions, and exercise data erasure rights.

• Example: National Digital Literacy Mission (NDLM) Curriculum Upgrades, integrating consumer privacy rights into school and community education.

Conclusion

True protection of privacy requires moving beyond the singular dread of state wiretapping to dismantle the pervasive architecture of commercial data exploitation, biometric profiling, and algorithmic injustice.

Source: THEHINDU