APPLICABILITY OF JUSTICE PUTTUSWAMY VS UNION OF INDIA TO NON-STATE ENTITIES

Transcription

1 November 02, 2017 APPLICABILITY OF JUSTICE PUTTUSWAMY VS UNION OF INDIA TO NON-STATE ENTITIES A. BACKGROUND: After a considerable amount of debate on the subject, the judgment passed by the Supreme Court of India in Justice K. S. Puttuswamy vs. Union of India 1 on August 24 th, 2017 has answered the question of whether the right to privacy exists as a fundamental right within the scheme of the Indian Constitution. It is unsurprising that the question arose in the current maelstrom of opinion and opportunity surrounding data acquisition and analysis. On the one hand, governmental acquisition and storage of personal and bioinformatic data through Aadhar had begun to raise more than a few eyebrows. On the other hand, the mantra data is the new oil has been on the lips of all data analysis and datamining-dependent entities, prompting the collection of data across a range and diversity of data points hitherto unprecedented. The question finally arose when a group of people, including a former judge of the Karnataka High Court (Justice Puttuswamy) contended that the biometric data and iris scans collected for issuance of Aadhaar cards was personal data, that such data could be subject to unauthorised usage and misuse and that its collection and storage by governmental authorities amounted to a violation of their fundamental right to privacy. The questions that arose in the course of the proceedings before the Supreme Court of India were ultimately referred to a 9-judge bench of the Supreme Court, comprising Chief Justice Khehar and Justices J. Chelameswar, S.A. Bobde, R.K. Agrawal, Rohinton Nariman, A.M. Sapre, D.Y. Chandrachud, Sanjay Kishan Kaul and S. Abdul Nazeer ( the Bench ). In summary, the Bench ruled that the right to privacy is a constitutionally protected right which not only emerges from the guarantee of life and personal liberty in Article 21 of the Constitution, but also arises in varying contexts from the right to freedom recognised and guaranteed by the Article 19 of the Indian Constitution. In the course of rendering this judgment, the Bench overruled precedents which contained (or were understood to contain) observations that the right to privacy was not a fundamental right recognised under the Indian Constitution. The judgment is divided into six portions elaborating the positions taken by Justice 1 Writ Petition (Civil) No 494 Of 2012

2 Chandrachud, Justice Kaul, Justice Nariman, Justice Bobde, Justice Chelameswar and Justice Sapre. The focus of this note is not to summarise the Judgment or to discuss its implications in general, but on its application to claims of breach of privacy by private persons or non-state actors or non-state entities, as they are often referred to in the course of the judgment. B. APPLICABILITY OF THE JUDGMENT TO NON-STATE ENTITIES An important question raised by the present judgment is the extent of enforceability of the right to privacy against non-state entities. A number of observations in the course of the Judgment are aimed at the applicability of the right to privacy to non-state actors. 1. Justice Chandrachud s Observations In the course of his opinion, Justice Chandrachud acknowledges the importance of the right to privacy in the context of the age of big data" i.e. data sets capable of being searched and marked by their exhaustive scope and permanency of collection. Justice Chandrachud elaborates on this within the context of Informational Privacy in the course of paras 170 to 185 of the Judgment. In specific, though, with regard to non-state entities, Justice Chandrachud makes certain important references non-state entities/actors. Justice Chandrachud first notes in para 174 that The challenges which big data poses to privacy interests emanate from State and non-state entities" Justice Chandrachud then goes on, in the conclusion to his opinion, at para T(5), to note that The dangers to privacy in an age of information can originate not only from the state but from non-state actors as well. Based, inter alia, on this observation, Justice Chandrachud suggested that the state put together a data protection regime after drawing a careful and sensitive balance between individual interests and legitimate concerns of the state. Justice Chandrachud has also observed that the data protection framework must also lay a special emphasis on consent which relies on the ability of the individual to make an informed choice after reading a privacy notice. 2. Justice Kaul s Observations It is also pertinent to examine the observations of Justice Sanjay Kishan Kaul, whose opinion contains a number of findings regarding the applicability of the right to privacy to non-state actors. In paragraph 12, Justice Kaul notes that

3 The right to privacy is claimed qua the State and non-state actors. Recognition and enforcement of claims qua non-state actors may require legislative intervention by the State. Justice Kaul then proceeds to elaborate on this observation in great detail in paragraphs of his opinion, which focuses specifically on the privacy concerns raised by nonstate actors. He begins by observing, in paragraph 15 that the capacity of non-state actors to invade privacy has been enhanced. In paragraph 17, Justice Kaul elaborates, noting that: Social network providers, search engines, service providers, messaging applications are all further examples of non-state actors that have extensive knowledge of our movements, financial transactions, conversations both personal and professional health, mental state, interest, travel locations, fares and shopping habits." Justice Kaul notes the participation of non-state entities in the collection of data of individuals, citing examples of Uber, Facebook, Twitter and Airbnb to explain how personal information such a location, thoughts and preferences of individuals collected by non-state entities. He notes that this makes all individuals exposed to vulnerability of possible exploitation of such collected personal information. Justice Kaul goes on to observe in paragraph 19 of his opinion that Knowledge about a person gives a power over that person. The personal data collected is capable of effecting representations, influencing decision making processes and shaping behaviour. It can be used as a tool to exercise control over us like the big brother State exercised. This can have a stultifying effect on the expression of dissent and difference of opinion, which no democracy can afford. Justice Kaul goes on to state, in paragraph 20 of his opinion, that there is an unprecedented need for regulation regarding the extent to which such information can be stored, processed and used by non-state actors and noting, in paragraph 21, that In today s world, privacy is a limit on the government s power as well as the power of private sector entities. Justice Kaul s observations regarding private entities take on relevance when, in paragraph 54 of his opinion, he recognises the right of an individual to deal with his personal data in a manner that he deems fit. from the right to privacy in this modern age emanate certain other rights such as the right of individuals to exclusively commercially exploit their identity and personal information, to control the information that is available about

4 them on the world wide web and to disseminate certain personal information for limited purposes alone. This observation has far reaching implications on various state as well as non-state actors who collect online information from individuals. Justice Kaul thus recognises the right of every individual to be able to exercise control over his/her own life and image as portrayed to the world and to control commercial use of his/her identity, thereby possibly laying down ground for a right to be let alone similar to that provided for by the European Union. Based on the previous observations, Justice Kaul therefore concludes in paragraph 77 of his opinion, that The right of privacy is a fundamental right. It is a right which protects the inner sphere of the individual from interference from both State, and non-state actors and allows the individuals to make autonomous life choices." Horizontal Applicability of the Right to Privacy From the preceding paragraphs, it is clear that at least 2 Justices of the Bench have weighed in in favour of a right to privacy being applicable against non-state entities, with Justice Kaul devoting a chapter of his opinion on the subject. However, it is important to understand the extent to which a fundamental right to privacy is horizontally applicable (i.e. applicable by private persons against other private persons as opposed to the state). The extent of horizontal applicability of the right to privacy will be examined in this chapter. a. Horizontal Enforceability of the Right to Privacy as a Common Law Right At the outset though, it is important to note that the Supreme Court has recognised a right to privacy that exists as a common law right. While the Union of India did not express any reservation with the existence of a right to privacy as a common law right, its central position that the existence of a right to privacy as a common law right precluded its existence as a fundamental right. In this regard, it is important to note the opinion rendered by Justice Chandrachud under paragraph 17 and 18 of the Judgment which states that: We can dismantle a core assumption of the Union s argument: that a right must either be a common law right or a fundamental right. The only material distinctions between the two classes of right of which the nature and content may be the same lie in the incidence of the duty to respect the right and in the forum in which a failure to do so can be redressed. Common law rights are horizontal in their operation when they are violated by one s fellow man, he can be named and proceeded against in an ordinary court of law. Constitutional and

5 fundamental rights, on the other hand, provide remedy against the violation of a valued interest by the state, as an abstract entity, whether through legislation or otherwise, as well as by identifiable public officials, being individuals clothed with the powers of the state. It is perfectly possible for an interest to simultaneously be recognized as a common law right and a fundamental right. Where the interference with a recognized interest is by the state or any other like entity recognized by Article 12, a claim for the violation of a fundamental right would lie. Where the author of an identical interference is a non-state actor, an action at common law would lie in an ordinary court. Privacy has the nature of being both a common law right as well as a fundamental right. Its content, in both forms, is identical. All that differs is the incidence of burden and the forum for enforcement for each form. This opinion is affirmed by Justice Bobde in paragraph 17 of his opinion where he notes that it is perfectly possible for an interest to be simultaneously recognised as a common law right and a fundamental right. He also notes, in the same paragraph 17 that, where the author of an interference with a recognised interest is a non-state actor, an action at common law would lie in an ordinary court. These opinions therefore establish that the right to privacy is guaranteed to every individual not merely as a common law right but as a fundamental right. It is important to take note of this duality of rights for they acknowledge that the right to privacy may be enforced, not just vertically against the state as a fundamental right, but horizontally against other private persons. The question of whether the right to privacy as a fundamental right itself may be horizontally applicable is sought to be examined in the next section. b. Horizontal Enforceability of the Right to Privacy as a Fundamental Right The observations of Justice Chandrachud and Justice Kaul on the applicability of the right to privacy to non-state actors/entities has provided a strong foundation for potential scenarios for the horizontal applicability of the said right to privacy to such non-state actors/entities. The jurisprudence of Indian constitutional law has a wellestablished engagement with the horizontal applicability of fundamental rights to private persons or non-state actors. 2 There are a number of methods by which the right to privacy may be enforced against non-state entities/actors through horizontal applicability. The most applicable of such scenarios is through the enforcement of positive rights against the State. In certain situations, the Supreme Court has ruled that the State does not merely have a 2 For additional information on horizontal applicability of fundamental rights in Indian constitutional law, please see Bhatia, Gautham, Horizontality under the Indian Constitution: A Schema, May 24, 2015 at

6 duty to refrain from violating certain fundamental rights, but also has a duty to protect individuals against such private interference with such fundamental rights. In a situation where the Courts have found that the State has failed in such a duty, the Court may step in to fill such a void. In the case of Vishakha vs. State of Rajasthan 3, the Supreme Court of India found that the absence of sufficient legislation to address the gang-rape of an Indian social worker constituted a violation of the worker s fundamental rights under Articles 14, 19(1)(g) and 21 of the Constitution. The Supreme Court recognised that, in the absence of an enacted law to provide for the effective enforcement of such basic human rights, the Court had the right to lay down guidelines until a legislation is enacted for the purpose of protection of such human rights. In exercise of such powers, the Supreme Court framed the Vishakha Guidelines which were intended to act as a stop-gap arrangement until the State framed a law on sexual harassment. C. CONCLUSION In summary, the judgment has granted constitutional recognition to the right of privacy as a fundamental right emanating out of the right to life and personal liberty. The Bench has further noted that the fundamental right to privacy would need to be enforceable against non-state actors/entities in order to have any effect and has recognised the importance of drafting legislation to govern the privacy concerns of individuals. Further, the concept of informational privacy has been granted recognition and the Bench has found that informational privacy is a facet of the right to privacy. The judgment and the findings of the Bench therein will have a bearing on pending matters filed before courts across India. One such important instance is the matter of Karmanya Singh Sareen and Anr vs. Union of India 4 filed by Mr. Karmanya Singh Sareen against the State, Whatsapp and Facebook, requesting issuance of a writ of prohibition against WhatsApp and Facebook in relation to sharing of user information between the entities including messages, pictures, videos, etc. In the course of the proceedings, the counsel for the Union of India submitted that the State intended to constitute a Committee of Experts under the Chairmanship of Justice B.N. Sri Krishna to identify key data protection issues in India and recommend methods of addressing them. The constitution of the Committee and the terms of reference of the Committee have also been mentioned therein. Upon submission of the report of the Committee, laws relating to data privacy would be enacted. At present, the matter is pending before the Supreme Court of India and is posted to be listed on November 20 th, 2017 for a determination on whether an interim injunction should be passed restraining the Respondents from sharing client data with third parties. 3 (1997) 6 SCC 241, 4 W.P.(C) 7663/2016 & C.M.No.31553/2016

7 The Bench, in the course of Puttuswamy vs Union of India, has made it clear that the right to privacy as envisioned by it cannot be effectively enforced without horizontal applicability against non-state actors. Accordingly, it is only a matter of time before such enforcement occurs, whether in the form of legislation drafted by the State or in the form of precedent handed down by the judiciary. In either situation, it is incumbent on private entities to identify potential flaws or other issues with their data protection and data privacy procedures and to work pre-emptively to address such issues at the earliest. *This is an update for general information purposes only and does not constitute legal advice. Please contact us if you require further clarifications on this subject. BENGALURU CHENNAI HYDERABAD MUMBAI NEW DELHI