Right to Privacy
Understanding the right to privacy in the Indian context — its scope, dimensions, and limitations.
🎯 Learning Objectives
- ▸ Define the right to privacy in the Indian context
- ▸ Analyze the scope of privacy rights
- ▸ Understand the limitations on privacy rights
- ▸ Identify the four dimensions of privacy recognised in Indian law
Scope of Privacy Rights
The right to privacy in India is broad and multifaceted. It includes several dimensions, each protecting different aspects of personal autonomy and dignity.
Four Dimensions of Privacy
- • Informational Privacy: Control over personal data and information
- • Bodily Privacy: Protection of the physical body from invasive procedures
- • Territorial Privacy: Protection of physical spaces like homes and offices
- • Communication Privacy: Privacy of correspondence, phone calls, and other communications
These dimensions interact. For example, the collection of location data (informational privacy) can reveal information about physical movements (territorial privacy). Understanding these interactions is essential for effective privacy protection.
Privacy is not just about keeping secrets — it is about control over personal information, personal space, and personal decisions.
Horizontal and Vertical Application
The right to privacy has both vertical and horizontal application. Vertical application means the right is enforceable against the State. Horizontal application means the right is enforceable against private parties.
Vertical Application
Vertical application is traditional. Article 32 (right to constitutional remedies) allows individuals to challenge state actions that violate fundamental rights. Privacy rights can be enforced against government surveillance, data collection, and other state actions.
Horizontal Application
Horizontal application is more recent and complex. The Puttaswamy judgment recognised that privacy must also be protected against private parties — such as companies that collect personal data. However, enforcing fundamental rights against private parties is more complex because Article 32 only applies to state actions.
The DPDPA implements horizontal application by imposing obligations on private Data Fiduciaries. This makes privacy rights enforceable against companies, not just the State.
Limitations on Privacy Rights
The right to privacy is not absolute. It can be restricted for legitimate purposes — like national security, public order, and crime prevention — provided the restrictions satisfy the three-pronged test (legality, necessity, proportionality).
Types of Limitations
- • National security: Surveillance for national security
- • Public order: Restrictions for preventing disorder
- • Crime prevention: Surveillance and investigation
- • Tax collection: Financial data collection
- • Regulatory compliance: Sectoral data requirements
- • Legal proceedings: Data disclosure for litigation
Each limitation must be justified under the three-pronged test. Blanket surveillance or data collection without specific justification violates the Constitution.
💡 Example
The Aadhaar judgment upheld Aadhaar but struck down Section 57 of the Aadhaar Act, which allowed private companies to use Aadhaar for authentication. The Court held that this was not proportionate — it was not necessary for the stated objectives.
Implications for Data Protection
The right to privacy has profound implications for data protection. The DPDPA is the legislative implementation of this constitutional right. Key implications include:
- • Consent requirements reflect the constitutional right to informational privacy
- • Breach notification requirements reflect the state's duty to protect privacy
- • Data principal rights (access, correction, erasure) implement privacy rights
- • Security safeguards requirements reflect the duty to protect personal data
- • Penalties for violations enforce the constitutional right
Understanding the constitutional right to privacy is essential for interpreting the DPDPA. The Act is not just a regulatory statute — it is the legislative expression of a fundamental right.
Every provision of the DPDPA should be read through the lens of the constitutional right to privacy. Compliance is not just legal — it is constitutional.
📖 Glossary
- Horizontal Application
- The application of fundamental rights against private parties, not just the State.
- Vertical Application
- The application of fundamental rights against the State.
- Article 32
- The constitutional provision that allows individuals to approach the Supreme Court for enforcement of fundamental rights.
- Proportionality
- The principle that restrictions on rights must be proportionate to the goal, with no less restrictive alternative.
🔑 Key Takeaways
- Privacy is a fundamental right in India
- Privacy has both vertical and horizontal application
- Privacy is not absolute — it can be restricted for legitimate purposes
- The right to privacy includes information, bodily, territorial, and communication privacy
📚 Further Reading
- K.S. Puttaswamy v. Union of India — Supreme Court of India (2017)
- Justice K.S. Puttaswamy v. Union of India (Aadhaar) — Supreme Court of India (2018)
- The Constitution of India — Government of India (1950)
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...