Puttaswamy Judgment

A deep dive into the Puttaswamy judgment — the landmark case that recognised privacy as a fundamental right in India.

Background of the Case

The Puttaswamy case arose from challenges to the Aadhaar scheme — India's national biometric identification system. Petitioners argued that Aadhaar violated privacy rights by collecting biometric data without adequate consent or safeguards. The case eventually reached a nine-judge bench of the Supreme Court.

The case was a culmination of decades of litigation over privacy. Earlier cases (Kharak Singh, Gobind, PUCL) had conflicting views on whether privacy was a fundamental right. The Puttaswamy case was an opportunity to settle the question definitively.

The nine-judge bench was unprecedented in Indian constitutional history. It signalled the importance of the issue and the need for a definitive ruling. All nine judges held that privacy is a fundamental right.

The Court's Reasoning

The nine judges wrote multiple opinions, but they agreed on several core points. The judgment's reasoning is rich and multifaceted:

Privacy as Intrinsic to Liberty

The Court held that privacy is not just a statutory right or a common law right — it is intrinsic to the right to life and personal liberty under Article 21. Privacy is essential to human dignity and autonomy. Without privacy, life cannot be lived with dignity.

Privacy as a Tripartite Right

One of the judges (Chandrachud J.) described privacy as a "tripartite" right — it includes (1) repose (freedom from unwanted intrusion), (2) sanctuary (protection of intimate spaces), and (3) intimate decision-making (autonomy in personal choices). All three are essential to human flourishing.

Privacy and Democratic Values

The Court recognised that privacy is essential for democracy. Without privacy, free expression, political dissent, and democratic participation are compromised. Surveillance chills democratic debate and enables authoritarianism.

The judgment also recognised that privacy is not just an individual good — it is a collective good. Society benefits when individuals can think, speak, and associate freely.

Key Holdings

The Puttaswamy judgment made several key holdings, which are now settled law:

• • Privacy is a fundamental right under Article 21
• • Privacy is intrinsic to human dignity and autonomy
• • The right to privacy is not absolute — it can be restricted
• • Restrictions must satisfy the three-pronged test (legality, necessity, proportionality)
• • Privacy has horizontal application — it can be enforced against private parties
• • Privacy includes informational privacy — control over personal data
• • Data protection legislation is essential to give effect to privacy

These holdings have profound implications. They mean that the government cannot violate privacy without justification, and that private companies must also respect privacy. They also mean that data protection legislation like the DPDPA is constitutionally mandated.

Implications for the DPDPA

The Puttaswamy judgment has profound implications for the DPDPA. Understanding these implications is essential for compliance:

• • The DPDPA must satisfy the three-pronged test for any restrictions on privacy
• • Consent requirements must be meaningful — not just formal
• • Data principal rights must be effective — not just symbolic
• • Security safeguards must be proportional to risk
• • Penalties must be proportionate to violations
• • The Data Protection Board must be independent

Compliance professionals should be aware that the DPDPA is not just a regulatory statute — it is the legislative implementation of a fundamental right. Non-compliance can be challenged as a constitutional violation, not just a statutory violation.

The Puttaswamy judgment also influenced the Aadhaar judgment (2018), in which the Court applied the three-pronged test to strike down provisions of the Aadhaar Act. This shows that the Court is willing to enforce privacy rights against state actions.

In the context of the DPDPA, the Puttaswamy judgment establishes the constitutional foundation for data protection. It confirms that privacy is not a mere privilege — it is a fundamental right that must be protected in law and practice.