Right to Privacy and the DPDP Act, 2023

Eight Judges, Six Judges, Nine Judges: The Privacy Cases

By Aditya Tiwari · Polity faculty, The Cavalier · Lawyer, 10 years teaching law and Polity

The word "privacy" does not appear in the Constitution. Whether it could still be a fundamental right depended on how far the Supreme Court was willing to read Article 21: "No person shall be deprived of his life or personal liberty except according to procedure established by law." In A.K. Gopalan (1950) the Court read that Article narrowly. It said the "procedure" only had to be laid down by a valid law, however unfair, and that "personal liberty" meant freedom of the body. Maneka Gandhi (1978) overruled that view. The procedure now had to be fair, just and reasonable, and Articles 14, 19 and 21 were read together. Once Article 21 meant "life with dignity", the door opened for privacy.

The pattern is easy to remember: larger benches earlier, smaller benches later. A bench of eight and a bench of six had said no. Only a bench larger than both could overrule them, which is why the Court had to assemble nine judges in 2017. The petitioner was Justice K.S. Puttaswamy, a retired Karnataka High Court judge, who had challenged the Aadhaar scheme. The question referred to the bench was general: is privacy a fundamental right at all? On 24 August 2017 the nine judges answered yes, unanimously.

What Puttaswamy Held, and the Aadhaar Judgment

The Court did not create privacy from nothing. It held that privacy is an intrinsic part of the right to life and personal liberty under Article 21 and of the freedoms in Part III as a whole. It described three strands: bodily privacy (decisions about your own body), informational privacy (control over facts about you) and the privacy of choice, such as whom to marry or what to eat. Privacy is not absolute. And because Article 21 protects citizens and non-citizens alike, so does privacy; Article 19, by contrast, belongs to citizens only. Our pages on the right to liberty and judicial activism and PIL show how the Court builds new rights on Article 21 in this way.

The same Aadhaar challenge came back to the Court. In September 2018 a five-judge bench (the Aadhaar judgment, sometimes called Puttaswamy II) decided by a 4:1 majority that the Aadhaar Act, 2016 was constitutional for delivering welfare subsidies and benefits, and that it did not violate privacy because it passed the proportionality test. But the Court struck down Section 57, which let private companies demand Aadhaar authentication. It also held that Aadhaar could not be made compulsory for bank accounts, mobile connections or school admissions. Linking Aadhaar to PAN was upheld. Our Aadhaar explainer covers the system itself.

The Law: From Srikrishna to the DPDP Act

A fundamental right protects you against the State. It does not stop a private company from collecting your data. To close that gap, the government set up a committee under Justice B.N. Srikrishna in 2017. Its report and draft bill came in July 2018. Later bills followed, and after a 2019 version was withdrawn in 2022, Parliament passed the Digital Personal Data Protection Act, 2023 in August 2023 (it received assent on 11 August). The Act covers digital personal data processed in India, and also processing abroad if it is connected with offering goods or services to people in India.

The Act rests on consent. Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, with a notice that can be read in English or any language of the Eighth Schedule. A person can withdraw consent as easily as she gave it. Consent is not needed for listed "legitimate uses" in Section 7, such as data voluntarily given for a stated purpose, State benefits and services, medical emergencies and employment.

Rights of a data principal: to get a summary of the data processed, to correct and erase it, to have grievances redressed and to nominate someone to act if she dies or is incapacitated. She also has duties: she must not file false or frivolous complaints or impersonate others, and a breach can cost up to ₹10,000. Children (under 18) need verifiable consent from a parent or guardian. Fiduciaries may not track or monitor children's behaviour or target advertising at them.

Exemptions, the RTI Change and the Rules Timeline

Section 17 is where privacy and State power meet. It exempts the processing of personal data for enforcing legal rights, preventing and investigating offences and certain research and statistical purposes. It also lets the Central Government exempt notified State agencies from the Act's provisions in the interests of the security of the State, sovereignty, public order and friendly relations with foreign States. Critics ask whether such exemptions pass the proportionality test of Puttaswamy; the government says they are limited to notified agencies and stated purposes.

The second flash-point is Section 44(3). It amends the Right to Information Act, 2005, replacing Section 8(1)(j) so that the exemption from disclosure covers "information which relates to personal information". Earlier, personal information could be denied only if it had no connection with public activity or invaded privacy unjustifiably, and could still be released if a larger public interest required it. Opposition MPs and RTI activists say the change removes that public-interest balance. The government points to the Act's own exception for personal data that must be disclosed under law. Expect polity questions on this clash between two rights, privacy and information.

A fiduciary must also report a breach to the Board and to those affected, with a detailed report due within 72 hours under the Rules. Against the State, a citizen can still go straight to the Supreme Court under Article 32: see our page on writs and Article 32.

How UPSC Has Asked It: Past Papers Solved

UPSC has asked about this chain mainly as who-petitioned, who-is-covered and what-does-Article-21-include.

Practice MCQs (with answers)

1. The right to privacy was declared a fundamental right in 2017 by a Supreme Court bench of
   1. 5 judges
   2. 7 judges
   3. 9 judges
   4. 11 judges
2. Puttaswamy (2017) overruled which earlier decisions, to the extent they denied a right to privacy?
   1. Golak Nath and Kesavananda Bharati
   2. A.K. Gopalan and Maneka Gandhi
   3. Gobind and R. Rajagopal
   4. M.P. Sharma and Kharak Singh
3. Under the DPDP Act, 2023, an entity that decides the purpose and means of processing personal data is called a
   1. Data Fiduciary
   2. Data Principal
   3. Data Protection Board
   4. Consent Manager
4. The maximum penalty under the Act's schedule for failing to take reasonable security safeguards is
   1. ₹50 crore
   2. ₹250 crore
   3. ₹500 crore
   4. ₹10,000
5. Under the Act, a "child" is a person below the age of
   1. 12 years
   2. 14 years
   3. 16 years
   4. 18 years
6. A Consent Manager under the DPDP framework is registered with the
   1. Ministry of Electronics and IT
   2. Data Protection Board of India
   3. Reserve Bank of India
   4. Telecom Disputes Settlement and Appellate Tribunal
7. Section 44(3) of the DPDP Act amends the
   1. Right to Information Act, 2005
   2. Information Technology Act, 2000
   3. Aadhaar Act, 2016
   4. Consumer Protection Act, 2019
8. The committee headed by Justice B.N. Srikrishna (2017–18) was set up to
   1. review the Aadhaar Act
   2. examine electoral reforms
   3. propose a data protection framework
   4. draft amendments to the RTI Act

Quick Revision