Right to Privacy

What is the Right to Privacy?

The **right to privacy** is the right of an individual to be free from unwarranted intrusion into their personal life, bodily autonomy, informational self-determination, and private affairs. It protects a person's ability to make choices about their own body, personal relationships, home, correspondence, and data without interference from the state or other individuals.

In India, the right to privacy has been recognised as a **fundamental right** forming an intrinsic part of the **right to life and personal liberty** guaranteed under **Article 21** of the Constitution. This means that no person can be deprived of their privacy except by a procedure established by law that is just, fair, and reasonable.

Legal Framework in India

The K.S. Puttaswamy Judgment (2017)

The most significant development in Indian privacy law is the unanimous decision of the **nine-judge bench** of the Supreme Court in **Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1**. This landmark judgment settled a decades-old debate by unequivocally holding that:

- The **right to privacy is a fundamental right** protected under Part III of the Constitution.

- It is an integral part of **Article 21** (right to life and personal liberty), **Article 14** (right to equality), and **Article 19** (freedoms of speech, movement, etc.).

- The right includes **privacy of the body, mind, decision-making, and information**.

- Any restriction on privacy must satisfy a **three-fold test:** (i) the restriction must be sanctioned by law, (ii) it must serve a legitimate state aim, and (iii) the means adopted must be proportionate to the objective.

The court explicitly overruled the earlier decisions in **M.P. Sharma v. Satish Chandra (1954)** and **Kharak Singh v. State of U.P. (1962)** that had held that the right to privacy was not a fundamental right.

Constitutional Provisions

- **Article 21:** "No person shall be deprived of his life or personal liberty except according to procedure established by law." The Supreme Court has interpreted "personal liberty" expansively to include the right to privacy.

- **Article 14:** The right to equality and equal protection of laws protects against arbitrary invasions of privacy.

- **Article 19(1)(a):** Freedom of speech and expression includes the right to receive information and the right to silence — aspects connected to informational privacy.

- **Article 19(1)(d):** Freedom of movement includes the right to move freely without surveillance.

The Digital Personal Data Protection Act, 2023

Following the Puttaswamy judgment, Parliament enacted the **Digital Personal Data Protection Act, 2023 (DPDP Act)** to provide a statutory framework for the protection of personal data. Key provisions include:

- **Consent-based data processing** — Personal data can be processed only with the informed consent of the individual or for certain "legitimate uses."

- **Data Principal rights** — Individuals (called "data principals") have the right to access their data, seek correction or erasure, and nominate a person to exercise rights on their behalf.

- **Data Fiduciary obligations** — Entities processing personal data (called "data fiduciaries") must maintain data accuracy, implement security safeguards, and delete data once the purpose is fulfilled.

- **Data Protection Board** — The Act establishes a Data Protection Board of India to adjudicate complaints and impose penalties.

- **Penalties** — Non-compliance can attract penalties of up to Rs. 250 crore depending on the nature of the violation.

Dimensions of the Right to Privacy

1. Bodily Privacy

The right to make decisions about one's own body, including medical treatment, reproductive choices, and sexual autonomy. The Supreme Court's decisions decriminalising homosexuality in **Navtej Singh Johar v. Union of India (2018) 10 SCC 1** and recognising the right to die with dignity in **Common Cause v. Union of India (2018) 5 SCC 1** draw significantly from the right to bodily privacy.

2. Informational Privacy

The right to control how one's personal information is collected, used, stored, and shared. This is particularly relevant in the digital age, where personal data is continuously collected by governments and corporations. The DPDP Act, 2023 directly addresses this dimension.

3. Decisional Privacy

The right to make intimate personal choices — about relationships, family, marriage, procreation, and how one wishes to live — without state interference. The Puttaswamy judgment explicitly recognised this aspect.

4. Spatial Privacy

The right to be free from intrusion into one's home, correspondence, and personal spaces. This includes protection against unlawful searches and surveillance.

Practical Examples

**Example 1:** A government agency collects biometric data (fingerprints, iris scans) of all citizens for a national identity programme. Citizens challenge this as a violation of informational privacy. The court must apply the three-fold test from Puttaswamy to determine whether the data collection is lawful, serves a legitimate aim, and is proportionate.

**Example 2:** An employer installs surveillance cameras in the washrooms of its office premises. Employees can challenge this as a violation of their right to spatial and bodily privacy, as the surveillance is disproportionate and intrudes into spaces where employees have a reasonable expectation of privacy.

**Example 3:** A social media company shares users' personal data with third-party advertisers without obtaining informed consent. Under the DPDP Act, 2023, affected users can file complaints with the Data Protection Board seeking penalties against the company and erasure of their data.

When Does This Term Matter?

- **Aadhaar and biometric data** — The right to privacy is central to challenges against mandatory Aadhaar linkage with bank accounts, mobile numbers, and government services.

- **Digital data and surveillance** — With increasing digitisation, the right to privacy governs how personal data is collected, processed, and shared by both governments and private entities.

- **Phone tapping and interception** — Interception of communications must comply with the safeguards laid down under the Telegraph Act, 1885 and the IT Act, 2000, and must satisfy the proportionality test.

- **Medical records** — Patients have a right to confidentiality of their medical records, and disclosure without consent can violate their right to privacy.

- **Sexual orientation and personal choices** — The right to privacy protects individuals from state interference in their intimate personal decisions.

- **Media reporting** — The media's right to report must be balanced against an individual's right to privacy.

Frequently Asked Questions

Is the right to privacy an absolute right?

No. Like all fundamental rights, the right to privacy is subject to reasonable restrictions. The Supreme Court in the Puttaswamy judgment laid down a three-fold test for any restriction on the right to privacy: (i) the restriction must be prescribed by law, (ii) it must pursue a legitimate state aim (such as national security, public order, or prevention of crime), and (iii) the restriction must be proportionate — meaning the means must be the least restrictive measure available to achieve the objective.

How does the right to privacy apply to the private sector?

While fundamental rights under the Constitution are primarily enforceable against the state, the right to privacy has horizontal application through statutory laws. The Digital Personal Data Protection Act, 2023 imposes obligations on private entities (data fiduciaries) to protect the personal data of individuals. Additionally, courts have applied privacy principles in disputes between private parties, particularly in cases involving surveillance, data breaches, and unauthorised disclosure of personal information.

What is the relationship between the right to privacy and the right to information?

The Right to Information Act, 2005 grants citizens the right to access information held by public authorities. However, Section 8(1)(j) of the RTI Act exempts personal information that has no relationship to any public activity or interest, or that would cause unwarranted invasion of the privacy of the individual. Courts balance these two rights on a case-by-case basis, weighing the public interest in disclosure against the individual's right to privacy.

Can the police access my phone or digital data without a warrant?

As a general principle, police cannot search or seize your personal digital devices — such as mobile phones, laptops, or storage devices — without following the procedure established by law. Under the Code of Criminal Procedure (now BNSS, 2023) and the Information Technology Act, 2000, searches and seizures must be authorised by a warrant or conducted under circumstances recognised by law. Any evidence obtained through an unlawful search may be challenged as a violation of the right to privacy, though Indian courts apply the test of relevance rather than an automatic exclusionary rule.