Introduction
The creation of identification systems such as Aadhaar, as well as the widespread technologies such as CCTV cameras, drones, and Facial Recognition Technology, require a continuous challenge of the digital entitlement of citizens to the specified goals of national security and state protection. In 2017, the Supreme Court declared the Right to privacy as one of the primary rights, which establishes a decisive precedent to assess the activities of the states regarding the collection of data and surveillance. In the recent past, legal interpretations have been provided on disclosure of identification data, and new extensive laws have been passed to govern processing of digital personal data.
Background
In August 2017, the Supreme Court of India in case of Justice K.S. Puttaswamy gave unanimous recognition to the Right to Privacy as a fundamental right under the Constitution. This was after a writ petition was filed in 2012 that questioned the constitutional validity of the Aadhaar Scheme, claiming that the government had not made sufficient protection of personal information of the citizens.
The Aadhaar system, created by the Unique Identification Authority of India (UIDAI), issues legal Indian citizens with a 12-digit unique identifier number that is their unique identity based on biometric data provided, such as fingerprint and retina scans, and is registered in a centralized database.
This data is governed by the Aadhaar Act, 2016 where strict data privacy policies are enforced. In particular, the Aadhaar Act, in Section 29(1), forbids the transfer of core biometric data, including fingerprints and iris scans, to anybody. There is some disclosure in the Act, but it is done in limited circumstances under a judicial order: Section 33(1) provides that only an order of a judge of a High Court may disclose some data.
Key points
The existing regulatory and social environment of privacy and surveillance can be defined by a number of following points:
- Judicial Oversight of Aadhaar Data Disclosure: The Aadhaar identity information disclosure, authentication records and usage details, to investigating authorities must be done by a court order under Section 33 of the Aadhaar Act, as stipulated by the Karnataka High Court.
- Non-Disclosure of Core Biometrics: According to the 29(1) of the Aadhaar Act, the core biometric data (fingerprints and iris scans) are not to be shared with anybody, even though there are provisions to disclose the usage data.
- Public Awareness and Perception: The polled population only heard about the right to privacy judgment of the Supreme Court about one in six. Although there is worry about digital theft and data breaches, mass surveillance (as in CCTVs) is not opposed, as long as it is perceived to increase the safety or order of the people.
- Niche Surveillance and Dissent: It is the general opinion amongst experts that unregulated targeted surveillance by the state is the most worrying aspect and is already being utilized as an instrument of curbing dissent. Some cases are when it is alleged that Pegasus spyware has been used to spy on opposition leaders, journalists and activists.
Recent Development
- Karnataka High Court Decisions on Aadhaar Data: The High Court of Karnataka decided that core biometric data cannot be disclosed, however, identity data like authentication record and location of usage relating to Aadhaar card may be produced at the bequest of a judicial order under Section 33 of the Aadhaar Act. In a particular situation of a missing individual, the court instructed the UIDAI to provide only the information of the place of the Aadhaar card use since the complaint was filed.
- Digital Personal Data Protection Act, 2023: Digital Personal Data Protection Act, 2023 has been approved and the President gave its assent on August 11, 2023. The purpose of this Act is to control the way in which digital personal data are processed by the recognition of the right of people to keep their data as well as the necessity to process such data because of the lawful activities. It requires a Data Fiduciary to notify the Data Principal of the personal data which are going to be processed and the intended purpose. The data protection board of India is also developed under the act to investigate the breach and give penalties.
- The Aadhaar Act Amendment proposal: Discussion is also being made to seek an amendment of the Aadhaar Act to allow police to have access to the core biometric information with a specific view to identify a dead person, which would facilitate a forensic approach. It is proposed that a jurisdictional judicial magistrate would be allowed to give the green light to such limited use instead of having to issue an order to do so by the High Court.
- Absence of Surveillance Training/Capacity: In 2022, the National Crime Records Bureau (NCRB) reported that it does not offer a special course on CCTV footages analysis to police training, although it mentions a course of the same nature on its website, which indicates an untrained workforce to handle advanced surveillance technology.
Conclusion
The legal protection of the Right to Privacy and statutory protection entrenched in the Aadhaar Act (Section 29(1) securing core biometrics, Section 33(1) ensuring the need to obtain a judicial approval to access the usage data) affirm the status of the protection of personal data. One important legal step in the establishment of the extensive legal framework towards accountability and redress of grievances in the digital arena is the enactment of the Digital Personal Data Protection Act, 2023. Nonetheless, scholars warn that even in the view of the advancements in law, the ongoing anxieties about the absence of transparency, underlying partiality on technology, as well as the possibility of unchecked targeted monitoring by state services, require strict and stringent and independent checks and balances, preferably including judicial review, to ensure that surveillance technology is not abused against the oppressed groups or invariably to deafen legitimate dissent.
“PRIME LEGAL is a full-service law firm that has won a National Award and has more than 20 years of experience in an array of sectors and practice areas. Prime legal falls into the category of best law firm, best lawyer, best family lawyer, best divorce lawyer, best divorce law firm, best criminal lawyer, best criminal law firm, best consumer lawyer, best civil lawyer.”
WRITTEN BY Manisha Kunwar
