Right to Privacy of Personal Digital Data-Historical Perspective and Legislative Framework

Introduction

India\'s population is more than 1.42 billion, with around 700 million internet users. In this digital age, data has become the lifeblood of society, and protecting personal data has emerged as a paramount concern. To understand what we are protecting, let\'s look at two important definitions from the Digital Personal Data Protection Act, 2023 [DPDP Act]:

• \"Data\" refers to a representation of information, facts, concepts, opinions or instructions in a manner suitable for communication, interpretation, or processing by humans or automated means. [Section 2(h) of the DPDP Act].
• \"Digital personal data\" means personal data in digital form. [Section 2(n) of the DPDP Act].

Necessity of Legislative action for Data Protection

We live in a world where data is new oxygen in digital form and we need to protect it. The need of the hour is to protect this personal data from any unauthorized use with a legal framework for the following two reasons.

• Digitalization is now way of life and business: The revolution of banking system in India, the introduction of the Aadhar card, and the mobile revolution have significantly transformed India into a paperless, cashless, and faceless society. From the GST registration process to income tax scrutiny, faceless systems have been introduced. We\'ve transitioned from carrying cash in our wallets to hearing the ubiquitous \"UPI KARO\" when making purchases.
• Digitalization intrudes privacy: Data and digitalization have impacted many sectors, with social media and AI at the forefront. Social media platforms capture personal data such as age, interests, personal pictures, and lifestyle, which have become valuable business assets. Certain private data, such as personal finance or health information, is highly confidential. A leak of such information can benefit competitors, leading to significant business losses. Notable breaches including the exposure of 1.5 million customers\' data over an e-commerce platform (2023), the leakage of 20 million user details under the educational sector (2020), and the banking data breach (2019) highlight the urgent need for robust data protection measures.

Roots of Right to Privacy in the Constitution of India

Historically, the right to privacy was not explicitly stated as a Fundamental Right under Part III of the Indian Constitution. However, through various judgments, the courts have interpreted other constitutional rights to encompass a limited right to privacy, primarily through Article 21 the right to life and liberty. The Honorable Supreme Court of India in the landmark K.S. Puttaswamy\'s case upheld the right to privacy.

Legislative Attempts so far and the sufficiency thereof

Before the enactment of the Digital Personal Data Protection Act, 2023, there were no comprehensive legal provisions for safeguarding personal data in India. It was only Section 43A of the Information Technology Act, 2000, which dealt with data protection and compensation, but it had a limited scope. Likewise, prior to the DPDP Act 2023, Rule 3 of Information Technology (Reasonable Security Practices And Procedures & Sensitive Personal Data Or Information) Rules, 2011 defined sensitive personal data. Vide Section 44(2) of the DPDP Act, 2023, Section 43A have been omitted from the Information Technology Act, 2000.

Insufficiency of the legal framework, limited scope of existing rules, and need for stricter regulations

The Information Technology Act, 2000 and rules thereunder simultaneously played a vital role for a certain period of time, but rapid technological advancements and increasing reliance on digital platforms has necessitated broader protections. These rules primarily safeguarded \"sensitive personal data\" but did not cover all personal data stored digitally, such as emails and other communications. The necessity to clearly define and strictly enforce data collection, consent mechanisms, and usage purposes was felt by the Government of India.

July 2017- Formation of Justice B.N. Srikrishna Committee and recommendations

In July 31, 2017, the Government of India set up a Committee of Experts to study various issues relating to data protection in India, to make specific suggestions on principles underlying a data protection bill, and to draft such a bill.

Important Puttaswamy\'s Judgment by the Honorable Apex Court

In a historical case of Justice K.S. Puttaswamy & Another vs. Union of India and Others [(2017) 10 SCC 1], a nine-judge Constitution Bench of the honorable Supreme Court on 24th August 2017 gave a landmark decision on the Right to Privacy wherein it was unanimously declared that privacy is a fundamental right, protected as an intrinsic part of the right to life and personal liberty under Part III of the Constitution. Key Conclusions that may be derived from this judgment are:

• Privacy is a fundamental right. It has always been considered a natural right, inseparable from human personality.
• The right to privacy encompasses: i) Intrusion into an individual\'s physical body, ii) Informational privacy, and iii) Privacy of choice.

This historical judgment recognized informational privacy as part of the right to privacy and left the task of legislating data protection law to the Parliament, which would protect data processed by both public and private entities.

August 2023- Enactment of Digital Personal Data Protection Act, 2023 - a Brief Overview

President Draupadi Murmu gave assent to the Digital Personal Data Protection Bill, 2023, making it the Digital Personal Data Protection Act, 2023, on August 11, 2023. The DPDP Act includes hefty penalties, up to 250 crore, for non-compliance. Key Provisions of the DPDP Act are:

• Applicability (Section 3 of the DPDP Act): To the processing of digital personal data within India, and to processing outside India if connected to offering goods or services to data principals in India.
• Data collectors must notify individuals about the purpose of data collection, and the data should not be used beyond that purpose.
• Data shared for a specific purpose should be used only for that purpose.

Conclusion

This Act is to provide for the processing of digital personal data in a manner that recognizes both the right of individuals to protect their personal data and the need to process such personal data for lawful purposes. Strict compliance will be required all across when personal information is stored digitally. While the Act is in place, its rules are still awaited, when issued, the effective implementation will be a priority, let us see how!