By Mishi Choudhary and Eben Moglen
As the Supreme Court's constitutional bench was hearing arguments on the fundamental right of privacy, Union of India announced the formation of a committee to consider a national data protection statute. Already, the mere possibility of such legislation is being offered as a reason why a fundamental right of privacy should not be found. This is a pure confusion.
Data protection legislation, however it is framed, imposes regulatory liabilities on both government and private actors, setting appropriate and detailed standards of care and permission from data subjects that must be observed by all parties processing personally identifiable data in India. Such rules are valuable, but they cannot substitute for—and indeed only slightly supplement—a right to privacy. If the Supreme Court finds the Constitution protects privacy as a fundamental right, it will result in strong limitations on government invasions of personal liberties through surveillance, forced disclosure, limitations on travel, access to health care and other basic rights and liberties.
What, in practical terms, is the fundamental right to privacy about? Let's start with state surveillance. In the 20th century, governments tapped telephones, because telephones were the only means of communication available to tap. Police states could have immense networks of informants, but this was profoundly expensive and inefficient. In the 21st century, government unconstrained by law doesn't do wiretapping, it does life-tapping. The stream of data available for surveillance includes not only telephone conversations and messages, but information about physical location moment to moment, our thoughts and social life through social media, and--particularly in a cashless economy--everything we buy, sell, or do. State power, unconstrained by law can use surveillance to reach further into our behaviour, our selfhood, our heads, than ever before.
In the memory of living Indian people, only one government has ever tried to free itself from the rule of law to this extent. By some accounts, the Emergency could be directed only against a tiny class of politically active persons. The power of surveillance in a networked society is that it can be applied to the entire population, all at once. Statutory law is no protection against such abuse by a government possessing legislative majorities. Only constitutional limitation restricting the power of legislation is sufficient, in the hands of judges with the vision and courage to invoke it.
To see what the technologies of our future can do, if not constrained by our fundamental right, we need to only look at the situation in China, where the Communist Party is dedicated to the use of the Internet not only to surveil and censor every single individual's communications, but to eliminate the very idea of fundamental rights altogether. This is the road our Supreme Court can assure that we never travel.
An often-offered red herring in the discussion has been the data being collected by private parties such as social media and platform companies. Usage of the services offered by these companies is optional no matter how ubiquitous their presence may seem. Fundamental rights can only be enforced against the State which has the power to force its citizens and therefore exerts far greater influence on our lives.
Preventing abuse of government power by recognizing the fundamental rights of all persons begins in our legal history with the Great Charter of 1215. Fundamental rights are the cornerstones of our rule of law, recognized in 1948 in the Universal Declaration of Human Rights as the inalienable common heritage of human kind. Part III of our Constitution that embodies the fundamental rights, is essential for protecting the rights and liberties of people against the trespass of power delegated by them to their government. They are limitations that apply on all organs of the government. The fundamental right of privacy prohibits the government from acting to invade, by surveillance or compulsory disclosure, the personal entitlement to be ‘let alone’ by the State.
Legislation may also be required to implement fundamental rights, or to subject private parties to rules that spread respect for those rights throughout society. In this sense, data protection legislation may be consonant with the fundamental right of privacy, but it can neither replace the right nor render it obsolete or unimportant.
Once the Supreme Court has found that all persons in India have a fundamental right to privacy, as we hope they will, the passage of data protection legislation will be a valuable complement to that ruling.
Mr Baijayant Panda has introduced a proposed data protection statute as a private member's Bill in the current session of the Lok Sabha. This is sound legislation; the new committee could usefully take the existing Bill as a starting point. But it is important not to confuse the lesser issue of data protection with the larger, far more important, issue of the appropriate recognition of our fundamental rights.
Eben Moglen is Professor of Law and Legal History at Columbia Law School in the city of New York and Founder President of the Software Freedom Law Center.Mishi Choudhary is the Legal Director and President of SFLC.in