Privacy Matters | India needs a new law to regulate govt surveillance

The bitter truth is, surveillance by the State is legal under certain circumstances. On November 19, Union Minister of State for Home G Krishan Reddy, in a written reply to Parliament, said that the government (Centre and state governments) are "empowered" by the law to authorise agencies to intercept, monitor or decrypt “any information generated, transmitted, received or stored in any computer resource”. However, it is "subject to safeguards as provided in the rules".

Even if the government is empowered to do so, there is no specific law that regulates surveillance by a government or its empowered agencies. Citizens also have no recourse if the state or any of its actors misuse the law.

Let's look at the existing legal frameworks that allows a government or a government agency to conduct surveillance.

The Indian Telegraph Act, 1885 allows interception of calls and Information Technology (IT) Act, 2000 permits interception of data by the government under certain circumstances. Hacking, however, is a criminal offence. There’s more. The IT (Procedures and Safeguard for Interception, Monitoring and Decryption of Information) Rules that were framed in 2009 under the IT Act notes that only a competent authority can issue an order for the interception, monitoring or decryption of any information generated, transmitted, received and stored in any computer resource which includes mobile phones. The competent authority is the Union Home Secretary or secretaries in charge of the state home departments.

So, all it takes is one Secretary to say yes!

In December 2018, the Centre authorised 10 agencies -- the Intelligence Bureau, the Central Bureau of Investigation, the National Investigation Agency, the Research & Analysis Wing, the Directorate of Signal Intelligence, the Narcotics Control Bureau, the Enforcement Directorate, the Central Board of Direct Taxes, the Directorate of Revenue Intelligence and the Delhi Police Commissioner -- to conduct surveillance. This authorisation came under huge criticism that the government was building a “surveillance state”. The government countered it with an argument that it was doing everything under existing legal frameworks. However, this has been challenged in the Supreme Court by four separate public interest litigations. In January, the court had sought a reply from the government on the surveillance order.

On the other hand, the Constitution of India recognises "privacy" as a fundamental right (Article 14, 19 and 21). The Supreme Court has, in August 2017, unanimously upheld the right to privacy as a fundamental right in a landmark judgment in the Justice KS Puttaswamy (Retd) vs Union of India case.

The question may be which should be given preference -- privacy for an individual, or the State's need for surveillance to ensure its citizens are safe? Individual privacy can never be an absolute right if there is the slightest chance that it might put the country's security at risk. That’s true for any nation in the world. What needs to be done is to ensure that the State’s power to conduct surveillance is not misused.

Under the current legal frameworks, all it takes to conduct surveillance on any individual is to get the permission of a secretary, as mentioned above. This is where the breach is likely to take place. A solution for this could be to bring this under judicial purview, supported by evidence to back up the need for a surveillance on any individual. Something similar, probably a more stringent system is followed in the United States.

Following the above-cited Google and WhatsApp security breaches, there is a need for a separate law to regulate surveillance by the government. Justice BN Srikrishna, who headed the committee that drafted the proposed Personal Data Protection Bill, 2018, (originally submitted on July 27, 2018), has also said in an interview to The Economic Times that a “special law” should be framed to regulate how government and its agencies monitor its citizens using technology tools.

Truth is there are a lot of grey areas and legal loopholes between the concept of ‘right to privacy’ and the government’s requirements for security when it comes to protecting the State. These loopholes need to go.