No right is absolute, and every right comes with certain restrictions. So does the Right to Privacy, which is a fundamental right under Article 21 of the Constitution of India. Right to life includes Right to Privacy and, as it is argued somewhere else on this blog, ‘privacy, as a right, is important for an individual to exercise control over his or her personality.’ The authority of the State to restrict the Right to Life (and limiting the right to Privacy) derives from the second part of Article 21. It states that the rights cannot be violated ‘except according to procedure established by the law’. After the Maneka Gandhi v. Union of India, the procedure established by the law must also be just, fair and reasonable. Every such procedure must pass the scrutiny of Articles 14, 19 and 21 of the Constitution of India. This post highlights the conditions under which the Indian State can constitutionally intervene with the Right to Privacy. Herein, it is crucial to understand that the rights are the general norms that must triumph, and the restrictions are exceptions. No exception can override the general norms except in certain clearly defined conditions (also known as ‘tests’ or ‘doctrines’).
Limiting the Right to Privacy: “Legitimate State Interest”
The fundamental right to privacy may be limited by a law that must be governed by a ‘legitimate state interest’. For example, in the Anuj Garg v. Hotel Association of India (“Anuj Garg”), the Supreme Court held that prohibiting women from choosing their profession (in this case, employment in bars) with an aim to ‘protect them’ is not proportionate to women’s right to autonomy, equality of opportunity, privacy etc (para 51). Herein, as per the Court’s decision, the state’s so-called legitimate aim is neither reasonable as per the mandate of Article 14 of the Constitution of India nor the means (complete prohibition of women in bars) adopted by the state are proportionate to the objective of the law (i.e., protecting the women).
This brings us to the principle of legitimate state interest. The majority verdict was authored by Justice Chandrachud in K.S. Puttaswamy v. Union of India (“Puttaswamy”) at paragraph 180 elucidates three requirements that are necessary for the state while intervening with citizens right to privacy, to protect ‘legitimate state interests’. All of the three requirements are mandatory. First, there must be a ‘law’ which is also an express requirement of Article 21. Second, there must be a legitimate state aim (the need for the law). The law must be within the corners of Article 14 which includes that it must not be arbitrary or manifestly arbitrary. The Court in Puttaswamy said,
“Legitimacy, as a postulate, involves a value judgment. Judicial review does not re-appreciate or second guess the value judgment of the legislature but is for deciding whether the aim which is sought to be pursued suffers from palpable or manifest arbitrariness. (Paragraph 180)”
This simply means that the legitimate aim of the state can be anything, from national security to anti-terrorism law. It is not for the courts to decide whether the aim is legitimate or not, but the courts must scrutinise whether the legitimate aim of the state is not ultra vires Article 14. Third, the means must justify the ends (proportionality); in this step, the state must ensure that “the means which are adopted by the legislature are proportional to the object and needs sought to be fulfilled by the law.” (Para 180) The means adopted by the state must not be disproportionate to the objective that it seeks to achieve.
For instance, the collection of data of citizens for social welfare schemes enables intervention in privacy rights. If there is a law that mandates such an intervention and it has a legitimate aim (to promote socio-economic parity which is a mandate as per directive principles of state policy), then such a law passes the first two steps of the test. Lastly, the means adopted by such a law to enable social welfare schemes must not be disproportionate and illegal. For example, if the state is collecting and storing citizen’s data, then there must be a data protection law to safeguard the data (including sensitive data) and only the necessary data must be collected which is required to enable the objective of the state (which does not mean everything under the sun). If these three tests are fulfilled, only then the exceptions under Article 21 are met and the state can intervene with privacy rights.
The Test of proportionality and privacy
The means which are adopted by the state must be proportionate with the rights. In the words of Fritz Fleiner, “the police should not shoot at sparrows with canons.” Therefore, whenever there is a constitutional challenge against any law of the state, the rights of the citizens must be balanced against the restrictions imposed by that law. This balancing of rights and restrictions is called ‘doctrine of proportionality’ (Modern Dental College and Research Centre & Ors. v. State of Madhya Pradesh & Ors). The Court said in paragraph 60,
“Jurisprudentially, “proportionality” can be defined as the set of rules determining the necessary and sufficient conditions for limitation of a constitutionally protected right by a law to be constitutionally permissible.”
The Court adopted the Justice Aahron Barak’s test of proportionality and it was reaffirmed in the case of K.S. Puttaswamy-II v. Union of India (“Aadhar Case”). Justice Barak’s test says that, “a measure restricting a right must, first, serve a legitimate goal (legitimate goal stage); it must, secondly, be a suitable means of furthering this goal (suitability or rational connection stage); thirdly, there must not be any less restrictive but equally effective alternative (necessity stage); and fourthly, the measure must not have a disproportionate impact on the right-holder (balancing stage).” In essence, a legislation must have a legitimate goal as discussed in the previous section and the means adopted must be to realise the legitimate goals of the state (it can be Directive Principles of State Policy or National Security concerns). Then, the means which are adopted by the law must be the ‘least restrictive measure’ of all (example, if the state wants to achieve X and there are two means to achieve that A and B. Then, the state must choose the least restrictive measure out of A and B). Lastly, such least restrictive measure must not be disproportionate to the rights of the citizens (for example, in the case of Anuj Garg, the complete prohibition of employment on women in bar disproportionately violates women’s right of equal opportunity, privacy and autonomy).
The first two steps are rarely disputed in the courts of law. Mostly, the concerns are raised regarding the third and the fourth step. The Supreme Court has adopted an inconsistent approach in dealing with the third step, that is, the least restrictive measure (in depth analysis of this issue authored by Ankush Rai, can be accessed here). The Court is not clear as to upon whom the burden lies with respect to showcasing the ‘least restrictive measure’: is it the petitioner or the respondent?
In the Aadhar Case, the Court said that the petitioners have the burden to suggest the least restrictive measure (paragraph 280). In the case of Anuradha Bhasin v. Union of India (Kashmir 4G issue), the Court lays the burden on the State in paragraph 70 where it says, “the ‘authorities’ must assess the ‘existence’ of any alternative mechanism in furtherance of the aforesaid goal.” In another case of Internet and Mobile Association of India v. Reserve Bank of India (Cryptocurrency case), the Court again said that the burden lies upon the State to suggest the least restrictive measure.
Out of these three judgments, the Aadhar case is a five-judge bench judgment and other two are three-judge bench judgment. Hence, there is an inconsistency with the Court’s approach which must be resolved by the Court itself in the next five-judge bench judgment.
The fourth step which is about the balancing of the rights is the most crucial prong of the test and is rarely focused on by the Courts. None of the means adopted by the law must go beyond what is necessary to achieve the objective. These restrictions must be interpreted strictly while giving wider interpretations to the enshrined rights. In the judgment of Rutili v. French Minister of Interior (1975 ECR 1219), the Court held that the interference with rights is only justified when “genuine and sufficiently serious threat to public and the policy is necessary for the protection of those interested in a democratic society”. In every case, the impact of the least restrictive measure on the right of the citizen is very crucial and it must be balanced carefully.
Conclusion
The state may have thousands of reasons to curb the right to privacy of the citizen. Nevertheless, the courts of law must strictly scrutinise every such intervention by the state. In the words of Ronald Dworkin, ‘discretion, like the hole in a doughnut, does not exist except as an area left open by a surrounding belt of restriction.’
In the modern times where every transaction has gone online (wherein the data of the users is collected and stored) and there exists questionable methods of State Surveillance like the use of spy-wares like Pegasus, it becomes vital for the Indian state to enact a data protection law which will ensure that the citizen’s privacy rights are protected. Furthermore, data protection law will enable a mechanism for redressing concerns related to privacy like the right to be forgotten, informational privacy, state surveillance, among other issues.
To understand the Right to Privacy and its importance, read another article here.