JUDGEMENTS : K S PUTTASWAMY

Decided On: 26.09.2018

Appellants: Justice K.S. Puttaswamy And Ors.

Vs.

Respondent: Union of India (UOI) and Ors

MANU/SC/1054/2018

PET:

417. As already explained above, the Constitution Bench has held that in K.S.
Puttaswamy though privacy is a fundamental right inter alia traceable to the
right to liberty enshrined in Article 21 of the Constitution, it is not an absolute
right but subject to limitations. The Court also laid down the triple test which
need to be satisfied for judging the permissible limits for invasion of privacy
while testing the validity of any legislation. These are:

(a) The existence of a law.

(b) A "legitimate State interest"; and

(c) Such law should pass the "test of proportionality".

PET:

593. The concept of "invasion of privacy" is not the early conventional thought
process of "poking ones nose in another person's affairs". It is not so simplistic.
In today's world, privacy is a limit on the Government's power as well as the
power of private sector entities

RES:

585. The growth and development of technology has created new instruments
for the possible invasion of privacy by the State, including through surveillance,
profiling and data collection and processing. Surveillance is not new, but
technology has permitted surveillance in ways that are unimaginable. Edward
Snowden shocked the world with his disclosures about global surveillance.
States are utilising technology in the most imaginative ways particularly in view
of increasing global terrorist attacks and heightened public safety concerns.
One such technique being adopted by the States is "profiling". The European
Union Regulation of 2016 [Regulation No. (EU) 2016/679 of the European
Parliament and of the Council of 27-4-2016 on the protection of natural
persons with regard to the processing of personal data and on the free
movement of such data, and repealing Directive No. 95/46/EC (General Data
Protection Regulation).] on data privacy defines "profiling" as any form of
automated processing of personal data consisting of the use of personal data
to evaluate certain personal aspects relating to a natural person, in particular
to analyse or predict aspects concerning that natural person's performance at
work, economic situation, health, personal preferences, interests, reliability,
behaviour, location or movements [Regulation No. (EU) 2016/679 of the
European Parliament and of the Council of 27-4-2016 on the protection of
natural persons with regard to the processing of personal data and on the free
movement of such data, and repealing Directive No. 95/46/EC (General Data
Protection Regulation).]. Such profiling can result in discrimination based on
religion, ethnicity and caste. However, "profiling" can also be used to further
public interest and for the benefit of national security.

RES:

325. Like other rights which form part of the fundamental freedoms protected
by Part III, including the right to life and personal liberty Under Article 21,
privacy is not an absolute right. A law which encroaches upon privacy will have
to withstand the touchstone of permissible restrictions on fundamental rights.
In the context of Article 21 an invasion of privacy must be justified on the basis
of a law which stipulates a procedure which is fair, just and reasonable. The
law must also be valid with reference to the encroachment on life and personal
liberty Under Article 21. An invasion of life or personal liberty must meet the
threefold requirement of (i) legality, which postulates the existence of law; (ii)
need, defined in terms of a legitimate State aim; and (iii) proportionality which
ensures a rational nexus between the objects and the means adopted to
achieve them.

RES:
145. It was also argued that the very scheme of the Aadhaar and the manner in
which it operates excludes every possibility of data profiling and, therefore, the
question of State surveillance would not arise. The powerpoint presentation
which was given by Dr. Pandey, as has been stated above, was referred to, on
the basis of which it was argued that the Aadhaar design takes full care of
security of persons.

PET:

178. The Court held that such invasion of privacy was not proportionate as it
was not "necessary in a democratic society" as it did not fulfill any pressing
social need.

PET:

417. As already explained above, the Constitution Bench has held that in K.S.
Puttaswamy though privacy is a fundamental right inter alia traceable to the
right to liberty enshrined in Article 21 of the Constitution, it is not an absolute
right but subject to limitations. The Court also laid down the triple test which
need to be satisfied for judging the permissible limits for invasion of privacy
while testing the validity of any legislation. These are:

(a) The existence of a law.

(b) A "legitimate State interest"; and

(c) Such law should pass the "test of proportionality".

PET:

480. Privacy, being an intrinsic component of the right to life and personal
liberty, it was held that the limitations which operate on those rights, Under
Article 21, would operate on the right to privacy. Any restriction on the right to
privacy would therefore be subjected to strict constitutional scrutiny.

PET:

577. It is important to justify the usage of biometric technology given the

invasion of privacy. When the purpose of collecting the biometric data is just
for authentication and there is little or no benefit in having stronger user
identification, it is difficult to justify the collection of biometric information.
The potential fear is that there are situations where there are few or no
benefits to be gained from strong user verification/identification and this is
where biometric technology may be unnecessary.208 (Example: When
ascertaining whether an individual is old enough to go to a bar and drink
alcohol, it is unnecessary to know who the person is, when all that is needed to
be demonstrated is that the individual is of legal age). Fundamental rights are
likely to be violated in case biometrics are used for applications merely
requiring a low level of security.

PET:

677. In Puttaswamy, Justice Kaul (in his concurring judgment) emphasized

upon the concerns regarding surveillance of individuals. The learned Judge
held: The growth and development of technology has created new instruments
for the possible invasion of privacy by the State, including through surveillance,
profiling and data collection and processing. Surveillance is not new, but
technology has permitted surveillance in ways that are unimaginable... One
such technique being adopted by States is 'profiling'. The European Union
Regulation of 2016 on data privacy defines 'Profiling' as any form of automated
processing of personal data consisting of the use of personal data to evaluate
certain personal aspects relating to a natural person, in particular to analyse or
predict aspects concerning that natural person's performance at work,
economic situation, health, personal preferences, interests, reliability,
behaviour, location or movements. Such profiling can result in discrimination
based on religion, ethnicity and caste.368 Justice Kaul also dealt with the need
to regulate the conduct of private entities vis-a-vis profiling of individuals: The
capacity of non-State actors to invade the home and privacy has also been
enhanced. Technological development has facilitated journalism that is more
intrusive than ever before...

[I]n this digital age, individuals are constantly generating valuable data which
can be used by non-State actors to track their moves, choices and preferences.
Data is generated not just by active sharing of information, but also passively...
These digital footprints and extensive data can be analyzed computationally to
reveal patterns, trends, and associations, especially relating to human
behaviour and interactions and hence, is valuable information. This is the age
of 'big data'. The advancement in technology has created not just new forms of
data, but also new methods of analysing the data and has led to the discovery
of new uses for data. The algorithms are more effective and the computational
power has magnified exponent.

PET:

703. There is no antinomy between the right to privacy and the legitimate
goals of the State. An invasion of privacy has to be proportional to and
carefully tailored for achieving a legitimate aim. While the right to food is an
important right and its promotion is a constitutional obligation of the State, yet
the right to privacy cannot simply and automatically yield to it. No legitimate
goal of the State can be allowed at the cost of infringement of a fundamental
right without passing the test of constitutionality. While analysing the
architecture of Aadhaar, this Court has demonstrated how the purported
safeguards in the Aadhaar architecture are inadequate to protect the integrity
of personal data, the right of informational self-determination and above all
rights attributable to the privacy-dignityautonomy trilogy. It is also concluded
that the Aadhaar scheme is capable of destroying different constitutional
identities. The financial exclusion caused due to errors in Aadhaar based
authentication violate the individual's right to dignity. The Aadhaar scheme
causes an unwarranted intrusion into fundamental freedoms guaranteed
under the Indian Constitution since the Respondents have failed to
demonstrate that these measures satisfy the test of necessity and
proportionality.

PET:

752. The collection of the biometrics of individuals impacts their privacy and
dignity. Informed consent is crucial to the validity of a state mandated measure
to collect biometric data. Encroachment on a fundamental right requires the
enacting of a valid law by the legislature.442 The law will be valid only if it
meets the requirements of permissible restrictions relating to each of the
fundamental rights on which there is an encroachment. Privacy animates Part
III of the Constitution. 443 The invasion of any right flowing from privacy places
a heavy onus upon the State to justify its actions. Nine judges of this Court in
Puttaswamy categorically held that there must be a valid law in existence to
encroach upon the right to privacy. An executive notification does not satisfy
the requirement of a valid law contemplated in Puttaswamy. A valid law, in this
case, would mean a law enacted by Parliament, which is just, fair and
reasonable. Any encroachment upon the fundamental right to privacy cannot
be sustained by an executive notification. There is also no merit in the
submission of the Respondents that prior to the enactment of the Aadhaar Act,
no individual has been enrolled under compulsion, and since all enrolments
were voluntary, these cannot be considered to be in breach of Article 21 or any
other fundamental right. The format of the first two enrolment forms used by
UIDAI, under which around 90 crore enrolments were done, had no mention of
informed consent or the use of biometrics. Hence, this submission is rejected.
Apart from the existence of a valid law which authorises an invasion of privacy,
Puttaswamy requires that the law must have adequate safeguards for the
collection and storage of personal data. Data protection, which is intrinsic to
privacy, seeks to protect the autonomy of the individual. The judgment noted
the centrality of consent in a data protection regime. The Aadhaar Act provides
certain safeguards in Section 3(2) and Section 8(3) for the purposes of ensuring
informed consent, and in terms of Section 29 read with Chapter VII in the form
of penalties. The safeguards provided under the Act were not in existence
before the enactment of the Act. The collection of biometrics after the 2009
notification and prior to the Aadhaar Act suffers from the absence of adequate
safeguards. While a legislature has the power to legislate retrospectively, it
cannot retrospectively create a deeming fiction about the existence of
safeguards in the past to justify an encroachment on a fundamental right. At
the time when the enrolments took place prior to the enactment of the
Aadhaar Act in September 2016, there was an absence of adequate
safeguards. Section 59 cannot by a deeming fiction, as it were, extend the
safeguards provided under the Act to the enrolments done earlier. This will be
impermissible simply because the informed consent of those individuals,
whose Aadhaar numbers were generated in that period cannot be
retrospectively legislated by an assumption of law. Moreover, it is a principle
of criminal law that it cannot be applied retrospectively to acts which were not
offences at the time when they took place. Article 20(1) of the Constitution
provides that "No person shall be convicted of any offence except for violation
of the law in force at the time of the commission of the act charged as an
offence". The application of the criminal provisions of the Act, provided under
Chapter VII of the Act which deals with "Offences and Penalties", cannot be
extended to the period prior to the enactment of the Aadhaar Act.

PET:

835. In the Privacy judgment P.S. Puttaswamy case (supra) all nine Judges
uniformly agreed that privacy is a fundamental right traceable to the right to
liberty Under Article 21 of the Constitution and hence subject to the same
limitations as applicable to the said Article. It has further been held that right
of privacy is not absolute and is subject to limitations. Justice D.Y. Chandrachud
in his lead judgment laid down that following three tests are required to be
satisfied for judging the permissible limits of the invasion of privacy Under
Article 21 of the Constitution:

(a) The existence of a law;

(b) A legitimate State interest; and

(c) The said Law should pass the test of proportionality.

PET:

1067: The submission of the Respondents that least intrusive test cannot be
applied to judge the proportionality of Aadhaar Act has been refuted by
Petitioners. Petitioners submit that least intrusive test is a test, which was
applied in large number of cases and i.e. the test which may ensure that there
is a minimal invasion of privacy. It is submitted that the Respondents could
have switched to a smart card, which itself contain the biometric information
of a person. Respondents submitted that least intrusive test has not been
approved either in the Modern Dental (supra) or in the Puttaswamy case. We
are also of the view that there are several reasons due to which least intrusive
test cannot be insisted. For applying the least intrusive test, the Court has to
enter comparative analysis of all methods of identification available, which
need to be examined with their details and compared. Court has to arrive at
finding as to which mode of identity is a least intrusive. We are of the view that
comparison of several modes of identity and to come to a decision, which is
least intrusive is a matter, which may be better left to the experts to examine.
Further, there are no proper pleadings and material with regard to other
modes of identification, which could have been adopted by the State, to come
to a definite conclusion by this Court.

The judgements in M.P Sharma and Kharak Singh being those of eight and six
judges respectively, holding that the Right to Privacy is not a Fundamental
Right. So the tests laid in Puttaswamy’s judgement have been satisfied and
hence the Aadhaar Act is not unconstitutional for the following reasons:

1. First condition in regard to the existence of a law has been satisfied.

2. Legitimate state interests such as prevailing the dissipation of social
welfare benefits, (prevention of money laundering, black money and tax
evasion and protection of national security are satisfied through the
Act).

PET:

In 2012 Justice K.S.Puttaswamy (retired) filed a petition in the Supreme Court

challenging the constitutionality of Aadhaar on the grounds that it violates the
Right to Privacy.

During the hearings, the central government opposed the classification of

privacy as a fundamental right.

The governments opposition to the right relied on two early decisions of

1.MP Sharma V. Satish Chandra in 1954.

2.Kharak Singh V. State of UP in 1962.

Which had held that privacy was not a fundamental right.

RESP:

In MP Sharma, the bench held that the drafters of the constitution did not
intend to subject the power of search and seizure to a fundamental right to
privacy.

They argued that the Indian constitution does not include any language similar
to the fourth Amendment of the US Constitution and therefore questioned the
existence of a protected Right to Privacy.

PET:

Inception of recognisation of Right to Privacy (ISSUE 2)

In Kharak Singh Case, the decision invalidted a Police Regulation that provided
for nightly domiciliary visits.

This Petitioner under Article 32 of the Constitution challenged the

constitutional validity of CH XX of the UP Police Regulations and the powers
conferred upon Police officials by its several provisions on the ground that they
violate the right guaranteed to citizens by Article 19 (1) (d) and Article 21 of the
Indian constitution.

Regulation 228 which occurs in CH XX of the Police Regulation defines “History-

Sheets as the personal records of criminals under surveillances”.