Privacy Laws in India

Written in 2022, before India passed the Digital Personal Data Protection Act, 2023. Read it as a picture of the law at that time.

Privacy is a term that is being thrown around everywhere when it comes to the internet. ‘privacy is a myth’ and 'you don’t have privacy in the age of the internet' are some of the things that we hear so often that we take privacy for granted. But have you ever thought about what privacy is actually?

If you go to google and search for the word ‘privacy’, a lot of results will appear, including the definition of the term. And that is what I did. The Cambridge dictionary website gives two definitions “someone's right to keep their personal matters and relationships secret” and the “state of being alone”.

But this is just a broad definition. We can divide privacy based on many factors, including the body of a person, the information about them, their location, space, medical information, association, religious affiliation, thoughts and feelings, behaviour, action, communication, sexual orientation and the list goes on.

The question is, do we have a right to privacy? If yes, what is the law that protects such a right?

We do have a draft personal data protection bill in the parliament, but it is just a bill as of now. And we will have to wait some time to see it as an act. Meanwhile, we do have other laws and case laws that deals with privacy. Let us see what they are:

1. Law of torts

Tort, as the definition goes, is a civil wrong. And there are such civil wrongs that are essentially a breach of privacy of a person. When there is a trespass in a private property, the trespass also impacts the right to privacy as the trespasser is invading the private space of the owner. He might have things that are personal to him that he doesn’t want people to see or he might be just a person who does not want many social interactions.

Another such wrong is a breach of confidence. Imagine that you are going to apply for a dream course and you are almost sure that you will get in and you confide the same in a person you trust and ask the person not to tell others. But he tells anyway. That is a breach of confidence and a breach of privacy. Your right to let others into a piece of knowledge about yourself is yours alone. Here the person did not respect that. So its also a breach of privacy.

2. Contract law

In contract law, privacy is usually dealt with clauses such as a privacy clause or a confidentiality clause, that you do not disclose the information you are getting from the other party, as it would negatively affect that party. It is basically privacy.

3. Professional codes

If you are a fan of Suits or any such legal dramas, you may have come across the term ‘attorney-client privilege’. What does that mean? It means that whatever that the client tells their attorney, is confidential information and cannot be disclosed to others. This is also applicable to doctor-patient, husband-wife, etc. Sections 123 to 126 of the Indian Evidence Act deal with such situations.

The major legislation that deals with online privacy protection in India is the Information Technology Act, of 2000. It has two specific sections that deal with data privacy. Section 43A and section 72A.

Section 43A deals with compensation for the loss of data when the body corporate that is responsible for the data is negligent in placing reasonable protection to the data and losses the same, such a body corporate will be liable to pay compensation to the person who was affected.

Section 72A takes us back to the contracts. When you are having a contractual clause where you are responsible to safely storing the information that you are given, and you fail to do so, you will have to pay compensation to the affected person. The same is here. The only difference is that the data is stored digitally, and there is a 3-year punishment. It is also applicable to intermediaries.

But there are certain cases where the liability of the intermediary is exempted under section 79 of the same act. If the intermediary can establish that the offence was done without his knowledge, or he was merely a bridge between the user and the communication system (that is, the internet), then he or she is not liable.

Why do we need a comprehensive data protection law?

The laws we have are not enough to protect the interest of the citizen of the country. Without airtight laws, the government cannot ensure the fundamental right to privacy under article 21 of the Indian Constitution, as recognised by the Supreme Court of India in K.S Puttaswamy Vs. Union of India in 2017.

The need for strong privacy protection laws is becoming increasingly clear in light of recent issues and controversies surrounding the popular communication app 'WhatsApp' and its new privacy policy update. This has caused a stir in India because WhatsApp is a popular app in the country, with nearly 39 crore of users. WhatsApp's new contentious policy update states that the users must agree to the new privacy policy which says that WhatsApp will share it with its parent company Facebook in order to improve its business platforms. Due to popular disapproval and challenges in the court, the policy has been on hold. However, This shows why we require a strong data protection law in India.