Surveillance is not the only privacy issue

Why in the News

Three recent developments together show surveillance spreading across the state, private firms and online networks:

1. The Supreme Court (SC) has disposed of a public interest litigation (PIL) on doxxing (publishing a person’s private details online) and deepfakes, asking Union Ministries to take remedial measures.
2. Rajya Sabha member A.A. Rahim has petitioned the SC against the Delhi Police’s use of facial recognition and biometric surveillance during the Cockroach Janta Party (CJP) protests.
3. The SC has upheld the Election Commission’s (EC) Special Intensive Revision (SIR) of electoral rolls, which critics warned could exclude eligible voters.

What is diffuse surveillance?

1. What it is: Diffuse surveillance is watching shared among states, private companies and foreign vendors, not one identifiable actor. It is like cameras run by many owners, with nobody answerable for the whole.
2. An old impulse: State interest in identifying people predates Aadhaar by over 150 years. In 1858, British magistrate William Herschel took handprints on contracts, later developed into Bengal’s fingerprint classification system.
3. What is new: The scale and speed differ, visible in Aadhaar, Delhi’s cameras and the SIR.
4. The takeaway: A privacy law that checks one actor at a time cannot protect data passing through many hands.

What are the three kinds of watching?

1. Facial recognition by the state: Rahim’s petition alleges police used facial recognition, AI-enabled smart glasses, drones and a mobile command vehicle at Jantar Mantar. Two private firms hosted the data.
2. Doxxing by online networks: Women at the CJP protests later had their personal details published, with reported rape and death threats.
3. Public shaming precedent: In March 2020, Uttar Pradesh put photos and addresses of Citizenship (Amendment) Act, 2019 protesters on Lucknow hoardings. The Allahabad High Court ordered removal as an “unwarranted interference in privacy”.
4. Identity checks on the rolls: Under the SIR, identity checks decide who stays on the electoral roll. The SC held the EC may examine citizenship only for this purpose, not decide it.
5. Scale of the SIR: Bihar’s roll fell from about 7.89 crore to 7.42 crore electors.

What is doxxing?

1. Meaning: Doxxing is publishing a person’s private details, such as a home address, online so that others can find and target them.
2. Speed of exposure: A photo can be uploaded, identified, amplified and linked to an address within hours.
3. Remedy so far: Disposing of the PIL, the SC left remedial measures to Union Ministries.

Why do India’s privacy safeguards fall short?

1. State-centred right: A nine-judge Bench in K.S. Puttaswamy v. Union of India (2017) held privacy a constitutionally protected right. The case was against the state, so its test targets state action.
2. Wide exemptions: The Digital Personal Data Protection (DPDP) Act, 2023 lets the Union exempt any state instrumentality by notification, on grounds including security of the state and public order.
3. Pegasus episode: In 2022, a court-appointed expert committee found malware in some phones but could not confirm it was Pegasus, Israeli spyware. It noted the Union had not cooperated.
4. Secrecy of findings: In 2025, the SC indicated parts of the committee’s report would stay confidential.
5. Broken chain of protection: The constitutional test guards only the state’s step, so no one answers when a protester is filmed, doxxed and threatened at home.

Challenges

1. Private hosts outside safeguards: Police data held by private firms sits beyond clear constitutional or statutory duties.
2. Self-exemption by government: The Union writes data rules and can exempt its own agencies, so no independent check applies.
3. No law on facial recognition: Police use of facial recognition rests on executive practice, with no statute setting its limits.

Way Forward

1. Surveillance statute: Parliament should legislate limits on police facial recognition, including warrants and retention limits.
2. Duties that follow data: Privacy obligations should bind private hosts and foreign vendors under rules made under the DPDP Act.
3. Reviewed exemptions: The Union should record reasons for each exemption and allow independent review.

Conclusion

Privacy protection in India still assumes one watcher and one watched. The pending petition on protest surveillance will test whether courts extend the privacy right beyond direct state action.

What is the Right to Privacy?

1. Constitutional basis: Privacy is part of Article 21, the right to life and personal liberty.
2. Related guarantees: It is read with Articles 14 and 19.
3. Scope: It covers informational privacy (personal data), decisional autonomy (intimate choices) and bodily integrity.
4. Limits on restriction: A restriction must pass legality, legitimate aim and proportionality. Eg. PUCL v. Union of India (1997) allowed phone tapping only under strict safeguards.

Matching Previous Year Question

“[2026] X’ was addressing a seminar on the meaning of the term ‘law’ as provided under Article 13, Part III of the Constitution of India. ‘X’ explained that the meaning of the term ‘law’ in the Constitution of India was very comprehensive. It included ordinances, orders and even rules and regulations. ‘Y’ pointed out that the term ‘law’ in Article 13 also included custom or usage having in the territory of India the force of law, to which ‘X’ was not convinced. Based on the above, select the correct conclusion from the options given below: (a) X is correct in the interpretation of law, including the view on non-inclusion of custom (b) The view of Y that ‘law’ included custom is not correct (c) The views of both X and Y are correct (d) The view of only Y is correct Answer: D”