Digital Privacy in India: Surveillance and Doxxing

DIGITAL PRIVACY IN INDIA: SURVEILLANCE, DOXXING AND THE CHANGING NATURE OF STATE POWER

Why in the News?

Recent developments involving facial recognition, doxxing, deepfakes, electoral-roll verification and spyware have renewed debate over India’s privacy framework. Together, they demonstrate that contemporary privacy risks extend beyond conventional state surveillance to interactions among government agencies, private technology companies and online networks.

Digital Privacy in India: Surveillance and Doxxing

FROM STATE SURVEILLANCE TO DIFFUSE DATA MONITORING

  • Facial Recognition: Deployment of facial recognition, drones, AI-enabled devices and biometric systems can allow authorities to identify individuals at public gatherings, raising questions about proportionality and data safeguards.
  • Digital Doxxing: Personal information obtained or inferred from public images can be amplified through online networks, potentially exposing individuals to harassment, threats and other forms of harm.
  • Electoral Surveillance: Special Intensive Revision (SIR) demonstrates another form of identity verification, where documentary and citizenship-related scrutiny can determine continued inclusion in electoral rolls.
  • Private Processing: When police or government agencies rely upon private technology companies and foreign vendors, responsibility for collection, storage, processing and misuse of personal information becomes more difficult to determine.
  • Historical Continuity: India’s identification practices predate modern digital technology, but digitisation, artificial intelligence and networked platforms have dramatically increased the speed, scale and reach of identification.

PRIVACY GOVERNANCE AND THE ACCOUNTABILITY GAP

  • Constitutional Protection: In S. Puttaswamy v. Union of India (2017), a nine-judge Supreme Court Bench recognised privacy as a constitutionally protected fundamental right, fundamentally reshaping India’s rights jurisprudence.
  • Proportionality Principle: Restrictions upon privacy must satisfy constitutional requirements involving legality, legitimate state purpose, necessity and proportionality, particularly where intrusive surveillance measures are involved.
  • Statutory Exemptions: The Digital Personal Data Protection Act, 2023 permits specified exemptions for government instrumentalities under circumstances including security of the State and public order, creating important accountability questions.
  • Pegasus Concerns: The Supreme Court-appointed technical committee examining alleged Pegasus spyware found malware in some examined devices but could not conclusively establish that Pegasus was responsible, while also noting limited government cooperation.
  • Responsibility Chain: Modern privacy governance requires accountability across the entire data lifecycle, because information may move from government collection to private processing and subsequently into online ecosystems.

RIGHT TO PRIVACY AND DATA PROTECTION IN INDIA

●      Fundamental Right: The Puttaswamy judgment established privacy as an intrinsic component of the rights guaranteed under Article 21, while also recognising its relationship with other fundamental freedoms.

●      Informational Privacy: Privacy encompasses informational autonomy, allowing individuals to exercise greater control over the collection, use and dissemination of personal information.

●      Data Protection: The Digital Personal Data Protection Act, 2023 establishes a statutory framework governing processing of digital personal data while creating obligations for data fiduciaries and rights for data principals.

●      Constitutional Balance: Privacy is not absolute; restrictions can be justified for legitimate purposes when they satisfy constitutional requirements of lawfulness, necessity and proportionality.

●      Emerging Challenge: Artificial intelligence, facial recognition, biometric databases, deepfakes and algorithmic profiling increasingly require privacy law to address risks created by interconnected public and private data ecosystems.