"AI-powered smart glasses expose gaps in India's data protection law"
Data Fiduciary
entity that determines the purpose and means of processing personal data under the DPDPA.
Data Principal
the individual to whom personal data relates, who holds consent rights under the DPDPA.
The right to privacy in India was not always a clearly recognised fundamental right. For decades, courts debated whether privacy could be read into Article 21 of the Constitution, which guarantees the right to life and personal liberty. The question was settled definitively by a nine-judge bench of the Supreme Court in K.S. Puttaswamy v. Union of India (2017). The court held that privacy is an intrinsic part of life and liberty, protected under Part III of the Constitution. This means the state cannot infringe on privacy without a law that is just, fair, and proportionate.
Following this judgment, Parliament enacted the Digital Personal Data Protection Act, 2023 (DPDPA). The Act governs how personal data is collected, stored, and processed. It introduces the concept of a Data Fiduciary (the entity collecting data) and a Data Principal (the individual whose data is collected). The Act requires informed consent before data collection and establishes a Data Protection Board to adjudicate complaints. However, the Act is technologically agnostic: it focuses on the purpose of data collection rather than the specific technology used to collect it.
The DPDPA has a significant structural limitation when applied to ambient or passive surveillance technologies. In a public space, a person cannot meaningfully consent to being recorded, nor can they monitor how their data is subsequently used. The Act also excludes data that is "made publicly available," which creates a gap: if someone is recorded in a public space and that recording is treated as publicly available information, the Act's protections may not apply.
The Puttaswamy judgment introduced the concept of reasonable expectation of privacy. Even in public spaces, individuals do not generally expect to be captured in granular detail, their conversations, movements, or expressions recorded and stored. This expectation is constitutionally protected. Yet the DPDPA, as currently framed, does not translate this constitutional protection into a clear operational rule for ambient recording in public. …
Examine the scope of Fundamental Rights in the light of the latest judgement of the Supreme Court on Right to Privacy.
Right to privacy is intrinsic to life and personal liberty and is inherently protected under Article 21 of the Constitution. Explain. In this reference discuss the law relating to DNA testing of a child in the womb to establish its paternity.
Describe the context and salient features of the Digital Personal Data Protection Act, 2023.
Under which Article of the Constitution of India is the 'Right to Privacy' protected?
Right to Privacy is protected as an intrinsic part of Right to Life and Personal Liberty. Which of the following in the Constitution of India correctly and appropriately imply the above statement ?
Consider the following statements regarding the Digital Personal Data Protection Act, 2023 (DPDPA):
1.The Act applies only to data collected within the territory of India.
2.The Act is technologically agnostic, focusing on the purpose of data collection rather than the method.
3.Data that is made publicly available is excluded from the Act's protections.
4.The Data Protection Board is empowered to impose financial penalties on Data Fiduciaries.
Which of the statements given above are correct?
Consider the following statements regarding the K.S. Puttaswamy v. Union of India (2017) judgment:
1.The judgment was delivered by a nine-judge constitutional bench of the Supreme Court.
2.The court held that the right to privacy is a fundamental right under Article 19 of the Constitution.
3.The judgment overruled the earlier decisions in M.P. Sharma (1954) and Kharak Singh (1962).
4.The court held that any state infringement of privacy must satisfy tests of legality, legitimate aim, and proportionality.
Which of the statements given above are correct?
Match the following terms related to India's data protection framework with their correct descriptions:
List I (Term) — List II (Description)
A.Data Fiduciary — 1. Individual whose personal data is being processed
B.Data Principal — 2. Entity that determines purpose and means of data processing
C.Data Protection Board — 3. Statutory body under DPDPA empowered to adjudicate complaints and impose penalties
D.Significant Data Fiduciary — 4. Category of Data Fiduciary designated by government based on volume/sensitivity of data handled
Select the correct answer:
With reference to the right to privacy in India, consider the following statements:
1.The reasonable expectation of privacy doctrine means individuals have no privacy rights in public spaces.
2.The Digital Personal Data Protection Act, 2023 excludes from its protections data that is made publicly available.
3.The Information Technology Act, 2000 contains provisions penalising the capture and transmission of images of a private area without consent.
4.The DPDPA requires Data Fiduciaries to conduct Privacy Impact Assessments before launching new products in India.
Which of the statements given above is/are correct?
Assertion (A): AI-powered wearable devices with discreet cameras create a regulatory gap under India's Digital Personal Data Protection Act, 2023, even though the right to privacy is a fundamental right under Article 21.
Reason (R): The DPDPA is technologically agnostic and excludes data made publicly available, while the Puttaswamy judgment's reasonable expectation of privacy standard applies even in public spaces.
Which one of the following is correct in respect of the above Assertion and Reason?
Want the full note, Prelims Facts & MCQ answers?
Create a free account — takes less than a minute.
Create free account