"Privacy Gaps Beyond State Surveillance: Doxxing, Rolls, Data Law"
Data Fiduciary
entity that decides the purpose and means of processing personal data under the DPDPA.
Data Principal
the individual whose personal data is collected or processed.
The right to privacy became an explicit fundamental right only through K.S. Puttaswamy v. Union of India (2017). A nine-judge Bench of the Supreme Court held that privacy is intrinsic to life and personal liberty under Article 21. The judgment set a tripartite test for any state action that infringes privacy: a valid law, a legitimate state aim, and proportionality. Parliament later enacted the Digital Personal Data Protection Act, 2023 (DPDPA). This law creates a Data Fiduciary, the entity collecting data, and a Data Principal, the person whose data is collected, and it requires consent before collection. It also sets up a Data Protection Board to handle complaints.
Puttaswamy was fought against the state, so its test is built around state action alone. The DPDPA carries this same limitation forward. It allows the Union government to exempt any state instrumentality from its provisions through a notification, on grounds that include the security of the state and public order. A similar gap already exists around Aadhaar: the state cannot enter into contracts with private corporations to share Aadhaar data, and Aadhaar is mandatory only for benefits funded from the Consolidated Fund of India, not for private products like insurance. Even so, once data moves from a government agency to a private vendor, weaker rules can apply.
The state's interest in identifying its population is not new. In 1858, William Herschel, a British magistrate, began using handprints on contracts in Bengal. This was later developed into a fingerprint classification system. The technology changed, from handprints to Aadhaar's biometric database to today's facial recognition cameras, but the underlying impulse to make a population identifiable has stayed the same.
Three distinct forms of watching are visible today. The first is direct state surveillance in public spaces. A petition against the Delhi Police alleges that facial recognition, AI-enabled smart glasses, drones, and a mobile command vehicle were used during a recent protest, with the resulting data reportedly hosted by private firms rather than a government agency. This raises a basic accountability question: which law governs the data once a private vendor holds it on the state's behalf?
The second form is decentralised, private watching. Individuals identified at a protest can be doxxed, meaning their personal details, including home addresses, are published online, sometimes with threats attached. This is not new in substance. In 2020, an administration displayed hoardings with photographs and addresses of protesters against the Citizenship Amendment Act, and the Allahabad High Court ordered these removed, calling the display 'unwarranted interference in privacy'. …
Under which Article of the Constitution of India is the 'Right to Privacy' protected?
Under which of the following Articles of the Constitution of India, has the Supreme Court of India placed the Right to Privacy?
Right to Privacy is protected as an intrinsic part of Right to Life and Personal Liberty. Which of the following in the Constitution of India correctly and appropriately imply the above statement ?
Consider the following statements:
1.'Aadhaar' metadata cannot be stored for more than three months.
2.State cannot enter into any contract with private corporations for sharing of Aadhaar data.
3.Aadhaar is mandatory for obtaining insurance products.
4.Aadhaar is mandatory for getting benefits funded out of the Consolidated Fund of India.
Which of the statements given above is/are correct?
Consider the following statements regarding K.S. Puttaswamy v. Union of India (2017):
1.The judgment was delivered by a nine-judge Bench of the Supreme Court.
2.It held that the right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21.
3.The case decided the constitutional validity of the Aadhaar scheme itself.
Which of the statements given above is/are correct?
Consider the following statements regarding Aadhaar:
1.The State cannot enter into any contract with private corporations for the sharing of Aadhaar data.
2.Aadhaar is mandatory for obtaining insurance products.
3.Aadhaar is mandatory for availing benefits funded out of the Consolidated Fund of India.
Which of the statements given above is/are correct?
Consider the following statements about the Digital Personal Data Protection Act, 2023:
1.It establishes a Data Protection Board to adjudicate complaints regarding personal data.
2.It empowers the Union Government to exempt any state instrumentality from provisions of the Act through a notification.
3.It applies uniformly to both digital and non-digital forms of personal data.
How many of the above statements are correct?
Match List I (Case/Event) with List II (Legal/Institutional Outcome) and select the correct answer using the codes given below:
List I:
A.K.S. Puttaswamy vs Union of India
B.Allahabad High Court ruling on Lucknow hoardings
C.Supreme Court on Special Intensive Revision of electoral rolls
D.Pegasus spyware case
List II:
1.Held display of protesters' photos and addresses as 'unwarranted interference in privacy'
2.Held the Election Commission may examine citizenship for a limited purpose but cannot itself adjudicate citizenship
3.Recognised privacy as intrinsic to Article 21
4.A court-appointed technical committee found malware but could not confirm the spyware's identity due to lack of cooperation
Assertion (A): The protections of the Digital Personal Data Protection Act, 2023 may not extend to a person recorded through facial recognition cameras in a public space.
Reason (R): The Act excludes personal data that is 'made publicly available' from its scope, and meaningful consent cannot be obtained in passive public surveillance.
Want the full note, Prelims Facts & MCQ answers?
Create a free account — takes less than a minute.
Create free account