SC hopes government will take proper steps on data protection

New Delhi: The Supreme Court on Thursday expressed the hope that the Union government will take necessary and proper steps to put in place a robust regime for data protection, saying information collected by it has to be utilised for legitimate purposes and ought not to be utilised unauthorisedly for extraneous purposes.

A constitution bench of the apex court in its judgement on the privacy right referred to the government`s statement during hearing in the privacy case that it has constituted a committee chaired by Justice B.N. Srikrishna, a former apex court judge, to review data protection norms in the country, and said since the government has initiated the process of reviewing the entire area of data protection, it would be appropriate to leave the matter for expert determination so that a robust regime for the protection of data is put in place.

"We expect that the Union government shall follow up on its decision by taking all necessary and proper steps," the bench headed by Chief Justice J.S. Khehar said.

The court observed that the balance between data regulation and individual privacy raises complex issues requiring delicate balances to be drawn between the legitimate concerns of the State on one hand and individual interest in the protection of privacy on the other.

"The sphere of privacy stretches at one end to those intimate matters to which a reasonable expectation of privacy may attach. It expresses a right to be left alone. A broader connotation which has emerged in academic literature of a comparatively recent origin is related to the protection of one`s identity.

"Data protection relates closely with the latter sphere. Data such as medical information would be a category to which a reasonable expectation of privacy attaches. There may be other data which falls outside the reasonable expectation paradigm. Apart from safeguarding privacy, data protection regimes seek to protect the autonomy of the individual," it said.

This, the order said, was evident from the emphasis in the European data protection regime on the centrality of consent. Related to the issue of consent is the requirement of transparency which requires a disclosure by the data recipient of information pertaining to data transfer and use, it observed.

Referring to the views of Richard A. Posner, an expert on cyber attacks, the judgement said Posner`s formulation would indicate that the State does have a legitimate interest when it monitors the web to secure the nation against cyber attacks and the activities of terrorists.

"While it intervenes to protect legitimate state interests, the state must nevertheless put into place a robust regime that ensures the fulment of a three-fold requirement. These three requirements apply to all restraints on privacy (not just informational privacy)."

The three-fold requirement for a valid law arises out of the mutual inter-dependence between the fundamental guarantees against arbitrariness on the one hand and the protection of life and personal liberty on the other.

"The right to privacy, which is an intrinsic part of the right to life and liberty, and the freedoms embodied in Part III is subject to the same restraints which apply to those freedoms," the judges said.

They observed that apart from national security, the State may have justifiable reasons for the collection and storage of data.

"In a social welfare state, the government embarks upon programmes which provide benefits to impoverished and marginalised sections of society. There is a vital state interest in ensuring that scarce public resources are not dissipated by the diversion of resources to persons who do not qualify as recipients.

"Allocation of resources for human development is coupled with a legitimate concern that the utilisation of resources should not be siphoned away for extraneous purposes. Data mining with the object of ensuring that resources are properly deployed to legitimate beneficiaries is a valid ground for the state to insist on the collection of authentic data. But, the data which the state has collected has to be utilised for legitimate purposes of the state and ought not to be utilised unauthorisedly for extraneous purposes.

"This will ensure that the legitimate concerns of the State are duly safeguarded while, at the same time, protecting privacy concerns. Prevention and investigation of crime and protection of the revenue are among the legitimate aims of the state. Information technology -- legitimately deployed is a powerful enabler in the spread of innovation and knowledge," the judgement said.