Technology and Privacy — Revision Notes

⚡ 30-Second Revision

Core Right: — Right to Privacy is a Fundamental Right under Article 21.
Landmark Case: — *Justice K.S. Puttaswamy v. UoI (2017)*.
Key Test: — Four-part Proportionality Test (Legality, Legitimate Aim, Necessity, Proportionality).
Key Law: — Digital Personal Data Protection Act, 2023 (DPDPA).
Key Body: — Data Protection Board of India (appointed by Central Govt).
Key Debates: — Privacy vs. Security; Innovation vs. Regulation.
Key Threats: — Surveillance (Pegasus, FRT), Algorithmic Bias, Corporate Data Mining.

2-Minute Revision

Definition: Technology and Privacy explores the conflict between technological advancement and the individual's fundamental right to privacy, primarily informational privacy.

Constitutional Basis: The right to privacy was declared a fundamental right under Article 21 by the Supreme Court in the *Puttaswamy (2017)* case. Any infringement must pass the four-fold proportionality test.

Key Legislative Framework: The Digital Personal Data Protection Act, 2023, is the primary law. It is based on a consent framework but is criticized for giving broad exemptions to the state, potentially weakening the Puttaswamy protections.

Major Ethical Dilemmas:

1
State Surveillance: — Balancing national security with civil liberties (e.g., Pegasus, Facial Recognition).
2
Corporate Data Practices: — Issues of meaningful consent, data monetization, and the power of Big Tech (e.g., WhatsApp policy).
3
AI & Algorithmic Bias: — The risk of automating discrimination and the lack of transparency and accountability in automated decision-making.

UPSC Relevance: This is a critical topic for GS-2 (Polity), GS-4 (Ethics), and Essay. Answers must integrate constitutional principles (Puttaswamy test), legal provisions (DPDPA), and ethical analysis of specific technological examples.

5-Minute Revision

The intersection of technology and privacy is a central theme in contemporary governance and ethics. Its foundation in India is the Puttaswamy (2017) judgment, which elevated privacy to a fundamental right under Article 21. The judgment's most crucial contribution is the proportionality test, which serves as the analytical framework for any state action infringing privacy: it must be legal, have a legitimate aim, be necessary, and be proportionate.

India's legislative response is the Digital Personal Data Protection Act, 2023 (DPDPA). It introduces key concepts like 'Data Fiduciary' and 'Data Principal' and establishes a consent-based regime. However, its efficacy is debated due to broad state exemptions and concerns over the independence of the Data Protection Board. A comparison with the EU's GDPR reveals the Indian law to be less stringent, particularly concerning state accountability and the scope of data covered.

Key Ethical Battlegrounds:

Surveillance vs. Liberty: — Technologies like Facial Recognition (FRT) and spyware (Pegasus) pose a direct challenge to privacy. The ethical question is whether their use is a proportionate response to security threats. The lack of a specific law governing FRT is a major concern.
Consent and Corporate Power: — The 'take-it-or-leave-it' nature of privacy policies from tech giants (e.g., WhatsApp) makes individual consent illusory. This highlights the power asymmetry and the need for regulatory intervention.
AI and Fairness: — The use of AI in areas like predictive policing or credit scoring raises profound ethical issues of algorithmic bias, where historical discrimination is encoded and amplified. The 'black box' nature of some AI models also creates an accountability vacuum.

Current Affairs Link: The implementation of the DPDPA, ongoing debates on a national AI policy, and court cases challenging the use of FRT are key recent developments. For Mains answers, it is crucial to move beyond a simple description of technologies.

The focus should be on applying the Puttaswamy test to these technologies and critically evaluating the adequacy of the DPDP Act as a safeguard. A forward-looking conclusion should advocate for 'Privacy by Design', stronger oversight bodies, and enhanced digital literacy.

Prelims Revision Notes

1
Right to Privacy: — Declared a Fundamental Right by a 9-judge bench of the Supreme Court.
2
Case Name: — Justice K.S. Puttaswamy (Retd.) vs Union of India, 2017.
3
Constitutional Article: — Intrinsic to Article 21 (Right to Life and Personal Liberty).
4
Puttaswamy Proportionality Test (4 parts):

* Legality (must be a law). * Legitimate Goal (must have a valid state purpose). * Necessity (must be necessary to achieve the goal). * Proportionality (rational nexus; benefits must outweigh harm to the right).

1
Data Protection Law: — Digital Personal Data Protection Act, 2023 (DPDPA).
2
Key Definitions in DPDPA:

* Data Principal: The individual to whom the data relates. * Data Fiduciary: The entity that determines the purpose and means of processing data. * Data Processor: An entity that processes data on behalf of the fiduciary.

1
Regulatory Body under DPDPA: — Data Protection Board of India (DPBI).
2
Appointment to DPBI: — Chairperson and Members are appointed by the Central Government.
3
State Exemptions in DPDPA: — Section 17 allows the Union Government to exempt its agencies on grounds of security, public order, etc.
4
Precursor Committee: — The Justice B.N. Srikrishna Committee drafted the first Personal Data Protection Bill.
5
GDPR: — General Data Protection Regulation, the framework of the European Union. Known for high penalties and a strong rights-based approach.
6
Data Localization: — Policy requiring data to be stored within a country's borders. Example: RBI mandate for payment data.
7
Section 69 of IT Act, 2000: — Grants power to the government for interception and monitoring of digital information.

Mains Revision Notes

1
Introduction Frameworks:

* Constitutional: Start with the Puttaswamy judgment establishing privacy under Art 21 and its proportionality test. * Legislative: Begin with the recent enactment of the DPDP Act, 2023 as India's attempt to create a robust data protection regime. * Ethical: Frame the issue as a conflict of values: individual autonomy vs. collective security, or innovation vs. human dignity.

1
Core Arguments & Analysis:

* Puttaswamy Test as Analytical Tool: Use the four prongs of the test to evaluate any technology or law (e.g., Is FRT 'necessary' and 'proportionate' for policing?). * Critique of DPDP Act: Acknowledge its positives (consent framework) but focus on the negatives for critical analysis (state exemptions, independence of DPB, dilution of provisions from earlier drafts).

* Privacy vs. Security is a False Dichotomy: Argue that rights and security are not mutually exclusive. Strong privacy can enhance security (protecting dissidents, securing communications). The goal is a balance through proportionality.

* Power Asymmetry: Emphasize this in corporate data collection contexts. The individual is not on an equal footing with Big Tech.

1
Key Case Studies & Examples:

* Aadhaar: Use for debates on biometric data, exclusion, and the potential for a 360-degree profile. * Pegasus: The ultimate example of invasive surveillance violating privacy and democratic norms. * WhatsApp Privacy Policy: Illustrates coercive consent and market dominance. * Predictive Policing in other countries: Use as an example to discuss the dangers of algorithmic bias.

1
Solution-Oriented Principles:

* Privacy by Design: Embed privacy into technology from the start. * Strengthening Oversight: Call for independent judicial or parliamentary oversight of surveillance. * Ethical AI Framework: Advocate for principles of Fairness, Accountability, and Transparency (FAT) in AI. * Empowering Users: Mention Consent Managers and digital literacy initiatives.

1
Conclusion Frameworks:

* Summarize the core tension and advocate for a balanced path forward. * Emphasize that law must keep pace with technology. * Conclude by linking the protection of privacy to the larger health of a democracy.

Vyyuha Quick Recall

Vyyuha Quick Recall:

1. The Puttaswamy Proportionality Test Mnemonic: "LPN-B"

To recall the four tests for any privacy infringement, remember "LPN-B" (Like a Powerful New Bill):

L — Legality: Is there a Law authorizing it?
P — Purpose: Is there a legitimate state Purpose (aim)?
N — Necessity: Is the infringement Necessary to achieve the purpose?
B — Balance (Proportionality): Is there a Balance? Does the benefit outweigh the harm to individual rights?

2. The 3-D Ethical Checklist for any New Technology:

When analyzing any new technology (like FRT, AI, Drones), use the 3-D Checklist:

Dignity: — Does it respect individual autonomy and human dignity? (e.g., pervasive surveillance erodes dignity).
Discrimination: — Does it have the potential to discriminate against or profile certain groups? (e.g., algorithmic bias).
Democracy: — Does it strengthen or weaken democratic principles like dissent, free speech, and accountability? (e.g., using tech to monitor protests weakens democracy).