Abstract
This article examines how people’s rights in the digital world are protected under Article 21 of the Indian Constitution, which guarantees the right to life and personal liberty. In contemporary society, individuals routinely engage with the internet, social media, smartphones, algorithms, online banking, Aadhaar and various digital platforms, all of which collect vast amounts of personal information.
As a consequence, protecting privacy and personal data has acquired paramount constitutional importance. The article analyses the landmark Puttaswamy judgement, the Digital Personal Data Protection Act 2023, and emerging challenges posed by artificial intelligence to privacy, dignity, and individual autonomy.
It argues that while legislative frameworks have advanced, a dedicated AI governance law is indispensable to address algorithmic accountability, transparency, and fairness within India’s constitutional framework.
Key Topics Covered
- Article 21 of the Indian Constitution and digital rights
- Right to life and personal liberty in the digital era
- Digital privacy and protection of personal data
- The Puttaswamy judgment and the constitutional right to privacy
- The Digital Personal Data Protection Act, 2023
- Artificial intelligence and emerging privacy challenges
- Algorithmic accountability, transparency, and fairness
- Need for a dedicated AI governance law in India
Article at a Glance
| Aspect | Details |
|---|---|
| Constitutional Basis | Article 21 of the Indian Constitution |
| Core Issue | Protection of digital rights, privacy, and personal liberty |
| Key Judicial Development | The landmark Puttaswamy judgment |
| Statutory Framework | Digital Personal Data Protection Act, 2023 |
| Emerging Concern | Artificial intelligence and algorithmic decision-making |
| Central Argument | India requires a dedicated AI governance law to ensure accountability, transparency, fairness, and constitutional protection of individual rights. |
I. Introduction: Digital Rights in the Modern Era
The proliferation of digital technology has fundamentally transformed how individuals interact, communicate, and participate in civic life. Digital rights are understood as the human rights and legal rights that enable individuals to access, use, create, and publish digital media, as well as to access and use computers, electronic devices, and telecommunications networks. The concept is particularly concerned with the protection and realisation of existing rights, such as the right to privacy and freedom of expression, in the context of digital technologies, particularly the internet.
Today, people use the internet, social media, smartphones, algorithms, online banking, Aadhaar, and digital platforms in everyday life. These technologies collect a large volume of personal information. Protecting privacy and personal data has, therefore, become a matter of urgent constitutional concern. The intersection of artificial intelligence and the right to privacy presents one of the most significant legal challenges of the digital age.
Key Features of Digital Rights
- Protection of the right to privacy in digital environments.
- Safeguarding freedom of expression on digital platforms.
- Access to computers, electronic devices, and telecommunications networks.
- Protection of personal data collected through digital technologies.
- Ensuring constitutional rights remain effective in the age of artificial intelligence.
Digital Technologies and Privacy Concerns
| Digital Technology | Role in Everyday Life | Privacy Concern |
|---|---|---|
| Internet | Communication and information access | Data tracking and surveillance |
| Social Media | Social interaction and content sharing | Collection of personal information |
| Smartphones | Daily communication and digital services | Location and usage data collection |
| Algorithms | Personalised recommendations and decision-making | Profiling and automated processing |
| Online Banking | Financial transactions | Financial data security |
| Aadhaar | Identity verification | Protection of biometric and personal data |
| Digital Platforms | Access to services and commerce | Large-scale collection of personal information |
II. Article 21 and the Constitutional Right to Privacy
Article 21 of the Indian Constitution provides that no person shall be deprived of his life or personal liberty except according to procedure established by law. It is widely regarded as the heart of the Constitution, guaranteeing the right to life and personal liberty to every person, whether a citizen or a non-citizen, residing in India. Article 21 serves as the foundation of all other rights enshrined by the Constitution, since life is an essential prerequisite for the enjoyment of other rights such as freedom, equality, and religion.
The Supreme Court has interpreted this article broadly and has included many rights within its ambit, such as the right to live with dignity, the right to health, the right to education, the right to livelihood, the right to privacy, the right to free legal aid, and the right to a speedy trial. Through progressive judicial interpretation, Article 21 has evolved into a comprehensive repository of fundamental freedoms that together constitute a dignified human existence.
Rights Recognised Under Article 21
- Right to live with dignity.
- Right to health.
- Right to education.
- Right to livelihood.
- Right to privacy.
- Right to free legal aid.
- Right to a speedy trial.
Importance of Article 21 in the Digital Age
| Aspect | Significance |
|---|---|
| Life and Personal Liberty | Provides constitutional protection against arbitrary deprivation. |
| Human Dignity | Recognises dignity as an integral part of the right to life. |
| Privacy | Protects individuals against unlawful intrusion into personal life. |
| Judicial Interpretation | Allows Article 21 to evolve with changing societal and technological developments. |
| Digital Era | Forms the constitutional basis for protecting personal data and digital privacy. |
III. Justice K.S. Puttaswamy v. Union of India (2017): A Constitutional Watershed
The right to privacy in India evolved from an unstated, fragmented concept into a formally recognised fundamental right intrinsic to Article 21 through the landmark judgement in Justice K.S. Puttaswamy v. Union of India. A nine-judge bench of the Supreme Court unanimously upheld privacy as a fundamental right guaranteed under Article 21 of the Indian Constitution.
The Court stated that a person’s right to privacy is fundamental to their autonomy, dignity, and personal liberty. Any attempt to limit this right must be justified by compelling reasons that satisfy the criteria of reasonableness, necessity, and proportionality.
Three-Fold Test for Restrictions on Privacy
This three-fold test now constitutes the constitutional standard governing state actions concerning data collection, digital monitoring, surveillance, and AI-driven governance tools.
- Reasonableness
- Necessity
- Proportionality
It ensures that the government cannot arbitrarily interfere with private affairs without a constitutional basis.
The Puttaswamy ruling marked a watershed moment in Indian constitutional jurisprudence, establishing the groundwork for safeguarding informational privacy, autonomy, and personal freedom in the digital age.
| Key Constitutional Principle | Significance |
|---|---|
| Recognition of Privacy | Privacy is recognised as a fundamental right under Article 21. |
| Autonomy and Dignity | Protects individual autonomy, dignity, and personal liberty. |
| Constitutional Test | Restrictions must satisfy reasonableness, necessity, and proportionality. |
| Digital Governance | Applies to surveillance, data collection, digital monitoring, and AI-driven governance. |
IV. Informational Privacy in the Digital Ecosystem
Informational privacy plays a key role in the broader context of privacy rights. It refers to an individual’s control over the gathering, storing, using, and sharing of personal data.
Every day, massive volumes of personal data are generated and processed in the digital ecosystem through online activities, biometric systems, e-commerce platforms, artificial intelligence applications, and cloud-based systems.
Major Threats to Informational Privacy
Unauthorised data sharing, data breaches, profiling, behavioural manipulation, cybersecurity threats, and identity theft have become major concerns owing to the growing commercialisation and exploitation of personal data.
- Unauthorised data sharing
- Data breaches
- Profiling
- Behavioural manipulation
- Cybersecurity threats
- Identity theft
Sensitive personal data is frequently gathered by digital networks without the data subject’s consent, raising the possibility of abuse and exploitation.
These issues are exacerbated by AI systems, which rely heavily on large datasets for algorithm training and automated decision-making.
Recognising these risks, the Supreme Court in Puttaswamy underscored the pressing need for a robust data protection framework in India.
Informational privacy is a crucial element of human dignity, freedom, and self-determination.
| Privacy Challenge | Impact |
|---|---|
| Data Breaches | Exposure of sensitive personal information. |
| Profiling | Behavioural analysis and targeted influence. |
| Identity Theft | Misuse of personal identity and financial fraud. |
| AI-Based Decision-Making | Potential algorithmic bias and automated harms. |
| Unauthorised Data Collection | Risk of abuse without informed consent. |
V. The Digital Personal Data Protection Act, 2023
The Digital Personal Data Protection Act, 2023, was enacted to protect personal data and translate the constitutional mandate of Puttaswamy into legislative reality.
The Act aims to empower individuals, referred to as data principals, by granting them meaningful rights over their personal data, including the rights to access, correct, erase, and withdraw consent at any time.
On the organisational side, it obliges data fiduciaries, including both private corporations and government bodies, to process data lawfully, fairly, and transparently.
Rights of Data Principals
- Right to access personal data
- Right to correct personal data
- Right to erase personal data
- Right to withdraw consent at any time
Obligations of Data Fiduciaries
- Process data lawfully
- Process data fairly
- Ensure transparency in data processing
- Comply with statutory obligations under the Act
| Stakeholder | Role Under the Act |
|---|---|
| Data Principals | Receive rights relating to access, correction, erasure, and withdrawal of consent. |
| Data Fiduciaries | Must process personal data lawfully, fairly, and transparently. |
Limitations of the Act
Notwithstanding its significance, the Act suffers from notable limitations.
- The government’s ability to exempt itself from its provisions under the guise of national security or public order, without stringent checks, poses a risk of excessive data collection and retention, potentially facilitating a surveillance state.
- Furthermore, the Act regulates how entities use personal data but does not explicitly regulate artificial intelligence.
- There are major lacunae in the Act’s protection of citizens from automated harms: it does not adequately govern AI systems or ensure algorithmic accountability.
| Limitation | Potential Consequence |
|---|---|
| Broad Government Exemptions | Risk of excessive data collection and surveillance. |
| No Explicit AI Regulation | Limited oversight of artificial intelligence systems. |
| Lack of Algorithmic Accountability | Insufficient safeguards against automated harms. |
VI. Artificial Intelligence and Privacy Concerns
Artificial intelligence has become an integral component of modern life and is widely deployed in areas such as social media, healthcare, banking, education, and government services. AI systems rely on large amounts of personal data to function effectively, which raises significant privacy concerns of constitutional magnitude.
How AI Collects Personal Data
AI collects and analyses personal information such as browsing history, location data, facial images, and online behaviour. This facilitates increased surveillance, whereby governments and private companies monitor individuals through technologies like facial recognition and tracking systems. Artificial intelligence also enables profiling and targeted advertising by studying individuals’ preferences and activities without meaningful consent.
Major Privacy Risks of Artificial Intelligence
- Collection and analysis of personal information.
- Mass surveillance through facial recognition and tracking systems.
- Profiling of individuals based on online behaviour.
- Targeted advertising without meaningful consent.
- Risk of data breaches and misuse of personal information.
- Biased or discriminatory AI outcomes resulting from unfair or incomplete datasets.
Another major concern is the risk of data breaches and misuse of personal information. AI systems may also produce biased or discriminatory outcomes when trained on unfair or incomplete data, adversely affecting employment, education, and access to financial services. To address these challenges, legal frameworks such as the Digital Personal Data Protection Act, 2023, have been introduced, but they do not constitute a comprehensive solution to AI governance.
Summary of AI Privacy Concerns
| Issue | Impact |
|---|---|
| Personal Data Collection | Large-scale collection of browsing history, location data, facial images, and online behaviour. |
| Surveillance | Governments and private companies monitor individuals using AI-powered technologies. |
| Profiling | Individuals are profiled for targeted advertising and behavioural analysis. |
| Data Breaches | Personal information may be exposed or misused. |
| Algorithmic Bias | Unfair outcomes affecting employment, education, and financial services. |
| Legal Framework | The Digital Personal Data Protection Act, 2023, provides safeguards but is not a complete AI governance framework. |
VII. Anuradha Bhasin v. Union of India: Internet Shutdowns and Digital Rights
Another significant dimension of digital rights was addressed in Anuradha Bhasin v. Union of India, a landmark decision concerning internet shutdowns, freedom of speech, and digital rights. Following the abrogation of Article 370 in August 2019, the government imposed restrictions in Jammu and Kashmir, including the suspension of internet services and restrictions on movement under Section 144 of the Code of Criminal Procedure (now Section 163 of the Bharatiya Nagarik Suraksha Sanhita). These restrictions were challenged by journalist Anuradha Bhasin before the Supreme Court.
Supreme Court Ruling on Internet Shutdowns
The Supreme Court held that the internet is an important medium for the exercise of rights guaranteed under Article 19(1)(a) (freedom of speech and expression) and Article 19(1)(g) (freedom to practise any profession) of the Indian Constitution. The Court further ruled that internet services cannot be suspended indefinitely and that any such suspension is unconstitutional unless it is temporary, subject to periodic review, and satisfies the test of proportionality. Government orders must be published so that affected persons may challenge them before courts.
Constitutional Principles Established
- The internet is an important medium for exercising constitutional rights.
- Internet shutdowns cannot be imposed indefinitely.
- Any suspension must be temporary.
- Restrictions must undergo periodic review.
- Government action must satisfy the test of proportionality.
- Government orders must be published for judicial scrutiny.
This case recognised the constitutional protection of online speech, established that internet shutdowns are subject to judicial review, introduced safeguards against arbitrary internet bans, and significantly strengthened digital rights under Articles 19 and 21. The judgement affirms that in today’s world, access to the internet is critical for learning, employment, medical care, finance, and democratic participation. Digital exclusion leads to social and economic marginalisation.
Key Takeaways from the Judgment
| Principle | Significance |
|---|---|
| Online Speech | Recognised constitutional protection for speech on the internet. |
| Judicial Review | Internet shutdowns are subject to judicial scrutiny. |
| Proportionality | Restrictions must be necessary, reasonable, and proportionate. |
| Transparency | Government shutdown orders must be published. |
| Digital Rights | Strengthened protections under Articles 19 and 21. |
| Social Importance | Internet access is essential for education, employment, healthcare, finance, and democratic participation. |
VIII. Digital Freedoms Within the Constitutional Framework
Digital freedoms are closely associated with the moral principles underpinning constitutional governance and democratic administration. The Constitution seeks to safeguard individual self-respect, freedom, and fairness against unreasonable government interference. In today’s digital world, these constitutional principles must extend to the online sphere and to the governance of technology.
Legal structures governing artificial intelligence, surveillance, and information handling must accordingly operate within constitutional boundaries and uphold essential rights.
Constitutional Protection of Digital Rights
Article 21 of the Indian Constitution has emerged as the pre-eminent foundation for safeguarding digital entitlements through judicial interpretation.
As AI technologies continue to evolve, India may require a dedicated AI governance law to address issues such as the following:
- Algorithmic accountability
- Transparency
- Fairness
- Protection against AI-related harms
The Digital Personal Data Protection Act, 2023, contributes to privacy protection in the age of AI, but it does not provide a complete solution for regulating the manifold challenges that AI presents.
Judiciary and the Future of Digital Governance
As technology advances, the judiciary will remain crucial in delineating the constitutional parameters of digital governance in India.
Courts will play a vital role in harmonising innovation, national security, and individual liberties to ensure that constitutional democracy and human dignity are preserved in the digital era.
| Constitutional Principle | Role in Digital Governance |
|---|---|
| Article 21 | Safeguards privacy, dignity, autonomy, and digital rights through judicial interpretation. |
| Artificial Intelligence Governance | Requires accountability, transparency, fairness, and protection against AI-related harms. |
| Digital Personal Data Protection Act, 2023 | Strengthens privacy protection but does not comprehensively regulate AI. |
| Judicial Oversight | Balances innovation, national security, and constitutional liberties. |
IX. Conclusion
The digital transformation has profoundly reshaped society, governance, and personal life.
The recognition of privacy as a fundamental right under Article 21 through the Puttaswamy judgement signified a watershed moment in Indian constitutional jurisprudence. It established the constitutional groundwork for safeguarding informational privacy, autonomy, and personal freedom in the digital age.
The rapid advancement of AI technologies, however, creates new legal and ethical challenges that cannot be resolved by data protection legislation alone.
The Digital Personal Data Protection Act, 2023, represents a significant legislative step but leaves critical gaps in the governance of automated systems, algorithmic accountability, and AI-driven surveillance.
The protection of privacy, dignity, and autonomy in cyberspace is vital to the preservation of constitutional values.
Need for a Comprehensive AI Governance Framework
A comprehensive legal framework for AI governance, grounded in the constitutional principles of reasonableness, necessity, and proportionality laid down in Puttaswamy, is an urgent imperative.
Only through such a framework can India ensure that the promise of Article 21 is fully realised in the digital age, safeguarding the dignity and liberty of every person in an increasingly AI-driven world.
| Key Area | Constitutional Objective |
|---|---|
| Privacy Protection | Safeguard informational privacy and personal autonomy. |
| AI Governance | Ensure accountability, transparency, and fairness. |
| Judicial Review | Protect constitutional rights against technological overreach. |
| Article 21 | Preserve dignity, liberty, and constitutional democracy in the digital age. |
References
- Justice K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1.
- Anuradha Bhasin v. Union of India, (2020) 3 SCC 637.
- Constitution of India, 1950, Art. 21.
- Constitution of India, 1950, Art. 19(1)(a) and 19(1)(g).
- The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023).
- The Bharatiya Nagarik Suraksha Sanhita, 2023 (Act No. 46 of 2023), s. 163.
- The Code of Criminal Procedure, 1973 (Act No. 2 of 1974), s. 144 (repealed).
- Maneka Gandhi v. Union of India, (1978) 1 SCC 248.
- NITI Aayog, National Strategy for Artificial Intelligence (2018).
- S.P. Sathe, Judicial Activism in India (Oxford University Press, 2002).
- Usha Ramanathan, ‘A Unique Identity Bill’ (2010) 45(35) Economic and Political Weekly 10.
- Chinmayi Arun, ‘On WhatsApp, Rumours, and Lynchings’ (2019) 54(49) Economic and Political Weekly 30.
Written By: Dr Kairali VS – Vels School of Law, Chennai
