Exploring the Concept of Digital Citizenship and Digital Privacy
Meaning of Citizenship and Constitutional Rights
The idea of Citizenship refers to a collection of rights available to a person who is a recognized citizen of a nation state. Article 5–11 of the Indian Constitution provides to all citizens some basic fundamental rights to exercise, however with the advent of time the notion of digital citizenship has come into existence which means that individuals are granted an inherent right to use their rights granted by the constitutional mandate on internet such as a right to free speech or a right of freedom of expression.
Judicial Recognition of Digital Rights
The apex court in judgement of :contentReference[oaicite:0]{index=0} (2020) too affirmed that freedom of speech and expression over internet are constitutionally protected.
Digital Inclusion and State Responsibility
Further the notion of digital citizenship also entails within itself the right to be access and digital inclusion within all schemes and policies of the government thus the onus falls on the government itself to ensure that there are necessary tools available at the hand of government to ensure that each citizen is included within the ambit.
- Right to access digital infrastructure
- Digital inclusion within government schemes and policies
- State responsibility to provide necessary tools and mechanisms
Digital Privacy as a Pillar of Digital Citizenship
Another major foundational pillar which is also a part of rights entailed under digital citizenship is digital privacy.
Origin of the Right to Privacy
The concept of privacy as a right originated in the judgement of :contentReference[oaicite:1]{index=1} where the court overruled the previous judgements of :contentReference[oaicite:2]{index=2} and :contentReference[oaicite:3]{index=3} and established privacy as an established right under the ambit of Article 21.
Data Protection and the Consent Framework
This made the way forward for acts such as the :contentReference[oaicite:4]{index=4} entailing a spirit of privacy by including the concept of consent which is required by data fiduciaries in order to process data.
Concerns and Need for Scrutiny
Though some parts of this act make the application of it largely in the favour of government and thus there needs to be a deep scrutinization for this purpose.
Key Components of Digital Citizenship
| Component | Description |
|---|---|
| Digital Rights | Exercise of constitutional rights such as free speech and expression over the internet |
| Digital Inclusion | Access to digital infrastructure and inclusion in government schemes |
| Digital Privacy | Protection of personal data and recognition of privacy as a fundamental right |
Exploring the Legal Mandate and Rigidity of Data Protection Act 2023
The KS Puttaswamy judgement laid down the foundation for the Digital Data Protection Act 2023 which was inherently made to ensure that the fundamental rights ensured in the Puttaswamy judgement are not breached however the legal provisions of this act has rendered it a toothless watchdog.
I) Digital Exclusion and Violation of Citizenship Rights Caused by This Act
Firstly the consent obtained by data principal as defined under the section 2(j) of the act for a minors and PWD’s shall be given by their parents or guardians however this creates a form of blinded approach for Indian households only 38 percent of the households are literate as cited by Oxfam report 2022.
In such cases it is the Teenagers that introduces the concept of Internet or data to their parents thus it becomes important to question on the viability of parental consent in such cases and further it violates the principle of evolving capacities which recognize that as a child grows older his capacity to understand also changes.
Further putting up a bar of 18 years means equating a child of age 16 years to that of a 7 year which in itself is frivolous, instead the age of consent for giving access to data must be lowered to 16 as many other legislations such as the UK General Data Protection Regulation.
In case of persons with disabilities Section 9(1) provides data fiduciaries to obtain the consent of guardians in order to process their data thus equating their status to that of minors however this in itself falls in contravention to the Rights of Persons with Disabilities Act 2016 which pronounces limited guardianship and retain their full decision power.
This section limits the Limited Guardianship model proposed under the Rights of Physically Disabled People Act.
II) The Regulatory Capture
Secondly another major issue at hand is that the Data Protection Board created under Section 18 of the aforementioned act, the power of such a board is vast such as entertaining grievances of data principals related to breach and have complete discretion regarding moving of an enquiry if the board deems it fit.
Section 19 of this act provides for Central Government to appoint the chairperson and other members of this board. This in itself fundamentally is flawed since giving the power to Central Government to appoint the members of the very board meant to safeguard illegal consent obtained by the government itself violates the principles of Natural Justice.
Unlike other regulatory bodies such as the Competition Board of India or the Election Commission the selection committee is not diverse such as including members of judiciary as well as the opposition thus leaving everything to government’s discretion.
III) The Exemption Clause
Lastly the most important nuance associated with this act is that it gives under Section 17(2) government the power to exempt itself from obtaining consent required under this act for the purpose of interests of sovereignty and integrity of India, Security of State, friendly relations with foreign states or for the purpose of maintenance of public order.
Further provisions enlisted in Section 7 of this act also allows the government to have the data of the individuals on the grounds for the purpose of responding to a medical emergency, on the ground of extracting data if it is necessary for the law of the land and etc.
This renders the entire section as ultra-vires to the power of Central Government since the power to decide whether to extract data lies solely in the hands of Central Government not even in the hands of Data Protection Board which carves out a scope for political misuse of this law particularly against the leaders of opposition or anyone who seeks to dissent against the government thus curbing their right to free speech and expression under Article 19(1) which is a foundational pillar of citizenship rights.
Instead of giving complete powers to Centre in this regard judiciary must also be involved in ensuring that there is no misuse of such provisions.
The Chapter 3 of the UK Data Protection Act 2018 mandates that there must be a judicial warrant before the centre can process the data of an individual without notifying them in the interest of public order, integrity etc.
This means that the power to decide whether or not appropriation of data of an individual is necessary lies in the hand of judiciary which makes the entire process less biased and thus would lead to a greater integrity of this act.
IV) Absence of a Remedial System
Lastly even in case of a breach by the Centre under this act Section 39 makes it impossible for an individual to approach a civil court in order to avail the remedies showcasing a complete absence of check and balance.
Within the entire act no provision exists to compensate the data principal directly the only way data principal can avail any benefit is through fines and breaches imposed upon on the organizations thus staking the basic principle of “ubi jus remedium” for every right there exists a remedy.
Though the act was created in order to enforce the principles entailed in Puttaswamy judgement but in principal application remains largely in-effective especially in the cases pertaining to the Central Government.
In this case it becomes relevant to understand the GDPR act where Article 82 explicitly provides for a right to be compensated depending upon the burden of proof and the damages suffered by the person.
This right of compensation is not only provided through the organizations but also lies with the processor or the government agencies which have obtained the data.
Exploring The Viability Of Free Speech On Digital Media In Relation With Right To Privacy
A right to free speech has been guaranteed under the Indian Constitution under Article 19(1)(a), further free speech is also available to citizens on internet is already established fact under Anuradha Basin vs Union Of India however in looking at right to free speech it becomes important to take the right to privacy in consonance.
Anonymity And Free Expression On The Internet
The anonymity of an individual is necessary in order to ensure that he/she can freely express his opinions over internet without the fear of getting his personal Information risked.
Various reports and interviews provided by the members of the ruling party have exposed how the party in power has misused the personal data of Citizens in order to threaten the individual or to supress his/her free speech.
Information Technology Act, 2021 And Concerns For Free Speech
Another major thing with this respect is the Information Technology Act 2021 mandates that all the intermediaries have to take down the flagged content within 36 hours of notice of a Court or through Central Government.
The problem again associated with this provision is that Central Government is again given more authority in order to take down any content as it deems objectionable under this Act thus raising serious questions on the issue of freedom of Speech.
Government Power To Obtain Personal Information
Not only this but under this Act the government also has the power again to obtain Personal Information of any Citizen within 72 hour notice by any intermediary.
Violation Of The Proportionality Test Under KS Puttaswamy Judgment
All such provisions of the statue are in direct violation with the Proportionality test laid down under the KS Puttaswamy judgement which required that for any act of the government to bypass Privacy of an individual or free speech indirectly it has to be passed through three pillars:
- Legality requiring that an act is Passed by a Competent Authority
- State interest in matters of securing integrity, unity or broader Public interest.
- If such a restriction is proportional or justifiable.
Application Of The Proportionality Test To The Present Context
In the aforementioned case the first Pillar of this test remains satisfied in the sense that the Act has been Passed by a Competent Authority that is the Central Government.
Ambiguity arises in case of the Second pillar. Though the words integrity or security of State has been used under this Act to provide a Blanket to escape legal scrutiny but the definition of these terms are vague and unclear which raises serious questions over the viability of this test in these cases.
The Issue of Ambiguity and Interpretation
The major problem that finally comes down with this respect, which has not been addressed in the Puttaswamy judgment as well, is regarding the interpretation of these terms. It raises serious questions such as which authority or a board shall be given the power to interpret these terms and then decide? Secondly, which pillar shall have the power to choose the members of this board in order to ensure that the board is free from partiality? And how should the terms be interpreted in order to ensure that no or least ambiguity regarding their definition is left so as to make the entire process more transparent.
Proposed Solutions to the Problem
Various solutions for this problem can be proposed:
I. Transparency in Content Removal and Data Access
One of them being making people aware of why their content has been removed under Section 69A or why the Data Protection Board has decided to obtain their data without consent. Such kind of practice is seen under the Digital Services Act passed in 2014 where the Act makes it mandatory to make the reason for the removal of content known to the person. Further, the reason must also be available in the public domain and must be in clear and non-ambiguous terms.
II. Judicial Oversight and Decentralisation
In order to make it more transparent, the IT Act as well as the Data Protection Act must have a further provision of this reason being mandated by the appropriate judicial or an appellate body, which will ensure a less centralized system. Even in international courts, this principle of having a strong non-political body for reviewing the necessity of all such acts has been affirmed from time to time, such as in the case of Big Brother Watch and Ors vs United Kingdom.
III. Application of the Brandenburg Test and Ultima Ratio
Another major solution is to make the definition of what may constitute as creating incitement or disturbing public order more clear. For this, the Brandenburg Test can be viable, which has been devised under the US case of Brandenburg vs Ohio where the court explicitly held that in order to restrict free speech, the speech must cause an imminent or immediate threat to the public and the government cannot base its allegations on what may happen in the future. Secondly, it also called upon restricting free speech only if the words spoken are direct and not rhetorical.
Even within the Indian context, this test does not lose viability given the fact that the Supreme Court has already used this test multiple times, such as in the case of Arup Bhuyan vs State of Assam and Indira Das vs State of Assam. Thus, while analysing the restriction of free speech on the internet, the proximity test must be given parlance to the doctrine of Locus Poenitentiae, which means speech must be curtailed only in case of an immediate threat or danger that it can cause and it should not be subject to what may happen in the future, but only on imminent danger.
Another major solution is that while adding the grounds for restriction for privacy in Acts such as the Data Protection Act, the lawmakers should also provide illustrations for each ground so that citizens can know what the government might expect or whenever the government can step in order to restrict privacy.
Lastly, the concept of Ultima Ratio as enshrined in German laws dealing with protection of data must be stressed in respect of India, which mandates that data shall only be collected from an individual in case collection of the same remains the last and the only resort for the public authorities.
Artificial Intelligence and the Changing Paradigm
While analysing the question of digital citizenship, AI accountability and AI biasedness become important areas for study. AI-based engines are used in order to flag dangerous content for removal on social media as well as providing the grounds for restriction of privacy of a person. However, AI tools too show an inherent biasness which is based on historical roots, historical notions about a particular set of people, or already established trends.
While delivering the Puttaswamy judgment, the Court laid stronger grounds for data privacy but did not address the essential question of AI which is used in processing of sensitive personal data of individuals. In the case of Indian Medical Association vs Union of India, the Court ordered to scrutinize and review regulatory frameworks for AI to ensure the systems are safe, transparent, and accountable.
Applying the same principle here necessitates the amendment to the IT Act 2021 and the Digital Data Protection Act 2023 to enlist the specifications regarding the transparency used by AI in flagging out content or processing personal data by AI. Further, mandatory audits and testing of AI must be made necessary to curb out any illegality in AI-based mandates.
Conclusion
The Digital Data Protection Act fails the proportionality test, compromised by clauses which advocate regulatory capture and unnecessary exemptions. True digital rights can only be met as long as there is proper judicial oversight, statutory precision while interpreting vague terms, as well as guaranteed algorithmic and AI-based transparency, accountability, and fairness. “
