Data Localisation- Exercising Constitutional Constraints over Weapons of Mass Surveillance
Author:
3rd Year,
School of Law, Christ Deemed to be University.
The Personal Data Protection Bill, 2018 is set to be introduced in the Parliament in the upcoming Winter session, warranting an urgent introspection of its provisions. The Bill, apart from being riddled with ambiguous provisions, fails to adhere to even the most basic tenets of privacy jurisprudence recognised by the B.N. Srikrishna Committee. The Committee had aptly recognised the goal of any privacy statute to be able to balance individual rights against state interests. However, the Bill leans dangerously towards the latter, a textbook example of which can be the provisions relating to data localization envisaged under it.
The paper aims at dissecting the provision and examining the subject at two levels. The first part highlights the inherent inconsistency between the enshrined goal of data localization and the method employed by it to achieve that goal. The second part outlines the flagrant violation of constitutional norms resulting from such measures. The same shall be examined in the context of right to privacy and the right to broadband in India.
RIGHT TO PRIVACY IN INDIA
The need for privacy can be traced back to the dichotomy existing since the Aristotelian times between the public space and the family space.[1]However, antiquity does nothing to resolve the long legacy of misunderstandings and misconceptions surrounding the idea[2]inviting charges of being protean[3]and the exercise of defining it as a ‘misguided quest’[4]. Nevertheless, privacy, similar to other freedoms, is intuitive i.e. it may exist even without any outright doctrinal justification, given the importance it enjoys in a democratic setup.[5]
Privacy is a complex value, much less a right, which cannot be cabined within rigid contours.[6]Some authors define it in the context of a democratic society in which privacy rights functions as an important limitation on the functions of the government and protects against unwarranted intrusion.[7]Others follow the more traditional method of defining the idea in negative- a trend started by Louis Brandeis and Samuel Warren[8]and built upon by the courts[9]. In fact, jurists have even evolved taxonomy of this right identifying sixteen different categories of privacy.[10]Thus, privacy is a family resemblance concept meaning that the same concept may have different connotations in different jurisdictions.[11]
Data localization requirements, as analyzed in the paper, pertain to the provisions as contained under the Personal Data Protection Bill, 2018. Therefore, the paper will be restricted to the constitutional right to privacy as conceptualised by the Hon’ble Supreme Court of India in its Puttaswamy judgment. Hence, the conclusions arrived at in the paper may not be the same in other jurisdictions with dissimilar notions of privacy.
Comparative Analysis of Privacy in USA and India
Privacy rights in the West stemmed out of deep distrust in the government and its agencies reflected in the anti-communist hysteria and the McCarthy era laws in the United States of America (USA). This led to widespread suppression of the selected classes of citizens who the government thought posed a threat to the country’s national security. Similarly, Germany saw unspoken atrocities during the establishment of the Third Reich in the hands of the German Secret Police- the Gestapo. Nevertheless, privacy laws developed differently in both these countries. Whereas Germany progressed towards a single, comprehensive law on privacy, the US developed a more sectoral approach.[12]
The American Constitution originally did not provide for the right to privacy. The concept was judicially evolved as a part of the Fourth, First, Third, Fifth and Ninth Amendments, bestowing constitutional prot
ection as a penumbral right. This was most notably upheld in Griswold v. Connecticut[13]where the Court ultimately struck down the impugned statute. Unsurprisingly, judgments upholding decisional privacy in the sphere of child bearing[14], abortion[15]and contraceptives[16]soon followed suit. The present privacy doctrine in the US aims to preserve informational privacy in the public sphere where a person can reasonably expect privacy.[17]
ection as a penumbral right. This was most notably upheld in Griswold v. Connecticut[13]where the Court ultimately struck down the impugned statute. Unsurprisingly, judgments upholding decisional privacy in the sphere of child bearing[14], abortion[15]and contraceptives[16]soon followed suit. The present privacy doctrine in the US aims to preserve informational privacy in the public sphere where a person can reasonably expect privacy.[17]
RIGHT TO ACCESS INTERNET AS A FUNDAMENTAL RIGHT IN INDIA
Events of the recent past have elicited unprecedented judgments from the Hon’ble Supreme Court of India, deserving praise and criticism in equal measure. Anuradha Bhasin v. Union of India[18]and Ghulam Nabi Azab v. Union of India[19]is one such case. The Court in its judgment bestowed constitutional protection under Articles 19(1)(a) and 19(1)(g) on internet, as a medium for exercising the rights enshrined thereunder. However, it fell short of declaring internet access as a Fundamental Right. Whereas the judgment of the Court is legally tenable and consistent with the Indian free speech jurisprudence, the lack of explicit declaration serves to condone the atrocities perpetrated by the government and ensures its continuance. The present discussion aims at analyzing the arguments put forward in favour of such a right and addresses the counter arguments alongwith considering privacy implications of such declaration.
The freedom of speech enjoys a historical legacy in India, as can be seen in the way the country obtained freedom from its erstwhile British overlords. The struggle for freedom, in this sense, was struggle for basic civil rights held inalienable in other countries[20], the absence of which led to widespread, well documented oppression[21]. In fact, K.M. Munshi while drafting the Constitution held such a right to constitute the essence of democracy.[22]Thus free speech, as made available to all citizens, was incorporated within the Indian Constitution by the makers of the Constitution in this backdrop.[23]
The Indian jurisprudence, with respect to free speech, is rooted in the centrality which the idea enjoys in a working democracy. Accordingly, it has undergone sufficient expansion to include the freedom of press, the freedom of accessing information, freedom to hoist the national flag and so forth. The objective of free speech in all these cases was identified to be attainment of truth, public participation in socio-political decision-making and individual self-fulfillment.[24] The right to internet, for the purposes of the present discussion, will be shown as the next logical step in this direction.
Defining the Right to Internet
The right to broadband first needs to be defined in order to be understood. This right is two-pronged and includes the following:
a) Unrestricted access to the internet subject to enumerated legal restrictions and;
b) Availability of technology to access the internet.[25]
Thus, it can be seen that it includes a positive right to access the internet as well as a negative right to availability of technology.[26]Accordingly, the former casts a negative duty on the state to not restrict this access and the latter casts a positive duty on the State to provide technology enabling the access. In the international forums the right is said to originate from the right to communicate[27]and the right to propagate ideas and access them[28].
The need for such a right has been expedited due to the phenomenon of ‘convergence’.[29]The traditional forms of information gathering from sources such as newspapers, radio and the like, have all converged with the internet. In other words, these sources now predominantly rely on the internet to reach their customers. Thus, if the right to internet is withheld from the people then their right to information is directly affected due to the advances in the field of information and communication technology, which have become the dominant mode of information dissemination.[30]
The Nature of Right to broadband in India
At the outset, it must be noted that this right is in the nature of a derivative right i.e. those rights which are not mentioned explicitly in the constitutional text but are nevertheless important to realise the objectives of the Constitution. They are termed as ‘penumbral rights’ or ‘unenumerated rights’ within the American jurisdiction.[31]Prominent examples of the same include the right to abortion[32]and the right to privacy.[33]
The Indian jurisprudence too believes in the same. Fundamental Rights in this sense have been held to be empty vessels to be filled in by each generation according to their experience.[34]This proposition was further expanded by the court by obligating constitutional courts to expand the ambit and reach of Fundamental Rights,[35]as Part III rights provide only the skeleton meant to be filled in by the courts[36].
The complex nature of the right to internet makes it difficult for it to be confined within one single Part III right. This means if this right is violated (assuming it has been granted) then more than just one Fundamental Right would stand violated. For instance, Article 19(1)(a) would be violated due to the aforementioned phenomenon of ‘convergence’. Also, if only certain sections of the society have access to this right owing to a digital divide[37], then it invites the wrath of Article 14. Thus, the right to internet is a multifaceted, penumbral right.
Arguments for a right to broadband
The object and purpose of the right to freedom of speech provides a prima facie justification for the existence of a right to broadband. The latter was granted so that members of the civil society are able to develop individual belief systems and propagate the same.[38]This was relied on by the Court to support the constitutional status of right to know as, knowledge about matters affecting public decide the extent of political free speech and its ability to sway public opinion.[39]Similarly, the right to disseminate or otherwise express one’s beliefs are in furtherance of the objectives of free speech.[40]The internet has now become an important tool of information dissemination owing to its wide coverage in a relatively short span of time. At the same time, it has become the predominant source of news and opinion in India.[41]Therefore, combining both it is evident that the internet has become an attractive ‘marketplace of ideas’[42], capable of providing high rate of return on very small amounts of investment. Hence, an impediment in accessing or in any way utilizing this resource will hamper the objectives envisaged under free speech.
This argument is further buttressed by the expansion of free speech by the apex Court. The court did not restrict Article 19(1)(a) to certain types of information which can be developed and circulated rather, it included within its ambit a wide range of endeavours. This included the right to be entertained, educated and informed and the like which promote scholarly initiatives and enhance the political discourse in the country.[43]In fact, even playing was considered to be an expressive conduct by the courts within Article 19(1)(a).[44]Therefore, a potential restriction on the right to access the internet will have the effect of prohibiting this exchange of ideas in the widest possible manner.
Often, a case against the granting of the right to internet is based upon the flawed understanding of Article 19(1)(a) that it aims to protect only certain mediums of expression, as in the case of newspapers, magazines etc. and not internet per se. However, it must be noted that the right granted under the same is medium neutral i.e. Article 19(1)(a) does not concern itself with the medium through which the idea is being propagated. Therefore, the construction of the provision is wide enough to include the internet as well.[45]
Another argument which favours the right is the increased corporatization of mass media. This poses a real and present danger to the freedom of speech and expression. It is a well established fact that common ownership of media impedes plurality of public opinion.[46]This means that very often, opinion masquerading as public opinion may not in actuality reflect the views and sentiments of the public instead, they tend to reflect the views of the corporate owners of these news outlets.[47]In fact, this had been anticipated way back by the Court and weakening effect this would have on the independence of the Fourth Estate.[48]In such times the internet can be safely relied on to reflect the actual views of the public as it is not owned by any corporate entity or a private individual. Therefore, this independence proffered by the internet might become subject to unreasonable government restrictions and hence, requires greater safeguards.
Therefore, the right to propagate one’s ideas should not be left confined to the traditional understanding of rights. Such rights must adapt to the changing contours of technology which enables wider and faster transmission of information leading to widespread circulation. Any attempt to restrict the same on technical or non technical grounds would be an affront to the deep rooted and expansive understanding of constitutional values of India[49]. Thus, the Kerala High Court has duly and rightfully recognised the right to access the internet.[50]
The internet has revolutionised the means of human communication. The Indian jurisprudence too has been active in expanding the contents of civil liberties in order to adapt to the changing needs of the society. Therefore, only a legislative vacuum exists for the Parliament to fill in and for the executive to implement it
DATA LOCALIZATION IN THE PDP BILL
The Bill makes a lazy attempt at being rights-friendly by toning down the localization requirement mandated by the RBI which barred the concerned entities from storing Indian data in foreign servers. The Bill, on the other hand, mandates only a copy of it to be stored in India, supposedly promoting national and data security. However, this does not overcome the fundamental flaw in data localization i.e. data honey potting. This ignores the fundamental precept of data security which links greater data and network fragmentation to enhanced security. Such data aggregations act as jackpot for cyber terrorists, waiting to be plundered. Hence, the goal of national security stands vanquished.
The advocates of data localization cite increasing threats of data colonization to further buttress their arguments. However, this argument too fails to stand the test of reason. An important requisite for data colonization is the concentration of data within certain geographic territories or nation states, as without data there can be no colonization. This may be due to the data localization norms of the domestic country. Hence, data colonization traces its roots to data localization itself.
In other words, the answer to data colonization is not data localization, doing so may only end up in creating a vicious cycle threatening the security of data across the globe. Therefore, the need of the hour is to globalise data as much as possible and not localise it.
DATA LOCALIZATION AND ITS CONSTITUTIONAL EFFECTS
Data localization also suffers from disturbing constitutional infirmities, especially in the aftermath of right to privacy acquiring a Part III status. Such measures are often the first step towards creating an environment of undiscriminating surveillance. This is compounded by the fact that the right involved is the right to privacy which people are ready to surrender, as Posner terms it, ‘at the drop of a hat’. Jurists across the globe cannot agree more.
Hence, there is an ever-pressing need to be extra cautious when it comes to the right to privacy. The Supreme Court of India, prescient of the same, had thus incorporated the American doctrine of gradual and stealthy encroachment within the Indian constitutional tradition. This recognises the fact that cherished rights are hardly annihilated in one fell swoop, they are gradually encroached upon until the day the right-holders suddenly realise their folly.
Data localization translates into greater government access to citizens’ data, increasing the threat of mass surveillance. This, coupled with troves of information collected by the government in the present day and age, implies that the government has rode roughshod over the principle of data stratification which Chandrachud J. had so accurately applied to preserve the constitutionality of Aadhar. Also, the implementing data localization will present another set of problems such as invasive IP checking.
Therefore, data localization in the opinion of the author has absolutely no legal basis and cannot be allowed to be implemented in a democratic setup.
[1] J. Roy, ‘Polis’ and ‘Oikos’ in Classical Athens, 46(1) GREECE AND ROME, 1 (1999).
[2] Ujwala Uppalpuri & Varsha Shivangowda, Preserving Constitutive Values in Modern Panopticon: The Case for Legislating Toward a Privacy Right in India, 5 NUJS L. REV. 21 (2012).
[3] Raymond Wacks, The Poverty of “Privacy”, 96 L.Q. Rev. 73, 76-77 (1980).
[4] Ken Gormley, One Hundred Years of Privacy, WIS. L. REV., 1135 (1992).
[5] Charles Fried, Privacy, 77 Yale L. J. 475 (1968).
[6] David H. Flaherty, On the Utility of Constitutional Right to Privacy and Data Protection, 41 CASE WEST. RES. L. REV., 831.
[7] Rubenfeld, The Right of Privacy, 102 HARV. L. REV. 737, 805 (1989).
[8] Warren & Brandeis, The Right to Privacy, 4 HARV. L. REV. 193, 195 (1890).
[9] Olmstead v. United States, 277 U.S. 438, 478 (1928) (Brandeis, J., dissenting), overruled in Katz v. United States, 389 U.S. 347 (1967).
[10] Daniel J Solove, A Taxonomy of Privacy, 154 U. PENN. L. REV. 477, 479 (2006).
[11] Wittgenstein, Ludwig (2001) [1953]. Philosophical Investigations. Blackwell Publishing.
[12] Robert M. Gellman, Can Privacy be reglated effectively on a national level? Thoughts on the Possible Need for International Privacy Rules, 41 Vill. L. Rev. 129, 146-47 (1996).
[13] 381 US 479 (1965).
[14] Eisenstadt v. Baird, 405 US 438 (1972).
[15] Roe v. Wade, 410 US 113 (1973).
[16] Paul v. Davis, 424 US 714 (1976).
[17] Katz v. United States, 386 US 954 (1967).
[18] WP(C) 1031/2019.
[19] WP(C) 1164/2019.
[20] Madhavi Garodia Divan, Facets of Media Law (2006), page 46.
[21] Bipin Chandra Pal et al., India After Independence: 1947-2000 (1999), page 22.
[22] 7 Constituent Assembly Debates, page 728.
[23] Subradipta Sarkar, Right to Free Speech in a Censored Democracy, 7 U. Denv. Sports & Ent. L.J. 62 (2009).
[24] Irwin Toy Ltd. v. Quebec (Attorney General), (1989) 1 S.C.R. 927.
[25] Special Rapporteur On The Promotion And Protection Of The Right To Freedom Of Opinion And Expression, Human Rights Council, U.N. Doc. A/HRC/17/27, Para 3 (2011).
[26] Jonathon W. Penney, Inrerner Access Rights.”A Brief History and Intellectual Origins, 38 (1) William Mitchell Law Review 9, 15 (2011).
[27] UNESCO, 21C/Resolution 15.1, page 57.
[28] Article 19(2), ICCPR.
[29] Milton L. Mueller, Digital Convergence and its Consequences, The Public 6(3) 12 (1999).
[30] Kartik Chawla, Right to Internet Access – A Constitutional Argument, 7 Indian J. Const. L. 57 (2017).
[31] Missouri v. Holland, 252 US 416.
[32] Roe v. Wade, 410 U.S. 113 (1973).
[33] Griswold v. Connecticut, 381 U.S. 479 (1965).
[34] Kesavananda Bharati v. State of Kerala, (1973) 4 SCC 225.
[35] Pathumma v. State of Kerala, (1978) 2 SCC 1.
[36] People’s Union of Civil Liberties (PUCL) v. Union of India, AIR 2003 SC 2363.
[37] Chandra Gnanasambandam et al., Onine and Upcoming: The Internet’s Impact on India, McKinsey & Company, page 6.
[38] Indian Express Newspapers (Bombay) (p) Ltd. & Ors. v. Union of India & Ors., (1985) 1 SCC 641.
[39] 1982 2 SCR 365.
[40] Romesh Thappar v. State of Madras, 1950 SCR 594.
[41] Zeenab Aneez et al.,, Reuters Institute India Digital News Report, 2019.
[42] Shreya SInghal v. Union of India, (2013) 12 S.C.C.73.
[43] Zee Telefilms & Anr. v. Union of India & Ors., AIR 2005 SC 2677.
[44] Secy., Ministry of Information & Broadcating, Government of India & Ors. etc. v. Cricket Association of Bengal & Ors., (1995) 2 SCC 161.
[45] Odyssey Communications Pvt. Ltd. v. Lokvidayan Sanghatana & Ors., 1988 AIR SC 1642.
[46] Edwin Baker, Media Concentration and Democracy (2006).
[47] Paranjoy Guha Thakurta, Reliance Takeover of Network 18, EPW (2014).
[48] Bennett Coleman v. Union of India, (1973) 2 SCR 757.
[49] Union of India v. Naveen Jindal & Anr., AIR 2004 SC 1559.
[50] Faheema Shirin R.K. v. State of Kerala & Ors., WP(C) No. 19716 of 2019 (L).
