Yesterday saw a landmark judgement out of India’s Supreme Court where nine judges ruled the right to privacy was “an intrinsic part of [the Constitution’s] Article 21 that protects life and liberty”. This decision reinforces the idea that privacy and protection of personal data form a firewall against today’s rapidly connected world. India has passed 450 million internet users in June this year and overall one-third of all Indians are connected at well above both the global and regional averages for affordability (A4AI).

Against this backdrop, recent survey findings show that one out of every three Indians is “extremely concerned” about how their personal data is handled and used. As more women come online, this figure will likely grow; currently, only 17% of women are connected across the whole of India (WRO).

While perception surveys suggest that Indians overall tend to fall on the more trusting side globally for how their personal data is handled, privacy is an issue increasingly affecting all Indians. Over the last seven years, the government has moved ahead with plans to register every Indian as part of a controversial and ambitious biometric ID programme, Aadhaar. Since 2010, some 1.11 billion Aadhaar cards have been generated, covering 92% of all Indians. Getting an Aadhaar card has become mandatory to access government subsidies and services — even to file taxes. Numerous court cases have been filed against the government, arguing that Aadhaar is a tool for surveillance and a means to violate privacy. Until yesterday’s verdict, analysts point to the fact that these challenges floundered since the right to privacy was not legally protected. Now India’s Supreme Court has said it is.

Despite the ruling, the debate on Aadhaar is likely to continue, and the governmental demand for people’s compliance to Aadhaar will not die down. However, the judgement is historic and significant on three counts:

• The judgement makes the privacy of Indian citizens a fundamental right. It enshrined privacy in the constitution (under article 21) at a critical moment. It was only in May 2017 that the former Attorney General of the Union government asserted “the concept of absolute right over one’s body was a myth.” This statement was made to those Indians who refused to provide their iris scans or fingerprints to the government, required for their Aadhaar registration.  Although the court’s judgement does not comment on whether the government’s de facto demand for all Indians to register to Aadhaar is an infringement of privacy, many Indian civil society activists think so, and will use the ruling to argue their case.
  
• The judgement actually now puts the government on the defence. They will likely have to link Aadhaar to the ‘reasonable restriction’ rider that comes with all fundamental rights. If privacy is a fundamental right with reasonable restrictions, then the government would now need to prove that their demand for people’s compliance to Aadhaar forms a part of the ‘reasonable restriction’ rider.
• The judgement is reminiscent of the concerns expressed five years ago by a group of experts on privacy under the chairmanship of Justice Ajit Prakash Shah. Justice Shah Commission’s report opened with the note that the ICT platforms that enabled national programmes (such as the unique identification number, DNA profiling, reproductive rights of women, privileged communication and brain mapping) had all the potential to impact the privacy of individuals of India.

The government’s argument in favour of Aadhaar as an essential system for Indians to access all financial services and welfare schemes has long been contested by various groups in India on the nature of its ‘rights’ violation as well as on its ‘technical flaws.’ The Supreme Court judgement now puts the onus on the government to ensure that there will be a robust data protection regime in India protecting an individual’s right to privacy.

Now is the time to move ahead with the proposed Right to Privacy Law, which had drafts released in 2011 and 2014. Apart from legally enshrining the Supreme Court’s decision, it would set up mechanisms — such as a Data Protection Authority and dispute resolution channels for how personal data is handled. Yesterday’s ruling shows that the fight has only just begun.

For updates, follow us on Twitter at @webfoundation and sign up to receive our email newsletter.