The Right to Privacy Case Was Nine Years Ago. Puttaswamy's Promise Is Still Waiting on a Data Protection Law That Works
The judgment told the state to bind itself. The statute it eventually produced binds everyone else.
The argument
- Puttaswamy was a judgment about the state's power over the citizen. The data protection law that followed is mostly about companies.
- The Act's exemptions for government, its government-appointed regulator and its amendment of the Right to Information Act leave the state where it was in 2017.
- Surveillance law — the part of the problem the judgment was decided to address — has not been touched.
On 24 August 2017, nine judges of the Supreme Court said unanimously that privacy is a fundamental right. The case had come to them because the government, defending the Aadhaar scheme, had argued that no such right existed. The bench answered that it did, that it was part of the liberty Article 21 protects, and that any law intruding on it must be a law, must pursue a legitimate aim and must be proportionate. The judges also said, in words the government has quoted ever since, that it was for the state to put in place a data protection regime. Nine years later there is one. It is not the regime the judgment described.
What the judgment asked for
Puttaswamy was not, at its core, a case about companies. The petitioners were worried about the state: about a biometric database that every welfare scheme would require, about the linking of that database to bank accounts and telephones, about what an executive with that information could do. The three-part test the judges laid down — legality, legitimate aim, proportionality — is a test for state action. The data protection law the judgment contemplated was one that would bind the state's collection and use of information about citizens, with an independent body to enforce it.
What the statute does
The Digital Personal Data Protection Act, 2023 is, for private companies, a serious law. It requires consent, notice, security, breach notification and erasure; it gives individuals rights of access and correction; it carries penalties of up to ₹250 crore; and from May 2027, when the rules take full effect, it will change how every business that touches personal data operates. For the state, it does three things the judgment did not contemplate.
- It lets the government exempt itself. Section 17 allows the Central Government to exempt any of its instrumentalities, by notification, on grounds of sovereignty, security, friendly relations or public order, and exempts processing for the prevention and investigation of offences outright. A law that the executive can switch off for itself is not a law that binds the executive.
- It gives the regulator to the government. The Data Protection Board's members are appointed by the Central Government on terms it sets. The Srikrishna Committee's 2018 draft proposed an authority selected with judicial participation; the 2019 bill kept a version of it; the Act dropped it. A board that reviews the state's processing is appointed by the state it reviews.
- It narrowed the Right to Information Act. Section 44(3) amended Section 8(1)(j) of the RTI Act to exempt personal information from disclosure without the public-interest balancing the provision had contained since 2005 — a change that protects officials from citizens, in the name of protecting citizens from officials.
A law that the executive can switch off for itself is not a law that binds the executive.
Lekha Menon
What has not been done
Surveillance law is where Puttaswamy was supposed to bite, and it has not been touched. Telephone interception is still governed by a provision of the Telegraph Act of 1885, carried without change into the Telecommunications Act, 2023, under which orders are issued by a home secretary and reviewed by a committee of secretaries; electronic interception by Section 69 of the Information Technology Act and rules from 2009 on the same model. There is no judicial authorisation, no notice to the person surveilled after the fact, no reporting to Parliament of how many orders are issued. The committee the Supreme Court appointed in the Pegasus matter reported in sealed cover; the court has not ruled. The proportionality test exists on paper and has never been applied to an interception order, because no one subject to one ever learns of it.
The judgment also assumed that the state's own databases would be governed by the new law. Instead, the Aadhaar judgment of 2018 upheld the scheme with limits that have since been loosened by amendment, the Criminal Procedure (Identification) Act, 2022 authorised collection of biometric and behavioural data from anyone arrested, with retention for seventy-five years, and the new criminal procedure code expanded the state's power to demand identification. Each was enacted after Puttaswamy; none was tested against it before passage.
Where the court is
The Supreme Court is, this term, hearing a Constitution Bench reference on whether metadata — call records, location data, browsing logs — attracts the full protection of the privacy right. It is the first occasion since 2017 on which the court has been asked to apply Puttaswamy to the state's own collection practices rather than to a statute's text. The answer will matter more than any provision of the Act, because it will say whether the three-part test is a rule for legislators or a standard the courts will actually enforce against the executive.
What would honour the judgment
- Narrow the exemptions. Replace the open-ended power in Section 17 with specific, time-limited exemptions subject to the Board's review.
- Free the regulator. Appoint the Board through a committee with a judicial member, give its members security of tenure, and let it make its own regulations.
- Legislate surveillance. Judicial authorisation of interception, post-facto notice where investigation permits, an annual report to Parliament, and a right to challenge — the ordinary features of every comparable democracy's law.
- Restore the RTI balance. Reinstate the public-interest override in Section 8(1)(j).
- Test new state databases first. A privacy impact assessment, published, before any law authorising the state to collect personal data at scale.
The judges in 2017 wrote that privacy is the constitutional core of human dignity. The state has since written a law that protects citizens from one another and from companies. That is worth having. It is not what was promised.
What did the Puttaswamy judgment decide?
That privacy is a fundamental right under Article 21 and Part III, that any interference must be lawful, pursue a legitimate aim and be proportionate, and that the state should enact a data protection law. Decided unanimously by nine judges on 24 August 2017.
What happened after Puttaswamy?
The Srikrishna draft of 2018, the 2019 bill withdrawn in 2022, the DPDP Act of 2023 with rules in November 2025 and full effect in May 2027; the Aadhaar judgment of 2018; and no reform of surveillance law.
Does the DPDP Act apply to the government?
Partly. State instrumentalities are data fiduciaries, but Section 17 lets the government exempt them by notification and exempts investigation of offences outright; the Board is government-appointed; and the Act narrowed the RTI exemption for personal information.
What law governs surveillance in India?
Section 5(2) of the Telegraph Act, now in the Telecommunications Act, 2023, with the PUCL safeguards and the 2007 rules, and Section 69 of the IT Act with the 2009 rules — executive authorisation, executive review, no notice.
Lekha Menon covers privacy, data protection and technology regulation. Read The Counsel's DPDP compliance roadmap and its report on the metadata reference before the Constitution Bench.
Lekha Menon
Lekha covers privacy, data protection and technology regulation.
Opinion pieces reflect the views of their authors and not necessarily those of The Counsel. This article is for general information only and does not constitute legal advice. Readers should consult a qualified lawyer about their own circumstances.