Introduction
In K.S. Puttaswamy v. Union of India (2017), a nine-judge Constitution Bench of the Supreme Court unanimously affirmed the Right to Privacy as a fundamental right intrinsic to life and personal liberty under Article 21. The ruling firmly anchored privacy in human dignity, personal autonomy, and bodily integrity, marking a watershed moment in Indian constitutional jurisprudence.
Core Dimensions of Privacy
The Supreme Court held that privacy imposes both negative duties (restraining arbitrary State intrusion) and positive obligations (requiring legislative protection of personal data). Privacy operates across three primary spheres:
- Spatial Privacy: Protection of physical boundaries, home, and personal spaces against unlawful surveillance and intrusion.
- Decisional Privacy: Autonomy over intimate personal choices, bodily integrity, and identity, later applied to decriminalise homosexuality in Navtej Singh Johar v. Union of India.
- Informational Privacy: An individual's control over the collection, processing, and dissemination of their personal data in a digital ecosystem.
The Four-Fold Proportionality Test
The court clarified that privacy is not an absolute right; legitimate State encroachments must satisfy a rigorous proportionality standard:
- Legality: The State action or restriction must be sanctioned by an enacted law.
- Legitimate Aim: The intrusion must serve a compelling public objective, such as national security, crime prevention, or targeted welfare distribution.
- Necessity: The measure adopted must be the least restrictive means available to achieve the desired goal, preventing excessive curtailment of rights.
- Balancing (Proportionality Stricto Sensu): There must be a rational nexus and a proper balance between the State objective achieved and the extent of rights infringed.
In the subsequent Aadhaar Judgment (2018), the Supreme Court applied this four-fold test to strike down Section 57 of the Aadhaar Act (which enabled private entities to mandate Aadhaar verification) as disproportionate, while upholding its mandatory requirement for targeted welfare subsidies under Section 7.
Legislative Enforcement and Institutionalisation
Following the recommendations of the Justice B.N. Srikrishna Committee set up post-Puttaswamy, Parliament enacted the Digital Personal Data Protection (DPDP) Act, 2023. The statute operationalises informational privacy by legally defining the duties of data fiduciaries, laying down consent protocols, and establishing the Data Protection Board of India.
Conclusion
The Puttaswamy judgment transformed Indian constitutional law from State paternalism to a rights-based framework that places individual dignity at its core. Sustained enforcement through robust statutory oversight will be vital to safeguard privacy amid rapid technological advancements.