This piece was first published on The India Cable – a premium newsletter from The Wire & Galileo Ideas – and has been republished here. To subscribe to The India Cable, click here.
In the first week of November, the Supreme Court will hear petitions by five academics – Ram Ramaswamy, Deepak Malghan, Sujata Patel, Mukul Kesavan and Madhava Prasad, along with the Foundation for Media Professionals – which urge the court to lay down guidelines for the exercise of police and law enforcement agencies’ powers to search and seize personal digital devices.
In 2017, a nine-judge bench of the court spoke in one voice as it held the right to privacy to be a constitutionally guaranteed fundamental right implicit in Article 21 of the constitution, and indeed, a synoptic reading of various other enumerated rights in the constitution.
It held that privacy in the digital age cannot be enforced or protected as an individual interest at all unless it is consecrated and fortified as a fundamental right.
The court was aware of the non-foreseeability of harms that arise out of a violation of the right to privacy. The court also elaborated on the various forms and facets of the right, including the privacy of correspondence, privacy as autonomy, and privacy as self-determination over personal information.
Most modern notions of privacy in the digital age use the term ‘privacy’ as shorthand to refer to a bundle of several concomitant rights over personal information – the right of access, the right of erasure, the right to have a say in the manner of its processing, the right of accuracy, the right of control of third-party access, etc.
However, this universally celebrated ruling has had little impact on the state’s behaviour.
The mobile phone is the treasure trove of one’s entire private life. But neither parliament nor any of the law enforcement agencies have seen the need or desirability to evolve any guidelines on how and when they could search the contents of a suspect’s mobile phone; or of its seizure, of the extraction of data from it or the manner in which it is produced or proved before a trial court.
Also Read | Interview: ‘Police Cannot Touch the Data on Your Computer Without Your Consent’
When Arnab Goswami handed in his phone and access to its data to the police, little did he know that his private communications in an instant messaging app would be disclosed to the entire world. It was the same with Rhea Chakraborty.
Even if one were to take an unsympathetic view of Goswami and Chakraborty, given that at that time they were both ‘accused’, the question also pertains to the privacy of others who had been in correspondence with them.
Mobile phones also contain data about other people – contact information, text messages, and emails. When police search a mobile phone, they gain access to this third-party data without the knowledge or consent of the other people involved.
The process by which law enforcement gains access to a phone may require answering a few questions.
Does the search of a phone require a judicial warrant?
Can the scope of the search be limited by that warrant? For instance, if there is reasonable suspicion that a conspiracy to commit a crime had been hatched in a WhatsApp group chat, can investigators check the subject’s communications in other groups, or other instant messaging or email communications, without further reason to believe that those are relevant?
If the scope of that search can indeed be limited, what measures would be needed to ensure that those limits are adhered to? Will the suspect be given a right to be present when the contents are being examined, and to object to the transgression of those limits?
A related question is whether the police should notify third-party data subjects when their data is being searched. This would give third-party data subjects the opportunity to challenge the search or to take steps to protect their privacy.
In addition to privacy, the Supreme Court would also have an opportunity to examine the matter from the point of view of the right against self-incrimination, protected under Article 20(3) of the constitution – also known as the ‘right to silence’.
The issue arises in several ways in relation to the production of devices by persons accused. However, the concern has generally been about the compulsion to divulge credentials, such as a password or a PIN.
There is a divergence of views among courts in other jurisdictions on this aspect. Some have held that police cannot compel a person to disclose their password, even if they have obtained a warrant. These courts have reasoned that disclosing a password is a testimonial act that is protected by the right against self-incrimination.
On the other hand, there are also judgments that hold that police can compel a person to disclose their password if they have obtained a warrant. These courts have reasoned that disclosing a password is not a testimonial act, but rather a physical act that is similar to providing a fingerprint or DNA sample. The Karnataka high court took this view last year.
The guidelines that the petitions seek also involve the protection of privileged communications, such as between spouses, between an attorney and a client, or a doctor and patient, and perhaps more pertinently, information that constitutes journalistic privilege or source secrecy.
The last but not the least concern is the return of devices seized during a search operation. Although Section 451 of the CrPC empowers the court to release seized devices once data has been extracted, in practice, the devices are detained eternally.
Privacy also includes the basic notion that the owner has been deprived access to the phone and its contents, which are required to carry on with life in the digital age.
If the Supreme Court chooses to lay down guidelines addressing some of these concerns, it would not only be ‘filling the gap’, but will in many ways herald a new age where there is some realisation of the landmark 2017 ruling.
Prasanna S. is an advocate-on-record in the Supreme Court and assists the petitioners in Ram Ramaswamy & Ors V Union of India WP(Crl) 138/2021, which is mentioned in this piece.