puttaswamy judgement

Health IDs: Unpacking the Narrative That Underpins India’s New Digital Superstructure

Is ‘consenting’ to share our data enough to decide what happens with it?

Note: This is the first of a two-part series explaining India’s plunge into digitising healthcare data, the ecosystem this is being built on, the key players involved and the set of governmental and private interests behind this push. Read the second part here.

On Monday, Prime Minister Narendra Modi launched the Ayushman Bharat Digital Mission, a platform to digitise citizens’ health records and provide them to public and private hospitals, testing laboratories and pharmacies.

“Every Indian will be given a Health ID,” the prime minister had promised on August 15 this year, from the ramparts of the Red Fort, elaborating, “This Health ID will work like a health account for every Indian. Your every test, every disease – which doctor, which medicine you took, what diagnosis was there, when they were taken, what was their report – all this information will be included in your Health ID.”

As a part of the online registration process for vaccinations against COVID-19, anyone who uses their Aadhaar details to sign in to the CoWIN platform is automatically issued a new health ID.

Apart from issuing Health IDs and digitising citizens’ personal health records, including prescriptions, diagnostic reports, medical histories, and billing information, the Ayushman Bharat platform will also maintain a digital register of medical practitioners, hospitals, and clinics. These will integrate private telemedicine and e-pharmacy operators with the public citizen-facing ecosystem to facilitate digital consultations with doctors, book appointments with diagnostic laboratories, order medication to be delivered home, or integrate health insurance payments for these services.

“The core building blocks… shall be owned, operated and maintained by the Government of India. Private stakeholders will have an equal opportunity to integrate with these building blocks and create their own products for the market,” senior bureaucrat Indu Bhushan, who was spearheading the digital health mission earlier, told reporters during its launch.

Major private players have heralded the Ayushman Bharat initiative for allowing them parity with the governmental healthcare system.

“The implications of this programme are far wider than what is being perceived today. It’s like a neural system for the entire ecosystem where the signals will flow up and down. That is what would bring in efficiency in the healthcare system,” Ashutosh Raghuvanshi, managing director and CEO, Fortis Healthcare, told Business Standard.

However, critics warn that such platforms will be used by the government to shirk off its responsibilities towards developing public healthcare infrastructure and have questioned the lack of adequate data protection laws in India.

Before the COVID-19 pandemic, in July 2018, the NITI Aayog had released its strategy document for the National Health Stack. This marked India Stack’s foray into healthcare, promising to build a key link in providing better ‘quality of care’ to citizens. India Stack refers to a set of application programming interfaces (or APIs) for integrating software and hardware, developed in conjunction with UIDAI’s Aadhaar project, that will facilitate ‘cashless’, ‘paperless’ and ‘presence-less’ services from business and government. This idea was developed into the Data Empowerment and Protection Architecture (or DEPA), a draft framework proposed by NITI Aayog in August 2020 for how private corporations and government agencies can access citizens’ personal data. DEPA calls upon private developers to design ‘consent managers’ – software that will allow exchanges from databases holding citizens’ personal data with those agencies seeking it, with the individual’s consent. DEPA stipulates certain financial and regulatory obligations under which consent managers will be governed.

How does DEPA seek to make India ‘data rich’ even while a lot of Indians remains very poor? And what are the threats that we must be protected from on this path to ‘data empowerment’? These are some questions that we delve into here. The rapidly expanding ecosystem of personal data-reliant services demands that we, as a society, face up to new challenges. But all that is silicon may not be gold. The role played by a small coterie of the financial and political elite in shaping India’s personal data governance machinery, in the pursuit of consent-based data sharing, is far from selfless. The Indian experience with personal data may have been different from the US, European, or Chinese ones, but it will be no less a stranger to controversy.

Prime Minister Narendra Modi virtually launches Ayushman Bharat Digital Mission, in New Delhi, September 27, 2021. Photo: Screengrab via PTI

Consent in code

DEPA’s consent managers will serve as intermediaries for handing over an individual or organisation’s personal data, similar to a notary or broker handling more traditional transactions. Consent managers will be ‘data-blind’, that is, they will not access any of the data under question or create copies in their own database but merely facilitate access to it for a fee.

This is how the technology will work: A ‘data user’, which could be either a government or a private agency, will submit its request in a standardised format to the consent manager. The consent manager will inform the person or organisation, whose data is in question, of the kind of data being requested, what purpose it will be used for, how long it will be shared, and whether it will be handed over to third parties.

If the request is granted, one or more ‘data fiduciaries’ – the governmental or private entities hosting the data – will fulfil the request. DEPA stipulates certain design principles to ensure that what is being consented to can be clearly understood, arguing that market-based competition among consent managers will ensure that diverse populations are catered to as porting between them will not be a hassle.

Source: Data Empowerment and Protection Architecture draft

For this exchange to work, the data will have to maintain ‘interoperable’ standards, that is, it must be readable across consent managers and the databases which could potentially use it. DEPA proposes using Open Standards to allow data sharing and portability between applications, tasking relevant agencies under the central government to set up data ‘sandboxes’ – toolkits that allow commercial entities to test their products before release using anonymised data sets maintained by the government.

While NITI Aayog predicts that individuals or small business can profit from allowing access to their data through a consent manager, charging them for each transaction may not be viable commercially. This is why consent managers may set up a subscription rate or enter into financial agreements with the entity requesting access to the data, the ‘data user’, to facilitate the transaction.

The regulation of DEPA’s consent managers has been delegated by NITI Aayog to sectoral authorities, as designated by the relevant Union ministry. Unregulated sectors can also use consent managers, in which case, the newly-designated Data Protection Authority (DPA) will serve as the regulatory authority. The Personal Data Protection Bill, tabled in the lower house of parliament in 2019, proposed setting up the DPA to monitor the use of public data, along the lines of the regulator SEBI in the securities market, IRDA in insurance, or TRAI in telecommunications. Currently, the DPA is set to be a wholly nominated body, while the data protection law awaits parliamentary approval for close to two years.

DEPA also states that, in certain cases, self-regulatory bodies may also be set up by businesses ‘to ease the burden on regulators’. An industry body called Sahmati is already performing such a role in the banking sector.

‘Data empowerment’ in practice

The draft framework states that ‘financial inclusion’ is DEPA’s immediate objective, something it has in common with the ‘Jan Dhan-Aadhaar-Mobile’ trinity. Speaking at a Microsoft policy conclave back in 2016, Nandan Nilekani, ex-chairperson of the UIDAI, had illustrated what this brave new world of consent-based data sharing for banking could look like.

“Suppose I want to get a loan from someone, I can tell my bank, ‘Give me my bank statement, electronically signed,’ and I’ll give it to the lender. I can tell the Income Tax [department], ‘Give me my tax records,’ I’ll give it to the lender. I’ll ask the, you know… my social media guys to give me my behavioural data, and I’ll give it to the lender.”

However, NITI Aayog’s report also clarified that DEPA will be applicable beyond banking and insurance. Apart from Ayushman Bharat in healthcare, the Telecom Regulatory Authority of India’s recommendations for ‘user empowerment’ in telecommunications, ‘e-credentialing’ for vocational education, and the India Urban Data Exchange for ‘smart city’ governance are some other places this will play a key role. Earlier in September, the Reserve Bank of India gave its nod to expand ‘account aggregators’ (AAs), the technology behind the Unified Payments Interface (UPI), into lending. AAs can now digitally serve the financial information of individuals and small businesses to lenders. Over 14,000 accounts have requested to join the new platform within a fortnight, making details of bank statements, insurance policies and mutual fund holdings just a tap away for lenders.

Health’s data-sharing quest

What will DEPA look like when the healthcare sector embraces its data sharing potential? Progress made on implementing consent managers in healthcare that is demonstrated on the National Digital Health Mission’s sandbox website hints at what lies ahead.

Source: National Digital Health Blueprint

In one scenario, a cancer patient may provide her Health ID to her diagnostics lab. Her reports will then be available to her on any consent manager of her choice by simply linking her Health ID to the app.

Now, if a ‘health information user’, such as an insurance agency, requests to view the patient’s radiology reports, this pop up on the consent manager application. She can then choose to share the reports with the agency for a designated period of time by ‘agreeing’ to do so on the app, as shown below.

Linking records. Source: NDHM Sandbox website

Health Information User dashboard. Source: NDHM Sandbox website

In practice, however, it may happen that a private insurance agency may choose to grant medical coverage only to customers willing to link their Health IDs and share other digitised records. Similarly, they may offer special incentives to those who share their medical history and financial statements for more customised insurance premium plans. In both these cases, while consent managers may allow citizens to exercise their choice, as defined in technological terms, odds will weigh against the individual for withdrawing consent because they entail putting her insurance coverage on the line.

The government, which is investing public resources in operationalising this digital ecosystem, is unlikely to play the role of a neutral arbiter either. Experience with voluntary enrolment under the UIDAI’s Aadhaar project, a biometrics-based identification system, illustrates this. With Aadhaar, not sharing biometric details with state and non-state agencies comes at a high cost. Activities ranging from opening Jan Dhan Yojana bank accounts, receiving subsidies or even buying a SIM card may be stalled, or become incredibly more tortuous, without Aadhaar linkage. In some cases, not sharing biometric details has resulted in being denied elementary government welfare schemes such as Mid Day Meals. With the prime minister’s public push for Health IDs, it seems that Ayushman Bharat is also heading the Aadhaar way. Welfare schemes in healthcare may be made contingent on digitising one’s health records, as has been done with a host of targeted benefits delivery schemes in the case of Aadhaar.

India has roughly twice as many private hospitals as government ones, despite less than a quarter of its citizens having access to medical insurance. There is one Indian doctor for every 11,082 citizens, more than ten times the doctor to patient ratio prescribed by the World Health Organisation. Prasanna S., a Supreme Court lawyer who has challenged the mandatory linkage of Aadhaar, warns that the digital health mission’s data policy puts the cart before the horse. Without clearly outlining its public healthcare benefits, the government has restricted public consultation to the fine print of how a massive database of citizen’s health data will be created. How the NDHM, which facilitates the entry of private medical technology companies using publicly-funded infrastructure, will help India reduce its healthcare deficit has not been addressed.

Moreover, a nine-judge bench of the apex court in the K. S. Puttaswamy vs Union of India verdict had designated certain types of data, such as that related to healthcare, as ‘sensitive personal data’ requiring legal safeguards. “So once this private information is at play, any state measure necessarily requires law,” Prasanna pointed out to this reporter during a discussion on the NDHM’s health data policy last September. “Where is this law? There is no law as on date.” The proposed Personal Data Protection Bill, 2019 is yet to be adopted by the Lok Sabha. In effect, a series of position papers from NITI Aayog and private think tanks seen as being close to the government have substituted any general or sectoral legislation related to personal health data.

Over 55,700 Health IDs had been issued within a fortnight of the prime minister’s announcement. Only on August 26 did the NDHM release a draft National Health Data Policy, which outlined certain protections for citizens’ sensitive personal data related to health. A week was initially provided for consultation with the public, which led technology watchdog groups such as the Internet Freedom Foundation to argue that the government was showing undue haste during a global pandemic.

Major conglomerates were already in the fray over this development. A day before Modi’s Independence Day address, the US-based retailer Amazon had launched its online pharmacy services in Bengaluru. Three days after the announcement, Mukesh Ambani’s Reliance Industries inked a Rs 620 crore deal to pick up 60% stake in the e-pharmacy company Netmeds.

Sourya Majumder is an independent researcher.

As SC Indicts Centre for Indifference to Basic Structure Doctrine, its Exasperation Is Telling

Judgments of nine non-collegium judges offer a mixed bag, suggesting an uncertain future for the Basic Structure Doctrine.

This is the last article in a six-part series on the basic structure doctrine – which the Supreme Court of India propounded in 1973 when it said that there are features of the constitution which are unamendable under any circumstances. The Wire is revisiting the doctrine as various aspects of it figure in several important cases currently before the apex court.

Also read: Part I / Part II / Part III / Part IV / Part V

On Friday, a three-judge bench of the Supreme Court comprising Justices L. Nageswara Rao, Hemant Gupta, and S.Ravindra Bhat lamented a disturbing trend of the government not implementing the directions issued by the court. “To ensure that the Tribunals should not function as another department under the control of the executive, repeated directions have been issued which have gone unheeded forcing the Petitioner (Madras Bar Association) to approach this Court time and again. It is high time we put an end to this practice. Rules are framed which are completely contrary to the directions issued by this Court.”

Among its key directions to the Centre, the bench has emphasised the constitution of a National Tribunals Commission to act as an independent body to supervise the appointments and functioning of tribunals, as well as to conduct disciplinary proceedings against members of tribunals and to take care of administrative and infrastructural needs of the tribunals. Also, the new search-cum-selection committees to fill vacancies of the tribunals will have the CJI or his nominee as the chairperson with a casting vote. This is to ensure that the judicial element, despite the presence of the civil servants in the committees, dominates.

Friday’s judgment is significant also because the court expressed its dismay and anguish that what has been recognised as part of the basic structure of the constitution by as many as five constitution benches of the court previously, is at stake: the guarantee of the rule of law to each citizen of the country, with the concomitant guarantee of equal protection of the law. Like many other nations, India recognised the need for tribunalisation of justice to provide for adjudication by persons with the ability to decide disputes in specific fields as well as to provide expedited justice in certain kinds of cases. By its cavalier attitude to the need for complying with the court’s directions to ensure tribunals’ autonomy, the Centre stood accused of turning a blind eye to the mounting arrears in the tribunals, mainly due to the delay in filling up the vacancies of the presiding officers and members of the tribunals.

Is the judgment on Friday in Madras Bar Association v Union of India symptomatic of the Centre’s likely indifferent stand in several crucial pending matters before the Supreme Court in which questions impinging on the Basic Structure Doctrine (BSD) have been raised?

The Indian Supreme Court currently has 30 judges with four vacancies. As the Supreme Court is set to hear several momentous cases of constitutional significance, The Wire takes a look at the judicial statistics of 14 judges who have dealt with cases impinging on basic structure doctrine during their Supreme Court terms so far.

Part V dealt with first five judges of the Supreme Court, who are part of the apex court’s collegium of five senior-most judges entrusted with the task of recommending new judges to the court. The Wire found that the judgments authored by the first five judges inspire hope that BSD may be relied upon to render justice in crucial cases before the court.

This part deals with the remaining nine Judges of the Supreme Court who dealt with the basic structure cases in the past. The data for this part, as in Part V, is drawn from Advance Judge Analytics of manupatrafast.com.

Also read: On Basic Structure Doctrine, Rulings of the SC’s First Five Judges Inspire Hope

1. Justice D.Y. Chandrachud

Date of Appointment (DoA): 13-05-2016.
Date of Retirement (DoR):10-11-2024
Current Seniority in Supreme Court: 6
Judgments authored: 316.
Judgments cited in : 187
Number of Basic Structure Cases dealt with so far in SC: 10

In Central Public Information Officer, Supreme Court of India v Subhash Chandra Agarwal, Justice Chandrachud joined the other judges on the constitution bench on the need to balance independence of the judiciary, a basic feature with the fundamental right to free expression. The Attorney General in this case pointed out that the disclosure of file notings between constitutional functionaries which concern the appointment process will erode the independence of the judiciary.

In Rojer Mathew v South Indian Bank Ltd and Others, the Supreme Court assessed the constitutional validity of the Finance Act, 2017 which pertain to the structure and organisation of tribunals. The petitioners challenged the passage of the Act as a Money Bill. The constitution bench struck down the Tribunal, Appellate Tribunal and other Authorities (Qualification, Experience and other Conditions of Service of Members) Rules, 2017 as a violation of the doctrine of separation of powers, and the basic structure of the constitution. Corollary to the dictum of the Supreme Court in the Fourth Judges case, judicial dominance in appointment of members of judiciary cannot be diluted by the executive, the bench held. The bench referred to the aspect of Money Bill in this case to a larger bench. Justice Chandrachud had authored a concurring opinion in this case.

Justice Dhananjaya Y. Chandrachud

In Maharashtra Chess Association v Union of India, Justice Chandrachud, presiding a bench also comprising of Justice Indira Banerjee, relied on judicial review being part of the basic structure of the constitution to hold that the Bombay high court erred in ousting its own writ jurisdiction to hear the case under Article 226.

In B.K.Pavitra v Union of India, Justice Chandrachud upheld the validity of the Karnataka Reservation Act, 2018, which provides for consequential seniority to persons belonging to Scheduled Castes and Scheduled Tribes promoted under the reservation policy. The Act was enacted after the Supreme Court held as invalid the previous Reservation Act, 2002 in the absence of quantifiable data for determining inadequacy of representation, backwardness and impact on overall efficiency. The court found merit in Karnataka government’s stand that promotion cannot be treated as the acquisition of creamy layer status.

Besides, the above Justice Chandrachud’s judgments in Justice K.S.Puttaswamy v Union of India (2017 Privacy case and the dissent in 2018 Aadhaar case), Government of NCT of Delhi v Union of India, Kalpana Mehta v Union of India, Jindal Stainless Ltd v State of Haryana and the dissent in Abhiram Singh v C.D.Commachen, are notable.

Also read: CJI Bobde’s View of Article 32 is Linked to Apex Court’s Vacillation on Basic Structure Doctrine

2. Justice Ashok Bhushan

DoA: 13-05-2016
DoR:04-07-2021
Current Seniority in Supreme Court: 7
Number of judgments authored: 226
Number of judgments cited in: 147
Number of basic structure cases: 6

Justice Ashok Bhushan has been part of the benches which delivered judgments in Justice K.S.Puttaswamy v Union of India (Aadhaar case 2018), Government of NCT of Delhi v Union of India, Kalpana Mehta v Union of India, and Jindal Stainless Ltd v State of Haryana.

Besides, he has authored judgment in K.Lakshminarayanan v Union of India, in which he rejected the contention that the principle of federalism, a basic feature, stood breached when the Centre unilaterally nominated members to the Puducherry legislative assembly, without consulting the government of the union territory.

In Shanti Bhushan v the Supreme Court, he dismissed the plea that the Chief Justice of India be directed to constitute a collegium of senior Judges for taking decisions as master of the roster. While the petitioner sought the Court’s intervention to ensure that rule of law, a basic feature prevails by such a direction, the bench held that the CJI ought to exercise his responsibility as the master of the roster independently to uphold the independence of the judiciary, another basic feature.

3. Justice L. Nageswara Rao

DoA: 13-05-2016
DoR: 07-06-2022
Current Seniority in Supreme Court: 8
No. of judgments authored: 159
No. of judgments cited in: 99
No. of basic structure cases: 2

In Association of Medical Super Speciality Aspirants and Residents and others v Union of India and Others, which Justice Rao, sitting with Justice Hemant Gupta, decided that right to life guaranteed by Article 21 means right to life with human dignity. While balancing communitarian dignity vis-a-vis the dignity of private individuals, the scales must tilt in favour of communitarian dignity. The laudable objective with which the state governments have introduced compulsory service bonds at the time of admission to postgraduate courses and super speciality courses could not be termed arbitrary as it was aimed to utilise the services of doctors who are the beneficiaries of government assistance to complete their education.

Justice Rao supported the precedent set in a previous case that moral considerations cannot be kept at bay and the judges are not expected to sit as mute structures of clay in the hall known as the courtroom, but have to be sensitive, “in the sense that they must keep their fingers firmly upon the pulse of the accepted morality of the day”. Although Justice Rao did not invoke BSD explicitly in this case, its influence was apparent in his reasoning, as the mandate to realise the objectives of the welfare state has been recognised as part of the basic structure in previous cases.

Also read: As Courts Rule on Constitution’s Basic Structure, Landmark Doctrine Turns Out to Be Elastic

It is not surprising, therefore, to find Justice Rao to voice his anguish in the manner he did in Madras Bar Association v Union of India on November 27. He reiterated the previously-held view in L.Chandra Kumar v Union of India that the power of judicial review vested in the high courts and the Supreme Court is part of the basic structure; therefore, the tribunals cannot act as substitutes of the high courts and the Supreme Court, and their functioning is only supplementary and that all decisions of administrative tribunals will be subject to scrutiny before a division bench of the respective high courts.

He also supported the precedent set while upholding the creation of NCLT and NCLAT, on the basis of the principle that independent judicial tribunals for the determination of the rights of citizens and for adjudication of the disputes and complaints of the citizens is a necessary concomitant of the rule of law. He underlined that the vesting of adjudicatory functions in tribunals was held to be not violative of the basic structure of the constitution, even when the court held the National Tax Tribunal Act, 2005 to be unconstitutional.

Relying on Supreme Court’s decision in Rojer Mathew which struck down the 2017 Rules, Justice Rao held that lack of judicial dominance in the search-cum-selection committee is in direct contravention of the doctrine of separation of powers and is an encroachment on the judicial domain. Excessive interference by the executive in the appointment of the members would be detrimental to the independence of the judiciary and an affront to the doctrine of separation of powers, he reminded the Centre.

Justice Rao blamed the Centre for ignoring the binding precedents, while framing the 2020 Rules, even though they replicated 2017 Rules in respect of the constitution of the search-cum-selection committees, insofar as they do not ensure judicial dominance. He made it clear to the Centre that the sponsoring department should not have any role to play in the matter of appointment to the posts of chairperson and members of the tribunals.

4. Justice Sanjay Kishan Kaul

DoA:17-02-2017
DoR: 25-12-2023
Current Seniority in Supreme Court: 9
No. of judgments authored: 85
No of judgments cited in : 44
No. of basic structure cases: 2

In State of Gujarat v Utility Users Welfare Association, Justice Kaul held that in any adjudicatory function of the state commission, it is mandatory for a member having the legal experience to be a member of the bench. But it is not mandatory to appoint a high court judge as a chairperson of the State Electricity Commission, he held.

Besides, Justice Kaul has authored a concurring judgment in Justice K.S.Puttaswamy (Privacy) case which is known for its lucidity. Justice Kaul, in his judgment, he held that the right of privacy protects the inner sphere of the individual from interference from both state, and non-state actors and allows the individuals to make autonomous life choices.

While agreeing with the view expressly overruling the ADM Jabalpur case, Justice Kaul called it an aberration in the constitutional jurisprudence. He desired that the majority opinion in that case, declining any relief to a citizen whose rights stood suspended when Emergency is in force, should be buried ten fathom deep, with no chance of resurrection.

Justice Sanjay Kishan Kaul. Credit: Youtube

Justice Sanjay Kishan Kaul. Photo: Youtube

Justice Kaul’s reluctance to test president of the Jammu and Kashmir High Court Bar Association, Mia Abdul Qayoom’s detention order recently for its validity, while persuading the Centre to release him in lieu of his promise not to make any political statements, surprised observers.

Justice Kaul’s disagreement with the previous ruling in A.D.M.Jabalpur case made one believe that he stood for expansion of one’s rights rather than restricting them taking cover under an Emergency-like situation in Jammu and Kashmir. But his latest judgment declaring the Shaheen Bagh-type protests unacceptable, and requiring them to be held in designated public places made one wonder whether he favoured shrinking of rights using specious reasoning.

Also read: Why Uncertainty Still Surrounds the Birth of the ‘Basic Structure Doctrine’

5. Justice S. Abdul Nazeer

DoA: 17-02-2017
DoR:04-01-2023
Current Seniority in Supreme Court: 11
Number of judgments authored: 71
Number of judgments cited in: 45
Number of Basic structure cases: 1

In Bharati Reddy v State of Karnataka and Others, Justice S. Abdul Nazeer held that judicial review, being a part of the basic structure of the constitution, cannot be ousted by Article 243-O of the constitution. Clause (b) of Article 243-O says that no election to any Panchayat shall be called in question except by an election petition presented to such authority and in such manner as is provided for by or under any law made by the legislature of a state. While a single judge misinterpreted the bar of Article 243-O as ousting high court’s jurisdiction, the division bench of the high court remanded the matter to the single judge. The Supreme Court agreed with the division bench citing basic structure doctrine. The judgment, authored by Justice S. Abdul Nazeer, held that the writ petition filed by the voters, who are not the members of the Zilla Panchayat, challenging the election of the Adhyaksha of the Zilla Panchayat, is maintainable.

6. Justice Navin Sinha

DoA: 17-02-2017
DoR: 04-01-2023
Current Seniority in Supreme Court: 12
Number of judgments authored: 114
Number of judgments cited in : 81
Number of basic structure cases: 1

In Neetu Kumar Nagaich v State of Rajasthan and Others, Justice Navin Sinha reiterated the previously held view that the power of the constitutional courts to direct further investigation or reinvestigation is a dynamic component of its jurisdiction to exercise judicial review, a basic feature of the Constitution. Though it has to be exercised with due care and caution and informed with self-imposed restraint, the plenitude and content thereof can neither be enervated nor moderated by any legislation, he has held.

In this case, a 3rd year student at the National Law University, Jodhpur mysteriously died, and his parents were dissatisfied with the investigation carried out by the state police. The investigation had reached a dead end without identification of the offenders. The Supreme Court set aside the closure report in the case, and directed a de novo investigation by a fresh team of investigators to be concluded within two months from September 16.

Also read: Eight Cases That Will Test Whether ‘Basic Structure Doctrine’ Can Safeguard India’s Democracy

7. Justice Indira Banerjee

DoA: 07-08-2018
DoR: 23-09-2022
Current Seniority in Supreme Court: 14
Number of judgments authored: 39
Number of judgments cited in: 18
Number of basic structure cases: 1

In All India Institute of Medical Sciences v Sanjiv Chaturvedi and Others, Justice Indira Banerjee held that judicial decorum and propriety demanded that a judicial order can be vacated, varied, modified, recalled or reviewed by a bench of coordinate strength or larger strength or a higher forum, but not a smaller bench of lesser strength, except in cases where such authority to a smaller bench was expressly conferred or implicit in such order.

In this case, the chairman of the Central Administrative Tribunal, at the principal bench at Delhi had stayed proceedings pending before a Division Bench of CAT at Nainital. The chairman, being one amongst the equals, could not have stayed proceedings pending before a larger bench, she held, relying on the proposition that judicial review is part of the basic structure of the constitution.

8. Justice Sanjiv Khanna

DoA: 18-01-2019
D0R: 13-05-2025
Current seniority in Supreme Court: 22
Number of judgments authored: 37
Number of judgments cited in: 16
Number of basic structure cases: 2

He authored the main judgment in Central Public Information Officer, Supreme Court of India v Subhash Chandra Agarwal, referred to earlier. In Ashwani Kumar v Union of India, he held that the doctrine of separation of powers, though not specifically engrafted, is constitutionally entrenched and forms part of the basic structure. In view of this, he declined the prayer of the petitioner in this case, the former Union minister, for a direction to parliament to enact a suitable standalone comprehensive legislation on custodial torture based on the Convention Against Torture and Other Cruel, Inhuman or Degrading Treatment or Punishment adopted by the UN General Assembly.

9. Justice S. Ravindra Bhat

DoA: 23-09-2019
DoR: 20-10-2023
Current Seniority in Supreme Court: 28
Judgments authored: 25
Judgments cited in: 7

Although Justice Bhat is yet to hear a basic structure case in Supreme Court so far, the last one which he decided as Rajasthan high court chief justice is noteworthy.

Also read: In Deciding Constitutionality of Enactments, Justice Arun Mishra Always Deferred to Centre

In Milap Chand Dandia and Others v State of Rajasthan and Others, which he decided as the Chief Justice of Rajasthan high court on September 4 last year, Justice Bhat had declared Sections 7BB and 11(2) of Rajasthan Ministers Salaries Act, 2017 as arbitrary and contrary to Article 14 of the constitution and therefore, void. The Act provided that former chief ministers shall get for the remainder of their lives, a government residence, a car for their family members, telephone and a staff of 10 persons including a driver. In arrogating a section of the political executive, that is, former chief ministers to status of a ruling elite by assuring them significant largesse for life, amounts to saying that they are more equal than other public servants and citizens of India, he held.

The remaining 16 judges of the Supreme Court may yet be untested in the application of the BSD to constitutional litigation, as search within their judgments on basic structure doctrine has not yielded any results. However, the possibility that they may sit in benches presided by or comprising some of these judges may well indicate how the scales of justice will tilt when the court begins to hear the pending basic structure cases.

India’s Privacy Bill Will Alter How it Regulates Social Media Platforms, Not all of it Good

The Bill gives the Centre the power to designate certain social media intermediaries as significant data fiduciaries.

The Personal Data Protection Bill was tabled in the Lok Sabha in December following much anticipation and debate.

The tabled Bill significantly differs from the one proposed by the Justice Srikrishna Committee, especially when it comes to provisions relating to governmental access to citizens’ data, with (retd) Justice Srikrishna going so far as to call it ‘dangerous’ and capable of creating ‘an Orwellian state’.

What has gone under the radar, perhaps, amidst this is the implications of the ‘social media intermediary’ construct that the Bill introduces, and the proposal to require certain social media platforms to provide users the option to voluntarily verify their accounts.

Section 26 defines ‘social media intermediary’ as a service that facilitates online interaction between two or more ‘users’ and allows users to disseminate media. While e-commerce, internet service providers, search engines, and email services are explicitly excluded from the definition, this term is broad enough to cover messaging services like WhatsApp, Telegram and Signal.

The Bill further provides for certain social media intermediaries to be designated as ‘significant data fiduciaries.’

Also read: Privacy Bill Will Allow Government Access to ‘Non-Personal’ Data

Apart from the generic obligations that the Bill proposes for significant data fiduciaries, Section 28(3) requires these designated entities to provide users with an account verification mechanism.

Scope and permissibility

Clearly, the intended effect of the provisions is outside the ambit of what we generally understand by ‘data protection.’ Perhaps the drafters also recognised this, and therefore awkwardly included ‘laying down norms for social media intermediaries’ in the preamble.

The fundamental issue here is that the obligation conflicts with a core tenet of similar legislation globally that has been emphasised in the Bill as well: data minimisation, i.e. the principle that organisations should not collect more information than needed to fulfill their purpose. The verification requirement is essentially a State diktat coercing social media companies into collecting more information about their users than is necessary.

Another way to look at the provision is as a move to indirectly expand the amount of information available to the government. Interestingly, the intention behind Section 28(3) is not mentioned in the Bill or its Statement of Objects and Reasons. The legitimate aim required to justify privacy infringements by the State as laid down in Puttaswamy v. Union of India has not been sufficiently clarified in the case of this provision.

Also read: Final Privacy Bill Could Turn India into ‘Orwellian State’: Justice Srikrishna

Therefore, this provision could very well flounder on being subjected to constitutional scrutiny.

Excessive delegation: Is the devil in the detail?

Another striking feature of the provisions is that several important decisions are left to the executive. The Bill gives the Centre the power to designate certain social media intermediaries as ‘significant data fiduciaries’ if they have with users higher than notified thresholds, whose ‘actions have, or are likely to have a significant impact on electoral democracy, security of the State, public order or the sovereignty and integrity of India’.

We can contrast this with the fact that the general power to classify entities as significant data fiduciaries lies with the Data Protection Authority (DPA). However, when it comes to social media intermediaries, the DPA is reduced to a paper tiger, with only consultation (and not even concurrence) being sought from the DPA.

This concentration of power in the hands of the government should be viewed in conjunction with the obvious conflict of interest created by the Bill: the government would be incentivised to designate platforms which attract dissenting speech, thereby increasing their obligations and concomitant costs.

The classification criterion is also problematic as ‘significant impact on electoral democracy’ is a subjective standard. Such powers could be a case of excessive delegation to the executive, possibly having an arbitrary impact on all growing social media platforms. Given this ambiguity, social media platforms may be incentivised to err on the side of caution and to apply harsher content moderation practices to police dissenting speech.

‘Voluntary’ verification of users

The Bill requires intermediaries to extend to users the option to verify their accounts, and verified accounts are to be provided a mark that shall be visible to all users. The manner in which platforms are supposed to facilitate this verification is yet another critical matter that is left to delegated legislation. If the history of Aadhaar is any indication, such delegation may result in rules that compromise the stated ‘voluntary’ nature of the provision.

Also read: Looking Beyond Privacy: The Importance of Economic Rights to Our Data

Even if left truly voluntary, this obligation may have an adverse impact on the exercise of freedom of expression online. Almost all leading social media platforms rely on user insights to drive personalised advertisement services that generate most of their revenue. These platforms have normalised private-actor surveillance of human behaviour, and seek to collect as much information as possible about users and non-users alike.

For instance, despite criticism, Facebook has a ‘real name’ policy, going as far as collecting information from users’ friends and third-parties to verify the ‘real’ identities of its users. Therefore, platforms like Facebook may incentivise the verification of accounts by increasing the visibility and reach of content created by ‘verified’ accounts, thereby eroding the legitimacy of pseudonymous expression.

The proposal is in sharp contrast with EU’s General Data Protection Regulation, which has led to rulings in Germany that Facebook’s ‘real name’ policy violates the law. The primary motivation of data protection legislation is to limit the personal and social harms that arise out of such indiscriminate collection of information. Unfortunately, instead of mitigating these, the Bill may very well end up entrenching these harms.

Legitimising surveillance

It is also relevant to note that the intermediary guidelines proposed by the MeitY were criticised for placing onerous requirements on ‘intermediaries’, a term in the Information Technology (IT) Act that remains a Procrustean bed for almost all internet services. Since the IT Act does not provide a separate definition of ‘social media intermediary’ and only defines an ‘intermediary’, the inclusion of the provision in the Bill may be a more convenient, albeit misplaced, effort to classify intermediaries and subsequently carve out specific obligations.

However, as we point out, this classification is outside the scope of the PDP Bill and would be better suited in the IT Act. The proposed provisions lack a clear and legitimate aim that is sought to be achieved from user account verification, and an excessive delegation of powers to the executive.

The provisions also need to be looked at in conjunction with Section 35 of the Bill, which empowers the Central government to exempt any government agency from obligations relating to processing of personal data in the interest of security of the State where necessary.

This provision marks a significant dilution of the Bill proposed by the Srikrishna Committee, which clearly incorporated the Supreme Court’s ruling in Puttaswamy v. Union of India: any invasion into privacy by the government must be authorised by law, be necessary for a legitimate state purpose and be proportional to the said goal. If the Bill is passed in its current form, exempted law enforcement and intelligence agencies would be able to demand data from social media intermediaries, including information on the ‘real identity’ of users, with little safeguards.

Unfortunately, it seems that several provisions of the Bill, including the schema relating to social media platforms, seek to legitimise disproportionate forms of state surveillance rather than curbing the power of the government to invade citizens’ privacy.

Tanaya Rajwade and Gurshabad Grover are researchers at the Centre for Internet and Society (CIS). Views are the authors’ alone.

Disclosure: The CIS is a recipient of research grants from Facebook.

Bombay HC: Phone Tapping Permitted Only in the Interest of Public Safety

The court quashed three separate orders passed by the home ministry allowing the CBI to intercept phone calls of a businessman.

The Bombay high court on Tuesday granted relief to a 54-year-old Mumbai based businessman and quashed three separate orders passed by the Union Ministry of Home Affairs allowing the Central Bureau of Investigation (CBI) to intercept phone calls of the petitioner businessman in a case of bribery involving an official of a public sector bank.

A division bench of Justice Ranjit More and Justice N.J. Jamadar directed the CBI to destroy the copies of said call recordings.

According to the CBI, the petitioner gave a bribe of Rs 10 lakh to the said bank official for credit-related favour. In three separate orders dated October 29, 2009, December 18, 2009, and February 24, 2010, interception of telephone calls of the petitioner was allowed. The CBI registered an FIR against the petitioner on April 11, 2011.

The petitioner contended that the said action was ultra vires of Section 5(2) of the Indian Telegraph Act, 1885, in non-compliance of rules made thereunder, and in violation of the fundamental rights guaranteed under Part-III of the constitution of India.

Senior advocate Vikram Nankani along with Sujay Kantawalla appeared for the petitioner in the case. They relied upon the apex court’s judgement in People’s Union for Civil Liberties (PUCL) v. Union of India (1997) and the nine-judge constitution bench’s decision in K.S. Puttaswamy v. Union of India (2017). Nankani argued that the alleged illegally intercepted telephonic recordings contained in the chargesheet and all material collected on the basis of such alleged illegally intercepted telephonic recordings ought to be set at naught.

Also read: Will India’s Snooping State Survive Judicial Scrutiny?

As per Section 5(2) of the Indian Telegraph Act, such interception can take place only on the occurrence of any public emergency, or in the interest of the public safety.

The PUCL case was affirmed by the apex court’s constitution bench in K.S. Puttuswamy (supra). In the said case (Puttuswamy), another decision of the apex court in R.M. Malkani v. State of Maharashtra was referred to.

The nine-judge bench also contemplated the following test for ensuring that right to privacy of an individual is not infringed upon:

Principle of proportionality and legitimacy

The concerns expressed on behalf of the petitioners arising from the possibility of the state infringing the right to privacy can be met by the test suggested for limiting the discretion of the state:

(i) The action must be sanctioned by law;

(ii) The proposed action must be necessary in a democratic society for a legitimate aim;

(iii) The extent of such interference must be proportionate to the need for such interference;

(iv) There must be procedural guarantees against abuse of such interference.

Also read: Is the Modi Govt Snooping on You? Here Are Five Questions You Should Be Asking

Judgment

Justice More who authored the judgement noted:

“We are of the view that as per Section 5(2) of the Act, an order for interception can be issued on either the occurrence of any public emergency or in the interest of the public safety. The impugned three interception orders were issued allegedly for the reason of ‘public safety’. As held in PUCL (supra), unless a public emergency has occurred or the interest of public safety demands, the authorities have no jurisdiction to exercise the powers under the said section. The expression “Public Safety” as held in PUCL (supra) means the state or condition of freedom from danger or risk for the people at large. When either of two conditions are not in existence, it was impermissible to take resort to telephone tapping.”

Thus, quashing the interception orders, the court observed:

“To declare that dehors the fundamental rights, in the administration of criminal law, the ends would justify the means would amount to declaring the Government authorities may violate any directions of the Supreme Court or mandatory statutory rules in order to secure evidence against the citizens. It would lead to manifest arbitrariness and would promote the scant regard to the procedure and fundamental rights of the citizens, and law laid down by the Apex Court.”

This article was first published on LiveLaw. Read the original here.

India’s Draft Data Protection Bill Needs to do More to Stack Up Against Global Standards

On 15 data protection policy-making metrics, we found that the Srikrishna Committee output passed muster on four principles.

India is at the cusp of enacting a data protection legislation. After an eventful year following the Supreme Court’s Puttaswamy judgment interpreting right to privacy as a fundamental right and the appointment of experts’ committee on data protection in India by the Ministry of Electronics and Information Technology, enactment of data protection legislation appears to be finally nearer to its next stage.

On July 27, 2018, a ten-member committee of experts on the data protection framework in India submitted a 176-page report and a draft bill entitled The Personal Data Protection Bill, 2018 (“Draft Bill”) to the Minister of Electronics and Information Technology, Ravi Shankar Prasad. The committee was chaired by retired Indian Supreme Court Justice B.N. Srikrishna.

It is essential that the privacy and data protection framework for the next billion users of the internet is informed by global best practices, and provides a strong user rights-respecting regime. Foremost amongst these global standards and practices are those created and enforced by the EU. After many years of implementing its Data Protection Directive, the EU advanced its regulatory regime for data protection by enacted and recently officially implementing the General Data Protection Regulation (GDPR). The GDPR is a positive framework for data protection, and will help users take back the control of their personal information. The framework is inspiring a number of governments around the world to introduce data protection legislation or to upgrade existing laws. Setting aside the issue of remaining loopholes for protection, the EU’s GDPR is proving to serve as an important benchmark for data protection legislation.

The Draft Bill proposed by the Srikrishna Committee draws inspiration in many instances from the GDPR. However, whether the Draft Bill provides an adequate framework for protecting the rights of the citizens of India is a live matter of debate.

Assessing the work of the Srikrishna Committee

At the start of 2018, several of us in the Access Now public policy team produced a policy guide based on the EU GDPR experience for the lawmakers working on data protection legislation across the world. The guide, entitled, ‘Creating a Data Protection Framework: A Do’s and Don’ts Guide for Lawmakers – Lessons from the EU General Data Protection Regulation’, provides a list of key issues that lawmakers should consider and emphasise when drafting comprehensive data protection legislation.

A copy of this lawmakers’ guide was submitted to the B.N. Srikrishna Committee on data protection in India earlier this year as a response to the public consultation carried out by the committee.

Following the submission of the report and the Draft Bill by the expert committee to the government of India, we embarked on an exercise of evaluating the Draft Bill, using the principles from the lawmakers’ guide as the benchmark. We have sought to provide a clear, concise, and principles-based evaluation of the complexities within the data protection framework proposed by the Indian expert committee.

A full copy of our larger evaluation report – entitled ‘Assessing India’s proposed data protection framework: What the Srikrishna Committee recommendations could learn from the lessons of Europe’ – is now available online.

Overall, of our 15 data protection lessons we earlier identified, we found that the Srikrishna Committee output passed muster on four principles, needs improvements on eight principles and failed in three areas. Overall, the Government of India needs to address the shortcomings and failures in the output presented by the Srikrishna Committee in 11 areas of global data protection standards. This include the following areas:

–Ensure transparent, inclusive negotiations

–Define and include a list of binding data protection principles in the law

–Define legal basis authorising data to be processed

–Include a list of binding users’ rights in the law

–Create binding and transparent mechanisms for secure data transfer to third countries

–Develop data breach prevention and notification mechanisms

–Establish independent authority and robust mechanisms for enforcement

–Do not seek broad data protection and privacy limitations for national security

–Do not authorise processing of personal data based on the legitimate interest of companies without strict limitations

–Do not develop a “right to be forgotten”

–Do not authorise companies to gather sensitive data without consent

Understanding the issues at play

The Draft Bill, in its current state, has many hits and misses. It is important to pay attention to the deeper details involved in many of these issues, in order to ensure that Parliament considers and passes a strong, effective privacy and data protection law aimed at protecting Indian citizens.

In our analysis, we found that the provisions of the Draft Bill defining the scope of application of the law, along with data security measures proposed for entities, seem to be strong. While multiple important rights entitled to the users have been codified under the Draft Bill, many gaps persist under the proposed regime. Rights such as the right to access and rectify data have been diluted and must be strengthened, and certain key rights such as right to object and the right to explanation are not provided under the Draft Bill. The steps taken toward data integrity and data protection impact assessment are encouraging and so are the provisions aimed at ensuring proper consent and standards thereof. However, the provisions on obtaining prior explicit consent have been diluted by the over-broad criteria of “exercise of functions of the state”.

We found the proposals for data localisation quite concerning, especially given such measures serve a surveillance and law enforcement purpose, at the cost of privacy and protecting user data. In the absence of adequate regulation of governmental access to citizen data in India, these data localisation measures may make user data in India liable to indiscriminate access by the government.

And that there is a severe need for reforming the surveillance regime in India is a fact noted by the expert committee itself in its report. However, despite this acknowledgement, neither the Draft Bill nor the report contain legislative language to reform and tighten Indian surveillance and investigatory powers. This is exacerbated by the several exemptions currently proposed by the Srikrishna Committee to be provided to government departments and other public agencies from data protection requirements in the name of “security of state” and “exercise of state functions”. This approach undermines confidence in the Indian government’s publicly stated resolve to truly protect the rights of its citizens and signal a surveillance creep in the data protection regime in India.

The Data Protection Authority, as currently outlined by the legislative text proposed by the Srikrishna Committee, would not be sufficiently independent from the executive or effective in its functioning. There are multiple concerns regarding the independence of the Authority, as well as ambiguities regarding the processes and jurisdiction of various departments within the Authority, particularly around the appointment, powers, and ways of working of the “adjudicatory officers” proposed in the Draft Bill to hear and decide claims brought by individuals regarding their data protection rights being infringed. The Draft Bill obliges the Data Protection Authority to conduct “‘mandatory” public consultation while making “codes of practices”, but multiple areas of regulation have been put outside the purview of this obligation. It is imperative that such consultations are made mandatory with respect to all regulations issued by the Authority in order to be truly user-centric, transparent and accountable.

The Draft Bill seeks to amend a few most celebrated rights of Indian democracy: the right to information. The additional language proposed by this bill to add to the existing Right to Information Act raises significant dangers – which many in the right to information and right to privacy communities have raised concerns on – especially of government departments much more actively seeking to refuse right to information requests.

Making sure we improve on the work of the Srikrishna Committee

The Srikrishna Committee report and its Draft Bill — which must be acted on by the government of India and finally considered in Parliament – requires further work to ensure that it truly protects the rights of users.

The outputs from the Srikrishna Committee ultimately represent the work of one expert committee. It is up to the Ministry of Electronics and Information Technology, and the government of India as a whole, to improve on the text provided to them and ensure that Prime Minister Narendra Modi and his Cabinet recommend a much stronger, citizen-focused bill for consideration by Parliament.

And ultimately, MPs must be allowed to perform their role and push themselves to only enact a strong privacy law for the Indian Union.

Raman Jit Singh Chima, Naman M. Aggarwal, and Akash Singh work with Access Now’s global policy team.

One Year of India’s Right to Privacy: No Step Forward and Two Steps Back

The Aadhaar programme, the context in which the much celebrated judgment was pronounced, continued on its merry way with little change to its scope, ambit or practices.

One year ago, to this date, nine judges of the highest court of the land spoke in one voice as they upheld the status of the right to privacy as a fundamental right protected under the constitution. In that process, the court rubbished the government’s stand that 40 years of supreme court jurisprudence recognising such a right required reconsideration.

The government’s Make-India-Great-Again arguments were based on a 1954 judgment and the majority opinion of a 1962 judgment both of which were given in an era where fundamental rights jurisprudence was unrecognisably different from the modern post-’70s reading of our fundamental rights.

In a constitutional democracy in which the rule of law and the rulings of the highest constitutional court are respected by the government, one might expect the judgment to alter the way the government went about its business. In the past 12 months though, we saw this expectation slowly turn into hope and then a wish and then finally into despair.

The Aadhaar programme, the context in which the much celebrated judgment was pronounced, continued on its merry way with little change to its scope, ambit or practice(s).

News stories on data leaks were only slightly less regular than the reports of targeted violence against women, minorities and/or Dalits.

Efforts were also on to build a social media monitoring tool, which would enable the central government to listen to every person’s digital communications including, gasp, e-mails, delivering the 2.0 version of its big-brother-dom.

The last remaining hope was pinned on the work that the committee of experts led by Justice (Retd) B.N. Srikrishna had undertaken. That was to show the nation the path forward and suggest a legislative framework on privacy and data protection, even as there were deep democratic flaws in the constitution of the committee and its functioning. The much delayed draft bill, accompanied by a report that ostensibly justifies the choices in the bill, was released in late July of this year.

Did the draft personal data protection bill help end an otherwise very ordinary year for the right to privacy with a flourish?

Not one bit. In fact, it does a Make-India-Great-Again dance of its own as it attempts to find new language to advance the same arguments that were unsuccessfully advanced in the right to privacy case.

Sample this. It was argued a year ago that privacy does not require protection as an independent fundamental right because each of the harms that ensues because of a privacy violation are anyway justiceable as violation of other rights – harms such as financial harms, or unwarranted surveillance or reputational loss etc. This was soundly rejected by the Supreme Court bench as it held that privacy was a standalone fundamental right and requires protection as such. However, this principle has found its way into the data protection bill that makes the consequent harm caused due to violation of privacy as a predominant consideration and not violation of privacy per se, which effectively de-recognises the right as a fundamental right. Contrast this with a right such as the right to free speech. How absurd would it be if there is an unlawful government order to take a news story down and if a news publication had to go to court and show harm caused to it by taking the taking down while challenging such an order?

The draft bill also attempts to misstate the reasons as to why it was perceived that such a legislation was needed in the first place. The real need for a privacy legislation is to address the mischief of privacy becoming a hard-to-enforce right both against state and non-state actors in a world which is increasingly looking at personal data as the new resource (like oil) that is to be nationalised, monetised and exploited. But the draft bill attempts to twist it by placing both the need for a flourishing digital economy and privacy of the individual at the same footing. And this is not merely academic nit-picking. Judicial interpretation takes the statement of objects and reasons of a statute as its life blood and each provision in the statute is interpreted keeping the objects and reasons in mind. After all, they say, the life of law is not logic but experience. An attempt to misrepresent the history and the experience that informed the need for this legislation is nothing less than intellectual dishonesty.

The justification of the draft bill for placing the “common good” of the digital economy and the individual right to privacy at the same footing is that rights, we’re told, are not deontological categories but only a means to an end after all. Except, that justification is not supported by the jurisprudence and the nine-judge bench judgment, as had been pointed out. It must be added that such justification is another attempt to undo the Puttaswamy judgment as it reinstates the legal logic that formed the basis of the ADM Jabalpur emergency judgment, which was expressly overruled in the Puttaswamy case. This is not a denial that individual fundamental rights do not have justifications rooted in the utilitarian common good – but only that the common good is not the only justification of any of the fundamental rights. Each of the fundamental rights has multiple justifications ranging from consequentialist justifications, utilitarian justifications to moral justifications rooted in the inherent dignity of every human being.

The centre-staging of the concerns of “digital economy” has an even higher price. The idea of common good that informs that reasoning is closely linked to the idea of common detriment, which effectively goes back to looking at personal data as a resource to be nationalised, monetised and exploited. As we addict the economy to live off citizens’ personal data, the violence and oppression that punctuates the state-versus-people conflicts that relate to resources such as land, oil and minerals will ensue in no time.

The only saving grace in the draft bill is perhaps is its tacit rebuke of many of the past practices of the Aadhaar project. Even so, it must be said that in the past year, the right to privacy took no step forward and two steps back.

Prasanna S. is a Delhi-based lawyer. He assisted the petitioners’ side in the right to privacy/Aadhaar cases in the Supreme Court. He tweets from @prasanna_s.