In a landmark judgment a nine-judge bench of the Supreme Court of India has unanimously held that privacy is a constitutionally protected right to be guaranteed by the fundamental rights contained in part III of India’s constitution. While not explicitly defining “privacy”, the court observed that privacy includes at its core the preservation of personal intimacies, the sanctity of family life, marriage, procreation, the home and sexual orientation.
This decision has wider implications, from both a geo-social and a business perspective. Some of the business implications of the right to privacy verdict are analysed below.
The major implications of the verdict will be seen in the virtual space of the internet and the associated sectors of e-commerce, search engines and data protection companies. The privacy issues related to the virtual world will be compounded as more and more Indians are using the internet platform, with internet penetration currently standing at 31% of India’s total population.
The consumer rights embedded in the verdict will have far reaching consequences for the way the data are collected and used (or misused) by telecommunication companies, internet service providers, search engines, e-commerce companies, app developers, etc. Companies in these sectors from now on will be under immense scrutiny and will be questioned in the courts for infringing the privacy rights of citizens.
At the moment, the different stakeholders associated with the virtual world are able to collect consumers’ data (at times) with their consent for targeted marketing provided the data are not resold to a third party for such a stakeholder’s benefit.
Requiring companies to disclose the purpose of their consumer data collection would raise a question as to whether the companies have a right to privacy. Can they invoke this verdict and say that from now on the government has no right to look into a business and seek details? Can a mobile messaging service provider deny the state security agencies the details of a terror suspect? What impact will it have on the ease of doing business in India and what are its implications for the government’s Make in India initiative? It is too soon to answer such questions but court battles are bound to be fought as there are going to be different interpretations of privacy and the exceptions to privacy enmeshed in the verdict on account of “state interest”.
On the other hand, this verdict has the potential of burgeoning business for data protection companies. In the present day and age, the world faces the threat of data breaches and financial frauds leading to monetary losses. As per various estimates, in India in 2016, ₹13 million (US$200,000) was reportedly lost in fraudulent transactions because of a malware attack on debit card details. Indeed, our financial data are so vulnerable that out of all kinds of data breaches in 2016, 73% were based on unauthorized access to financial data and identity theft.
India is seen by the world community as a nation having comparative advantage in the service sector especially in the domain of information and communication technology. India can help build capacities in other developing countries which have faced various bank heists like in 2016 when the Bangladesh Central Bank was swindled out of US$81 million. The world’s big four consulting firms could also start to operate data privacy and cyber security verticals in India, which presently are being operated from their North America and Europe offices.
As discussed above, there are various business and commercial implications of this judgment. The full effect of the judgment will be fully felt only in future when a balance will be reached between individuals and the state; individuals and business; and business and the state. Indeed, as recently as 6 September, notwithstanding the contentions by a US-based social media company and its mobile messaging service that their operations are in line with India’s rules and regulations and that a major search engine is doing much worse when it comes to users’ data and information protection, the Supreme Court of India questioned them on users’ data and information breach. Going forward, restraining orders are also expected, if these companies are found to be sharing data with third parties.
Ultimately, all verdicts and laws must uphold the right to life and quality of life as also the development of business and commerce through online and technology-driven growth. A balance among all the stakeholders in the geo-social and geo-economic arena must be met especially in this fast changing world.
(This article was originally published in India Business Law Journal - https://www.vantageasia.com/privacy-verdict-top-court-implications-business/)