Puttaswamy Declared Privacy a Fundamental Right. India's Surveillance Apparatus Barely Noticed

On 24 August 2017, nine judges of the Supreme Court delivered a judgment that, on paper, should count among the most significant in the Republic's history: privacy, they held unanimously, is a fundamental right, intrinsic to life and personal liberty under Article 21, and it does not depend on being separately enumerated in the constitutional text to receive full protection. Justice K.S. Puttaswamy versus Union of India overturned two earlier, much narrower rulings — M.P. Sharma from 1954 and Kharak Singh from 1962 — that had held privacy was not a distinct fundamental right at all, rulings that had been used for decades to justify everything from unregulated police surveillance to intrusive domiciliary visits. The 2017 judgment was sweeping in its reasoning and unambiguous in its conclusion. What it could not do, because judgments cannot legislate, was rewrite the statutory framework under which India's surveillance actually operates, and that framework has changed remarkably little since.

The law surveillance still runs on

Telephone interception in India is still governed principally by Section 5(2) of the Indian Telegraph Act, a colonial-era statute from 1885, as interpreted by the Supreme Court's own 1996 ruling in PUCL versus Union of India, which introduced procedural safeguards — written orders, periodic review committees, a maximum duration for interception orders — precisely because the bare statutory text offered almost none. Internet-based surveillance operates under Section 69 of the Information Technology Act, 2000, and its associated 2009 rules, which permit interception, monitoring and decryption of any information transmitted through a computer resource on grounds as broad as "the sovereignty or integrity of India" or "public order," approved through an executive authorisation process that involves no judicial warrant at any stage. Puttaswamy's own three-part test for any restriction on privacy — legality, necessity and proportionality — has been cited by petitioners challenging aspects of this framework in subsequent litigation, but the framework itself, including the absence of judicial authorisation for interception, has not been struck down or substantially reformed by any court in the years since.

Pegasus and the limits of what litigation alone can achieve

The 2021 revelations that Pegasus spyware, sold by the Israeli firm NSO Group exclusively to government clients, had allegedly been used against journalists, opposition politicians and civil society figures in India produced a genuinely significant judicial response: the Supreme Court constituted a technical committee to investigate, an unusual step that acknowledged the seriousness of the allegations. But the committee's report, submitted in 2022, found it could not conclusively determine whether Pegasus had been used on the specific phones examined, partly because targets did not preserve devices in a forensically useful state, and partly because the government of India declined to cooperate with the inquiry beyond a limited extent, citing national security. The episode is a useful illustration of a broader pattern: even when courts are willing to engage seriously with surveillance overreach, the interlocking realities of state secrecy claims, technical evidentiary difficulty and the absence of any independent surveillance oversight body outside the executive itself, mean judicial intervention alone struggles to produce accountability.

Aadhaar: the case that both affirmed and complicated the right

Puttaswamy's aftermath is entangled with the Aadhaar litigation in ways that are often oversimplified in retrospective accounts. The five-judge Aadhaar judgment in 2018, decided in the shadow of the privacy ruling that had just preceded it, upheld the core Aadhaar scheme as constitutionally valid, including its use for welfare delivery and its linkage to the filing of income tax returns, while striking down its mandatory linkage to bank accounts and mobile phone connections as disproportionate. Privacy advocates who had hoped Puttaswamy would translate into a more restrictive reading of Aadhaar's data-collection architecture were, to a significant extent, disappointed by that outcome, which shows that establishing privacy as a fundamental right did not settle, on its own, how the proportionality test would be applied to any specific programme; it merely established that the test had to be applied at all, a real but partial victory.

The Digital Personal Data Protection Act: progress with a wide carve-out

India finally passed a comprehensive data protection statute in 2023, the Digital Personal Data Protection Act, after multiple earlier draft bills going back to the Justice Srikrishna Committee's 2017-18 report had stalled or been withdrawn. The Act establishes real obligations on private data processors regarding consent, purpose limitation and breach notification, which is a genuine advance over the near-total absence of statutory data protection that preceded it. But the Act also contains, in Section 17, a broad exemption allowing the government to exempt any of its own instrumentalities from most of the Act's obligations "in the interest of sovereignty and integrity of India" and similar grounds — precisely the same grounds under which surveillance orders are currently authorised — which means the very entities most implicated in privacy concerns about state surveillance are also the entities the Act most readily allows to exempt themselves from its discipline. Civil liberties groups pointed this out during the legislative process; the provision passed largely unchanged.

The counter-argument states actually make, and its limits

Governments across the political spectrum, when defending this framework, tend to make a version of the same argument: India faces genuine and serious internal security threats — cross-border terrorism, organised crime, insurgency in specific regions — and a surveillance regime requiring prior judicial warrants for every interception, as exists in some other democracies, would introduce delays that could be operationally costly in fast-moving security situations. This is not a frivolous argument, and comparative practice shows even judicially robust democracies balance warrant requirements against emergency exceptions rather than insisting on prior judicial sign-off in literally every case. The weakness in the Indian version of this argument is not the underlying security concern; it is the near-total absence of any independent, standing oversight mechanism — parliamentary, judicial or otherwise — that reviews surveillance authorisations even after the fact, which most comparable democracies do provide in some form even while accepting emergency exceptions to prior authorisation.

A right declared, an architecture unreformed

What Puttaswamy actually achieved should not be understated: it closed off the possibility, previously left open by Kharak Singh, that the state could argue privacy simply was not a constitutional value requiring justification at all. Every subsequent surveillance dispute in India is now, at minimum, forced to engage with a proportionality standard that did not clearly exist before 2017. But a constitutional declaration is a starting point for statutory reform, not a substitute for it, and eight years on, the statutes actually governing interception remain substantially the ones Puttaswamy's own reasoning called into question. India has, in effect, a first-rate constitutional right to privacy sitting atop a third-rate statutory framework for enforcing it, and the gap between the two is where the right currently, and precariously, lives.