Hot News

Privatising Privacy

Privatising Privacy

In Franz Kafka’s “The Trial”, the central character, Josef K, is tried for a crime he has no knowledge of. The process begins subtly, with K being placed under observation. He is told that there is a large and powerful authority that will be dealing with him from then on. This is borne out by the way that many pairs of eyes are trained on him: neighbours peer into the window, work colleagues show up uninvited at his apartment, strangers know all about his case.

From the moment that he becomes the accused man and so the object of suspicion, he suffers the loss of his privacy. No one causes him harm, no one locks him up, even his initially belligerent outbursts at the court go unpunished and no one contests his right to keep his management position at a bank. Even so, K feels like a hunted animal, an impression Kafka steps up to the point where even the reader loses the ability to draw a clear distinction between real threats and paranoia. The long and short of it being K is reduced from an individual to data compiled in a dossier.

Now, had the Supreme Court’s recent landmark verdict making individual privacy a fundamental right not came through, K’s fate could very well have been the future of the Indian citizenry. Punching holes in individual privacy, the government had called for the allocation of biometrics-aided personal identification number, which limits persons to dossiers and reams of data subject to state surveillance.

While the government, in effect the state machinery, vociferously claimed that informational and individual privacy do not hold a chance before compelling state interests and are not absolute rights, the Court turned the tide in favour of the individual. With the privacy ruling, the Court has ensured that the state shall not be the peeping tom and hound the citizens, like it happened with Josef K in “The Trial”.

However, as it stands now, the verdict will have a far-reaching impact on daily lives, as everything from a trivial Know Your Customer (KYC) form to the more complex idea of reproductive rights will come under the ambit of the privacy ruling.

Stephen King in “Firestarter” wrote, “No one likes to see a government folder with his name on it.” But the larger premise of Aadhaar, the world’s largest biometric project, is just that – to maintain dossier on each individual. Presently, of the Indian population of 1.3 billion people, data of nearly 1.17 billion has been documented. The project ran into rough weather after several petitioners challenged Aadhaar claiming that it goes against their right to privacy. The Aadhaar programme was introduced by the Congress government but it kept going strength to strength even after the Bharatiya Janata Party assumed power in 2014. The latter’s obsession with the Aadhaar’s unique identification system went to such great lengths that it demanded Aadhaar be linked to PAN card and used for filing income tax returns. Notably, the government had also made a strong pitch for the use of Aadhaar number to register deaths in order to prevent “identity fraud”. However, the reading of the privacy judgment and other SC verdicts on the biometric-based identity scheme show that Aadhaar could lose its position of eminence against pre-existing identity proofs.

Biometrics data, which includes photographs, fingerprints and iris scans, forms the backbone of the Aadhaar system as these are the basis on which unique identification number is allotted. It goes without saying that such a large repository of biometric information can be used for mass surveillance. Additionally, Aadhaar doesn’t use basic principles of cryptography, and much of the security defences it uses are not known. In fact, identity theft with the use of biometrics can be a cakewalk as a gummy bear is enough to store fingerprint and a high resolution camera can easily capture iris scans. Also, by issuing identification cards for animals, including a dog named Tommy Singh, and the Hindu god Lord Hanuman, Aadhaar is not without lapses.

Another set of data compilation practice that may be under scrutiny is the preservation of health records. Medical records are confidential documents, the publication of which can lead to embarrassment, scorn and lose of opportunities, both career and academic. The privacy judgment is also likely to place stringent measures on the KYC forms, which companies insist the customer fill. Although these are for the purpose of tailoring services to the customers’ preferences, the Court notes that insurance firms, banks and credit card companies are treating individual profiles as commodities.

In fact, under the right to privacy verdict, profiling of any kind can be deemed as unlawful. The 2016 regulations of European Union defines profiling as the “automated processing of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences”.

While it is understood that every individual is bound to reveal/share a few nuggets of information about themselves to authorities or institutions, profiling will henceforth run into legal trouble when these bits of particulars are no longer confined to silos and shared with a third party, like a private-sector telemarketing service.

The crackdown of the SC verdict extends to the realm of data mining as well. Justice D Y Chandrachud mentioned three internationally accepted aspects of privacy: spatial control, decisional autonomy and informational control. The last aspect is of particular relevance in today’s “era of ubiquitous dataveillance”. Surreal are the ways in which personal information is hoarded, used and abused in the digital age.

To elucidate, the Court noted: “Uber, the world’s largest taxi company, owns no vehicles. Facebook, the world’s most popular media owner, creates no content. Alibaba, the most valuable retailer, has no inventory. And Airbnb, the world’s largest accommodation provider, owns no real estate. Something interesting is happening. Uber knows our whereabouts and the places we frequent. Facebook at least knows who we are friends with. Alibaba knows our shopping habits. Airbnb knows where we are travelling to.”

The legalese extended to include online shopping as well, noting that buying stuff on the Internet leaves electronic footprint, which companies can use to determine choices and interests of the individual. Nearly 2 billion people are on Facebook, disseminating personal data that can be mined by third parties. Just as it happens, cyberspace is the new frontier for gathering personal information, and its power has only begun to be exploited. In fact, the ads that we see on our social media accounts and the websites we visit is already tailored to our preferences, taking into consideration our choices.

It goes without saying that privacy is now the price we pay for all of the web services that we consume every day for free. Displaying acute farsightedness, the Bench also brought to the fore the evolution of ideas of piracy as technologies matured. Justice Chandrachud pointed out the trendy “wearable devices” and the extensive amount of personal data it stores could compromise privacy.

For example, imagine that you wake up to the alarm in your wearable device, your smartphone, which is already linked to your hand gadget, shows you slept poorly. You realise you are late and head to work in haste. Caught in traffic, you have no time for breakfast. After hours of planting yourself in front of the computer, you settle for a couple of paranthas with a huge chunk of butter. This more-than-filling lunch is followed by more computer time and endless cups of coffee. You leave work exhausted and with no strength for an evening workout session. You reach home and crash with takeaway pizza and a couple of beers, and browse Facebook on your smartphone. You even upload an Instagram photo of your supposed dinner and share a Snapstory. It is post midnight when you finally sleep.

That you are leading a sedentary lifestyle is not the only harm happening in your life. By connecting your wearable device and your smartphone and linking your social media accounts, you are, in fact, exposing yourself to great damage. The data stored on your devices can be accessed by a malicious third party or a hacker through a data breach and sold to unscrupulous organizations that want to use that data to assess your health risks. In the process, you could end up facing steep increases in health insurance, or even a policy cancellation. The risk of this is so real that companies are buying data breach insurance to protect themselves in the case of consumer information getting into the wrong hands.

Further, the SC ruling also intersects the discussions revolving around contentious topics like reproductive rights, sexuality and euthanasia.

Although not mentioned in the text of the Constitution in so many words, reproductive rights are inherent to right to life and liberty, just like right to privacy. As it is enshrined in Article 21 of the Constitution, a woman’s right to make reproductive choices is also a dimension of personal liberty. More importantly, the woman also reserves the right to “abstain from procreating”.

As for sexuality and sexual identity, marriage, procreation and sexual orientation are all integral to the integrity of the individual, according to the Supreme Court. Therefore, the 2013 judgment reinstating Section 377 of the Indian Penal Code that criminalises homosexuality strikes a discordant note within the larger framework of the privacy rights. LGBT rights are inherent to right to life and liberty, and equal protection demands protection of the identity of every individual without discrimination.

Despite the fact that Indian law disallows euthanasia or medically assisted suicide, the SC’s favourable verdict could also pave way to right to die as the right to privacy invests in the individual the right to refuse food and/or medicine. Justice J Chelameswar explained thus, “An individual’s right to refuse life prolonging medical treatment or terminate his life is another freedom which falls within the zone of the right of privacy.”

The judgment also recognised the Kafkaesque dystopia that state surveillance can result in, as was explained in the case of Josef K mentioned in the beginning, and came down heavily on unauthorised phone tapping.

When the state has the right to intrude in a citizen’s life, there can be no personal space. The world has shrunk to become a global village of information, but in this process it places curbs on individual liberty, leading to a kind of dystopia. It also becomes incompatible with the democratic structure, which the Constitution promotes. The democratic framework of our country is built on the bedrock of the Universal Adult Franchise, secret ballot exercised in privacy. Now if the private exercise were to be made a public affair, elections would no longer be fair. Therein lies the efficacy of the privacy ruling. Marlon Brando rightly said, “Privacy is not something that I’m merely entitled to, it’s an absolute prerequisite.”

(Published on 04th September 2017, Volume XXIX, Issue 36)