Informational Privacy

Informational privacy is a person’s interest in controlling how information about them is collected, stored, used and disclosed. It protects autonomy and dignity by limiting unjustified interference with personal data, while permitting lawful and proportionate processing for legitimate purposes.

Constitutional foundation

In Justice K.S. Puttaswamy v. Union of India, 2017, a nine-judge Supreme Court bench unanimously held that privacy is intrinsic to life and personal liberty under Article 21 and to the freedoms guaranteed by Part III. The judgment recognised informational privacy as one dimension of privacy, alongside bodily and decisional privacy.

• Individuals may seek constitutional remedies against unlawful State interference under Articles 32 and 226.

Limits on interference

The right is not absolute. State action affecting informational privacy must satisfy legality, meaning the existence of law; pursue a legitimate State aim; and meet proportionality, so that the intrusion is necessary and not excessive.

• These requirements constrain arbitrary collection, retention, profiling, use and disclosure of personal information by the State.
• Judicial review examines whether the restriction fairly balances individual privacy with a legitimate public purpose.

Statutory protection of personal data

The Digital Personal Data Protection Act, 2023 provides a framework for processing digital personal data. It imposes duties on data fiduciaries, requires valid consent or another statutorily recognised use, and grants individuals rights including access to information, correction, erasure and grievance redressal.

• For the Act, a child is a person below 18 years, and processing generally requires verifiable consent of a parent or lawful guardian.
• Subject to statutory exceptions, the Act prohibits processing likely to harm a child’s well-being, tracking or behavioural monitoring of children, and targeted advertising directed at them.
• The statutory framework operationalises privacy obligations for both public and private data fiduciaries, while the fundamental right primarily restrains State action.