The Constitution at 76: Privacy, Technology and the Future of Fundamental Rights

The Constitution of India came into force on 26 January 1950. Seventy-six years later, its core guarantees face pressures that no drafter could have anticipated: mass surveillance infrastructure, algorithmic decision-making in public services, social media as the primary arena of public discourse, and the collection and monetisation of personal data at a scale that reshapes power relations between individuals and institutions. The Constitution has not changed in its fundamental structure, but the jurisprudence that gives its provisions practical meaning continues to evolve. This article examines how constitutional guarantees under Part III are being interpreted and tested in the context of technology, and what those developments mean for businesses and professionals operating in India today.

Privacy as a Fundamental Right: From Puttaswamy to Practice

The nine-judge bench decision in Justice K.S. Puttaswamy v. Union of India (2017) 10 SCC 1 settled conclusively that the right to privacy is an intrinsic component of the right to life and personal liberty under Article 21. The judgment recognised informational privacy, bodily integrity, and decisional autonomy as protected dimensions of that right. In the years since, the practical implications of Puttaswamy have been worked out gradually through litigation. Courts have applied the proportionality framework established in that judgment to assess whether state interference with privacy is backed by law, pursues a legitimate aim, and deploys the least restrictive means available. For businesses, the judgment has constitutional significance beyond the regulatory: it establishes that individuals have a constitutionally protected interest in data about themselves, and that processing that data without a legal basis engages a fundamental right, not merely a statutory one.

Surveillance, Interception and the Absence of a Judicial Warrant Requirement

India’s legal framework for communications surveillance, primarily the Indian Telegraph Act, 1885 and the Information Technology Act, 2000, does not require prior judicial authorisation before the state intercepts communications. Interception orders are issued by executive authorities under Section 5(2) of the Telegraph Act and Section 69 of the IT Act. The absence of a mandatory judicial warrant, combined with the opacity of oversight mechanisms, has been the subject of sustained constitutional challenge. The Supreme Court’s directions in PUCL v. Union of India (1997) 1 SCC 301 established procedural requirements for telephone interception, but those safeguards predate the scale of contemporary digital surveillance. The petitions arising from the Pegasus spyware disclosures brought the constitutional dimensions of state surveillance back into focus, and the technical committee appointed by the Supreme Court highlighted limitations in the legal framework governing covert access to personal devices. For businesses, the practical implication is that employee communications conducted on company infrastructure are potentially subject to interception under the existing executive-authorised framework, without the oversight that a judicial warrant requirement would provide.

Article 19 and the Regulation of Online Speech

Article 19(1)(a) guarantees freedom of speech and expression, subject to the reasonable restrictions in Article 19(2). The interface between this guarantee and the regulation of online content has generated significant litigation. The Supreme Court struck down Section 66A of the IT Act in Shreya Singhal v. Union of India (2015) 5 SCC 1, holding that its broad and vague prohibitions on "offensive" online communication were not saved by any of the grounds in Article 19(2). Section 66A’s effective application by police forces despite its invalidation has remained a documented concern. The 2021 amendments to the Intermediary Guidelines introduced requirements for traceability of encrypted messages and mandatory content takedown within 36 hours of government orders. These requirements engage Article 19(1)(a) in ways the courts have not yet definitively resolved. Businesses operating social media platforms or messaging services in India must navigate a framework where the constitutional boundaries of permissible content regulation remain actively contested.

The DPDP Act and Constitutional Adequacy

The Digital Personal Data Protection Act, 2023 is the legislative response to the constitutional obligation identified in Puttaswamy to put personal data protection on a statutory footing. The Act establishes consent-based processing, purpose limitation, and data minimisation principles, and creates the Data Protection Board as an adjudicatory mechanism. Critics have noted that the Act’s exemptions are broad: the central government may exempt any government instrumentality from the Act’s requirements by notification, and processing for national security purposes is entirely outside its scope. Whether these exemptions satisfy the proportionality standard established in Puttaswamy has not yet been tested before the Supreme Court. The constitutional adequacy of the Act’s safeguards against state surveillance, in particular, remains an open question. For compliance purposes, businesses should treat the Act’s requirements as a floor rather than a ceiling, and monitor evolving judicial interpretation of the constitutional privacy standard.

Algorithmic Decision-Making and the Right to Equality

Article 14 guarantees equality before the law and equal protection of the laws. As government services and private sector decisions increasingly rely on algorithmic systems, the constitutional implications of automated decision-making are receiving attention. An algorithm that systematically disadvantages a class of persons defined by protected characteristics engages Article 14 and, where public employment or social benefit allocation is involved, Articles 15 and 16 as well. The absence of any obligation to explain or review algorithmic decisions in most current Indian regulatory frameworks creates a gap between the constitutional guarantee of equality and its practical enforceability in data-driven contexts. Businesses deploying automated decision systems in hiring, credit assessment, or benefit allocation should assess those systems against the equality standard, both as a matter of legal risk management and in anticipation of regulatory developments.

The Path Forward

The Constitution at 76 is not a static document. Its provisions are interpreted by courts through the lens of contemporary conditions, and the Supreme Court has demonstrated over seven decades a willingness to read fundamental rights expansively where doing so serves the values that animate Part III. The technology questions that now engage those provisions will generate a body of jurisprudence over the next decade that will define the constitutional settlement between individual rights and state and commercial power in the digital age. Businesses and individuals should approach compliance not merely as a statutory obligation but as an engagement with constitutional values that the courts will continue to develop.