Discuss the importance of personal data protection in the context of human rights. (2019, 15 Marks)
Article 12 of the UDHR (1948) and Article 17 of the ICCPR (1966) protect every person against arbitrary interference with privacy, family, home and correspondence. In a data-driven economy, personal information is a source of profit for firms and of power for states, so data protection has become the working form of the old right to privacy, and a condition for many other rights.
Why it is a human rights question
- Dignity and autonomy. In K.S. Puttaswamy v Union of India (2017) a nine-judge bench held privacy intrinsic to life and liberty under Article 21; Justice D.Y. Chandrachud’s lead opinion named informational privacy a facet of it and urged a robust data protection regime.
- A gateway right. Profiling and surveillance chill expression, association and dissent. Exposure of religion, caste, health or sexuality invites discrimination, and opaque algorithmic scoring in welfare, credit or policing can deny entitlements without reasons.
- Democracy. The Cambridge Analytica affair (2018) showed that harvested Facebook data could steer electoral choices as easily as consumer ones.
The threats
- Corporate extraction. Search, social media and advertising platforms run on data, which Shoshana Zuboff calls “surveillance capitalism” (2019).
- State surveillance. The Edward Snowden disclosures (2013) and the Pegasus spyware cases showed total access to a device; India’s Supreme Court has not published its technical committee’s report.
- Borderless flows and asymmetry. Data crosses borders faster than law. Citizens of developing countries with weak or recent laws are exposed to transnational firms without effective remedy, which feeds the demand for data sovereignty.
The response
- Global norms. UN General Assembly resolution 68/167 on privacy in the digital age (2013) held that rights offline apply online; a Special Rapporteur on privacy followed in 2015.
- Models. The EU’s GDPR (applied from 2018) treats data protection as a fundamental right, with consent, purpose limitation, minimisation and erasure. The United States regulates sector by sector as consumer protection.
- India. The Digital Personal Data Protection Act, 2023, after the Justice B.N. Srikrishna Committee (2018), became operative through Rules notified on 13 November 2025; most duties of data fiduciaries bind from 13 May 2027.
The contested balance
Data also improves targeted welfare, public health and security, so the test is proportionality: legality, legitimate aim, necessity and safeguards. Puttaswamy (Aadhaar) (2018) applied it, upholding Aadhaar for welfare but striking down its use by private firms. The DPDP Act is now on trial by the same test. Petitions say its state exemptions (Section 17), an executive-chosen Data Protection Board and Section 44(3), which removes the public-interest override from the RTI Act’s personal-information exemption, fail it. On 16 February 2026 the Supreme Court issued notice, refused a stay and called for a larger bench; the challenge was heard again on 7 August 2026 and is pending.
Conclusion
Data protection is not a technical matter but a precondition for most other rights in the digital age. The state is both its guarantor and a possible violator, so the measure of any regime is independent oversight and limits on the state itself, ensuring that data serves the people it describes rather than exploiting them.